harbor仓库部署
1.Harbor简介
Harbor是一个用于存储和分发Docker镜像的企业级Registry服务器，可以用来构建企业内部的Docker镜像仓库。
它在Docker的开源项目 Distribution的基础上，添加了一些企业需要的功能特性，如镜像同步复制、漏洞扫描和权限管理等。
它的主要功能包括：
- 基于角色的访问控制：用户和存储库通过“项目”进行组织，用户可以对项目下的图像具有不同的权限。
- 基于策略的映像复制：可以在多个注册表实例之间复制（同步）映像，并在出现错误时自动重试。非常适合负载平衡、高可用性、多数据中心、混合和多云方案。
- 漏洞扫描：Harbor定期扫描图像并警告用户漏洞。
- LDAP/AD 支持：Harbor 与现有的企业 LDAP/AD 集成，用于用户身份验证和管理。
- 图像删除和垃圾回收：可以删除图像，并且可以回收其空间。
- 公证：可以确保图像的真实性。
- 图形用户门户：用户可以轻松浏览、搜索存储库和管理项目。
- 审计:跟踪对存储库的所有操作。
- RESTful API:支持大多数管理操作的RESTful API，易于与外部系统集成。
- 易于部署:提供在线和离线安装程序。
Docker compose
Harbor在物理机上部署是非常难的，而为了简化Harbor的应用，Harbor官方直接把Harbor做成了在容器中运行的应用，而且这个容器在Harbor中依赖类似redis、mysql、pgsql等很多存储系统，所以它需要编排很多容器协同起来工作，因此VMWare Harbor在部署和使用时，需要借助于Docker的单机编排工具(Docker compose)来实现。
2.所需的部署条件
需要安装docker，有docker-compose命令
安装docker
[root@localhost ~]# cd /etc/yum.repos.d/
[root@localhost yum.repos.d]# wget https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/docker-ce.repo
[root@localhost yum.repos.d]# sed -i 's@https://download.docker.com@https://mirrors.tuna.tsinghua.edu.cn/docker-ce@g' docker-ce.repo
[root@localhost yum.repos.d]# dnf -y install docker-ce
配置镜像加速器
[root@localhost yum.repos.d]# sudo mkdir -p /etc/docker
[root@localhost yum.repos.d]# sudo tee /etc/docker/daemon.json <<-'EOF'
> {
> "registry-mirrors": ["https://6wh26kc0.mirror.aliyuncs.com"]
> }
> EOF
{
"registry-mirrors": ["https://6wh26kc0.mirror.aliyuncs.com"]
}
[root@localhost yum.repos.d]# sudo systemctl daemon-reload
[root@localhost yum.repos.d]# sudo systemctl restart docker
[root@localhost yum.repos.d]# systemctl enable docker
Created symlink /etc/systemd/system/multi-user.target.wants/docker.service → /usr/lib/systemd/system/docker.service.
安装docker-compose
//修改名称
[root@localhost ~]# hostnamectl set-hostname harbor.example.com
[root@localhost ~]# bash
[root@harbor ~]# hostname
harbor.example.com
//安装docker-compose命令
[root@harbor ~]# ls -a
. .bash_history .bash_profile .config .tcshrc anaconda-ks.cfg
.. .bash_logout .bashrc .cshrc .wget-hsts
[root@harbor ~]# DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
[root@harbor ~]# mkdir -p $DOCKER_CONFIG/cli-plugins
[root@harbor ~]# ls -a
. .bash_history .bash_profile .config .docker .wget-hsts
.. .bash_logout .bashrc .cshrc .tcshrc anaconda-ks.cfg
[root@harbor ~]# cd .docker/
[root@harbor .docker]# ls
cli-plugins
[root@harbor .docker]# curl -SL https://github.com/docker/compose/releases/download/v2.7.0/docker-compose-linux-x86_64 -o $DOCKER_CONFIG/cli-plugins/docker-compose
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:20 --:--:-- 0curl: (7) Failed to connect to github.com port 443: Connection refused
//已经下载好的上传至root下
[root@harbor ~]# ls
anaconda-ks.cfg docker-compose-linux-x86_64.octet-stream
[root@harbor ~]# mv docker-compose-linux-x86_64.octet-stream /root/.docker/cli-plugins/docker-compose
//配置docker-compose
[root@harbor ~]# cd /root/.docker/cli-plugins/
[root@harbor cli-plugins]# ls
docker-compose
[root@harbor cli-plugins]# chmod +x docker-compose
[root@harbor cli-plugins]# ll
total 25188
-rwxr-xr-x. 1 root root 25792512 Aug 12 09:25 docker-compose
[root@harbor cli-plugins]# pwd
/root/.docker/cli-plugins
[root@harbor cli-plugins]# ln -s /root/.docker/cli-plugins/docker-compose /usr/bin/
[root@harbor cli-plugins]# cd
[root@harbor ~]# which docker-compose
/usr/bin/docker-compose
[root@harbor ~]# docker compose version
Docker Compose version v2.7.0
3.部署harbor
//安装harbor
[root@harbor ~]# wget https://github.com/goharbor/harbor/releases/download/v2.5.3/harbor-offline-installer-v2.5.3.tgz
