一、registry私有仓库实现加密仓库
在/media目录下创建目录registry,用于存放registry私有仓库的镜像数据
[root@server1 ~]# cd /media/
[root@server1 media]# mkdir registry
配置服务端(server1):
1、创建certs证书,生成服务器私钥
[root@server1 ~]# cd /mnt/docker/
[root@server1 docker]# mkdir certs #在哪个目录下创建certs都可以,该目录的名字随意给
[root@server1 docker]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/xin.org.key -x509 -days 365 -out certs/xin.org.crt #必须在certs目录的上一层目录执行(由命令决定的)
Generating a 4096 bit RSA private key
..........................................................................................................++
..........++
writing new private key to 'certs/xin.org.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn #国家的名字
State or Province Name (full name) []:shanxi #省的名字
Locality Name (eg, city) [Default City]:xi'an #市的名字
Organization Name (eg, company) [Default Company Ltd]:linux #公司的名字
Organizational Unit Name (eg, section) []:redhat #部门的名字
Common Name (eg, your name or your server's hostname) []:xin.org #域名(必须上面指定的xin.org)
Email Address []:root@xin.com #email地址
查看证书、私钥
2、启动仓库
[root@server1 certs]# cd ..
[root@server1 docker]# docker run -d \ #必须在certs目录的上一层目录执行(由命令决定的)
> --restart=always \ #表示开机自启
> --name registry1 \
> -v "$(pwd)"/certs:/certs \
> -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \ #必须是0.0.0.0:443
> -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/xin.org.crt \
> -e REGISTRY_HTTP_TLS_KEY=/certs/xin.org.key \
> -p 443:443 \
> -v /media/registry:/var/lib/registry \
> registry:2.3.1
查看运行的registry1容器
查看443端口(https)
3、编写/etc/hosts文件,增加域名解析
[root@server1 ~]# vim /etc/hosts
172.25.83.1 server1 xin.org
[root@server1 ~]# docker tag rhel7:nginx4 xin.org/rhel7:nginx4
[root@server1 ~]# cd /etc/docker/
[root@server1 docker]# mkdir certs.d #该目录的名字必须是certs.d目录
[root@server1 docker]# cd certs.d/
[root@server1 certs.d]# mkdir xin.org #该目录的名字必须是xin.org(前面指定的域名)
[root@server1 certs.d]# cd xin.org/
[root@server1 xin.org]# cp /mnt/docker/certs/xin.org.crt ca.crt #这个证书的名字可以随意给
[root@server1 xin.org]# ls
ca.crt
[root@server1 xin.org]# docker push xin.org/rhel7:nginx4
The push refers to repository [xin.org/rhel7]
9fd85e6ca660: Pushed #显示Pushed表示上传成功
668afdbd4462: Pushed
nginx4: digest: sha256:96f12a4c433231a0c36d20af593dba0c135fed0aa2d3c180c2c00ac2a9cd5867 size: 739
测试:
1、在server2上编写/etc/hosts文件,增加域名解析;获取证书;并进行测试:下载xin.org/rhel7:nignx4
<1>编写/etc/hosts文件,增加域名解析
<2>获取证书
[root@foundation83 ~]# mkdir /etc/docker/certs.d/xin.org -p #目录的名字必须是这个
[root@server1 xin.org]# scp /etc/docker/certs.d/xin.org/ca.crt root@172.25.83.83:/etc/docker/certs.d/xin.org/ #将server1上的ca.crt文件复制到物理机的/etc/docker/certs.d/xin.org目录下
<3>测试:下载xin.org/rhel7:nignx4
[root@server2 ~]# docker pull xin.org/rhel7:nginx4
nginx4: Pulling from rhel7
269521def953: Pull complete #看到Pull complete表示pull成功
ff969636d6bb: Pull complete
Digest: sha256:96f12a4c433231a0c36d20af593dba0c135fed0aa2d3c180c2c00ac2a9cd5867
Status: Downloaded newer image for xin.org/rhel7:nginx4
改名:
[root@server2 ~]# docker tag xin.org/rhel7:nginx4 rhel7:nginx4
[root@server2 ~]# docker rmi xin.org/rhel7:nginx4
二.加密仓库的访问控制
1.生成鉴权密码文件
[root@server1 ~]# cd /mnt/docker/
[root@server1 docker]# mkdir auth #在哪个目录下创建auth都可以,该目录的名字随意给
[root@server1 docker]# docker run --entrypoint htpasswd registry:2.3.1 -Bbn westoswestos > auth/htpasswd #用户westos(第一个),密码westos(第二个)。必须在auth目录的上一层目录执行(由命令决定的)。其中auth/htpasswd名字可以随便给,但是--entrypoint后面必须是htpasswd。这里>表示重定向,如果还要添加,需要用>>,否则会覆盖之前的。
2.查看生成的认证密码
查看生成的容器(没有在运行)
3.删除仓库registry1(映射到本地主机的443端口),并删除之前存放registry私有仓库的镜像数据的目录(/media/registry)下的数据,防止冲突。
[root@server1 auth]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ea3602dd0021 registry:2.3.1 "/bin/registry /etc/…" 13 hours ago Up 24 minutes 0.0.0.0:443->443/tcp, 5000/tcp registry1
[root@server1 auth]# docker rm -f registry1
[root@server1 auth]# cd /media/registry/
[root@server1 registry]# ls
docker
[root@server1 registry]# rm -rf docker/
[root@server1 registry]# ls
4、启动registry1
[root@server1 registry]# cd /mnt/docker
[root@server1 docker]# docker run -d \ #必须在certs目录的上一层目录执行(由命令决定的)
> --restart=always \
> --name registry1 \
> -v "$(pwd)"/certs:/certs \
> -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
> -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/xin.org.crt \
> -e REGISTRY_HTTP_TLS_KEY=/certs/xin.org.key \
> -p 443:443 \
> -v /media/registry:/var/lib/registry \
> -v "$(pwd)"/auth:/auth \
> -e "REGISTRY_AUTH=htpasswd" \
> -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
> -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
> registry:2.3.1
查看运行的registry1容器
查看443端口(https)
5、用户登录
[root@server1 docker]# docker login xin.org
Username: westos #用户westos
Password: #密码westos
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
登陆成功之后,会生成,相应的认证文件。下次不用再登录。
6、上传xin.org/rhel7:nginx4(上传的镜像随意选,但是/前面必须是前面设定的域名xin.org)
[root@server1 docker]# docker tag rhel7:nginx4 xin.org/rhel7:nginx4
[root@server1 .docker]# docker push xin.org/rhel7:nginx4
The push refers to repository [xin.org/rhel7]
9fd85e6ca660: Pushed #显示Pushed表示上传成功
668afdbd4462: Pushed
nginx4: digest: sha256:96f12a4c433231a0c36d20af593dba0c135fed0aa2d3c180c2c00ac2a9cd5867 size: 739
server2测试:
<1>登录进行认证
[root@server2 kiosk]# docker rmi rhel7:nginx4 #删除上次实验pull的镜像
[root@server2 kiosk]# docker login xin.org #或docker login -u westos -p westos 172.25.83.1
Username: westos #用户westos
Password: #密码:westos
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
#退出xin.org命令为:docker logout xin.org
[root@foundation83 kiosk]# docker pull xin.org/rhel7:nginx4
#改名
[root@server2 ~]# docker tag xin.org/rhel7:nginx4 rhel7:nginx4
[root@server2 ~]# docker rmi xin.org/rhel7:nginx4