//将已经下载完成的上传至root下
[root@harbor ~]# ls
anaconda-ks.cfg harbor-offline-installer-v2.5.3.tgz
[root@harbor ~]# tar xf harbor-offline-installer-v2.5.3.tgz -C /usr/local/
//配置harbor
[root@harbor ~]# cd /usr/local/
[root@harbor local]# ls
bin etc games harbor include lib lib64 libexec sbin share src
[root@harbor local]# cd harbor/
[root@harbor harbor]# ls
LICENSE common.sh harbor.v2.5.3.tar.gz harbor.yml.tmpl install.sh prepare
[root@harbor harbor]# cp harbor.yml.tmpl harbor.yml
[root@harbor harbor]# vim harbor.yml
hostname: harbor.example.com
#https: //注释
# https port for harbor, default is 443
#port: 443
# The path of cert and key files for nginx
#certificate: /your/certificate/path //注释
#private_key: /your/private/key/path //注释
[root@harbor harbor]# ./install.sh
[+] Running 10/10
⠿ Network harbor_harbor Created 0.2s
⠿ Container harbor-log Started 0.8s
⠿ Container registryctl Started 2.6s
⠿ Container harbor-db Started 2.7s
⠿ Container redis Started 2.7s
⠿ Container registry Started 2.8s
⠿ Container harbor-portal Started 2.6s
⠿ Container harbor-core Started 3.2s
⠿ Container harbor-jobservice Started 3.9s
⠿ Container nginx Started 3.9s
✔ ----Harbor has been installed and started successfully.----
[root@harbor harbor]# ss -anlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 127.0.0.1:1514 0.0.0.0:*
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:80 [::]:*
LISTEN 0 128 [::]:22 [::]:*
访问测试
4.设置开机自启
[root@harbor harbor]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d9733e6e4e1c goharbor/harbor-jobservice:v2.5.3 "/harbor/entrypoint.…" 13 minutes ago Up 13 minutes (healthy) harbor-jobservice
0842e684ec07 goharbor/nginx-photon:v2.5.3 "nginx -g 'daemon of…" 13 minutes ago Up 13 minutes (healthy) 0.0.0.0:80->8080/tcp, :::80->8080/tcp nginx
354b557fd74e goharbor/harbor-core:v2.5.3 "/harbor/entrypoint.…" 13 minutes ago Up 13 minutes (healthy) harbor-core
7b3be3e09009 goharbor/registry-photon:v2.5.3 "/home/harbor/entryp…" 13 minutes ago Up 13 minutes (healthy) registry
913a2d0fa801 goharbor/harbor-db:v2.5.3 "/docker-entrypoint.…" 13 minutes ago Up 13 minutes (healthy) harbor-db
ecc48ce68cc2 goharbor/redis-photon:v2.5.3 "redis-server /etc/r…" 13 minutes ago Up 13 minutes (healthy) redis
cf3d4e00c154 goharbor/harbor-portal:v2.5.3 "nginx -g 'daemon of…" 13 minutes ago Up 13 minutes (healthy) harbor-portal
972c1f135b71 goharbor/harbor-registryctl:v2.5.3 "/home/harbor/start.…" 13 minutes ago Up 13 minutes (healthy) registryctl
6c7673fbebfa goharbor/harbor-log:v2.5.3 "/bin/sh -c /usr/loc…" 13 minutes ago Up 13 minutes (healthy) 127.0.0.1:1514->10514/tcp harbor-log
//创建脚本进行自启动
[root@harbor ~]# vim /etc/rc.local
#!/bin/bash //开头位置
cd /usr/lcoal/harbor //添加
docker-compose start //添加
[root@harbor ~]# ll /etc/rc.d/rc.local
-rw-r--r--. 1 root root 516 Aug 12 10:17 /etc/rc.d/rc.local
[root@harbor ~]# chmod +x /etc/rc.d/rc.local
//重启查看配置是否成功
[root@harbor ~]# reboot
[root@harbor ~]# ss -anlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 127.0.0.1:1514 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:* [root@harbor harbor]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d9733e6e4e1c goharbor/harbor-jobservice:v2.5.3 "/harbor/entrypoint.…" 13 minutes ago Up 13 minutes (healthy) harbor-jobservice
0842e684ec07 goharbor/nginx-photon:v2.5.3 "nginx -g 'daemon of…" 13 minutes ago Up 13 minutes (healthy) 0.0.0.0:80->8080/tcp, :::80->8080/tcp nginx
354b557fd74e goharbor/harbor-core:v2.5.3 "/harbor/entrypoint.…" 13 minutes ago Up 13 minutes (healthy) harbor-core
7b3be3e09009 goharbor/registry-photon:v2.5.3 "/home/harbor/entryp…" 13 minutes ago Up 13 minutes (healthy) registry
913a2d0fa801 goharbor/harbor-db:v2.5.3 "/docker-entrypoint.…" 13 minutes ago Up 13 minutes (healthy) harbor-db
ecc48ce68cc2 goharbor/redis-photon:v2.5.3 "redis-server /etc/r…" 13 minutes ago Up 13 minutes (healthy) redis
cf3d4e00c154 goharbor/harbor-portal:v2.5.3 "nginx -g 'daemon of…" 13 minutes ago Up 13 minutes (healthy) harbor-portal
972c1f135b71 goharbor/harbor-registryctl:v2.5.3 "/home/harbor/start.…" 13 minutes ago Up 13 minutes (healthy) registryctl
6c7673fbebfa goharbor/harbor-log:v2.5.3 "/bin/sh -c /usr/loc…" 13 minutes ago Up 13 minutes (healthy) 127.0.0.1:1514->10514/tcp harbor-log
使用Harbor的注意事项：
- 在客户端上传镜像时一定要记得执行docker login进行用户认证，否则无法直接push
- 在客户端使用的时候如果不是用的https则必须要在客户端的/etc/docker/daemon.json配置文件中配置insecure-registries参数
- 数据存放路径应在配置文件中配置到一个容量比较充足的共享存储中
- Harbor是使用docker-compose命令来管理的，如果需要停止Harbor也应用docker-compose stop来停止，其他参数请–help
部署客户端
在拥有docker环境的虚拟机中部署
//修改名字
[root@localhost ~]# hostnamectl set-hostname client
[root@localhost ~]# bash
//添加服务端IP
[root@client ~]# vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.48.151 harbor.example.com //添加
[root@client ~]# ping 192.168.48.151
PING 192.168.48.150 (192.168.48.151) 56(84) bytes of data.
64 bytes from 192.168.48.150: icmp_seq=1 ttl=64 time=0.064 ms
64 bytes from 192.168.48.150: icmp_seq=2 ttl=64 time=0.115 ms
64 bytes from 192.168.48.150: icmp_seq=3 ttl=64 time=0.049 ms
//登录harbor
[root@client ~]# vim /etc/docker/daemon.json
{
"registry-mirrors": ["https://w673ojdv.mirror.aliyuncs.com"], //末尾添加逗号
"insecure-registries": ["harbor.example.com"] //添加
}
[root@client ~]# systemctl restart docker
[root@client ~]# docker login harbor.example.com
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
albertdnp/httpd v1.1 1be8037c305a 2 days ago 789MB
//将自己创建的镜像上传到harbor上
[root@client ~]# docker tag albertdnp/httpd:v1.1 harbor.example.com/library/httpd:v1.1
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
albertdnp/httpd v1.1 1be8037c305a 2 days ago 789MB
harbor.example.com/library/httpd v1.1 1be8037c305a 2 days ago 789MB
[root@client ~]# docker push harbor.example.com/library/httpd:v1.1
The push refers to repository [harbor.example.com/library/httpd]
08a3872d7f33: Pushed
74ddd0ec08fa: Pushed
v1.1: digest: sha256:2529f74a8986eb0b4adf7503b0e0007896cd38e984f6365167434b8e8bf33586 size: 742
查看效果
可以显示上传时间
测试是否能拉取下来
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
albertdnp/httpd v1.1 1be8037c305a 2 days ago 789MB
harbor.example.com/library/httpd v1.1 1be8037c305a 2 days ago 789MB
[root@client ~]# docker rmi -f harbor.example.com/library/httpd:v1.1
Untagged: harbor.example.com/library/httpd:v1.1
Untagged: harbor.example.com/library/httpd@sha256:2529f74a8986eb0b4adf7503b0e0007896cd38e984f6365167434b8e8bf33586
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
albertdnp/httpd v1.1 1be8037c305a 2 days ago 789MB
[root@client ~]# docker pull harbor.example.com/library/httpd:v1.1
v1.1: Pulling from library/httpd
Digest: sha256:2529f74a8986eb0b4adf7503b0e0007896cd38e984f6365167434b8e8bf33586
Status: Downloaded newer image for harbor.example.com/library/httpd:v1.1
harbor.example.com/library/httpd:v1.1
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
albertdnp/httpd v1.1 1be8037c305a 2 days ago 789MB
harbor.example.com/library/httpd v1.1 1be8037c305a 2 days ago 789MB