Docker Private Registry
Docker Registry
Registry用于保存docker镜像，包括镜像的层次结构和元数据。用户可以自建Registry，也可以使用官方的Docker Hub。
Docker Registry分类：
- Sponsor Registry：第三方的Registry，供客户和Docker社区使用
- Mirror Registry：第三方的Registry，只让客户使用
- Vendor Registry：由发布docker镜像的供应商提供的registry
- Private Registry：通过设有防火墙和额外的安全层的私有实体提供的registry
所有的Registry默认情况下都是基于https工作的，这是Docker的基本要求，而我自建Registry时很可能是基于http工作的，但是Docker默认是拒绝使用http提供Registry服务的，除非明确的告诉它，我们就是要用http协议的Registry
Docker Private Registry
Registry的主要作用是托管镜像，Registry运行在容器中，而容器自己的文件系统是随着容器的生命周期终止和删除而被删除的，所以当我们把Registry运行在容器中时，客户端上传了很多镜像，随着Registry容器的终止并删除，所有镜像都将化为乌有，因此这些镜像应该放在存储卷上，而且这个存储卷最好不要放在Docker主机本地，而应该放在一个网络共享存储上，比如NFS。不过，镜像文件自己定义的存储卷，还是一个放在Docker本地、Docker管理的卷，我们可以手动的将其改成使用其它文件系统的存储卷。
这就是使用容器来运行Registry的一种简单方式。自建Registry的另一种方式，就是直接安装docker-distribution软件。
使用docker-distribution自建Registry
找包地址：https://pkgs.org/search/?q=docker-distribution
自建Registry
[root@localhost ~]# yum install -y http://mirror.centos.org/centos/7/extras/x86_64/Packages/docker-distribution-2.6.2-2.git48294d9.el7.x86_64.rpm
[root@localhost ~]# vim /etc/docker-distribution/registry/config.yml
version: 0.1
log:
fields:
service: registry
storage:
cache:
layerinfo: inmemory
filesystem:
rootdirectory: /var/lib/registry
http:
addr: :5000
[root@localhost ~]# systemctl start docker-distribution.service
[root@localhost ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:5000 *:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:2375 *:*
使用自建的Registry去上传镜像
# 使用insecure-registries参数添加http支持
[root@localhost ~]# cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://docker.mirrors.ustc.edu.cn/"],
"bip": "192.168.88.8/24",
"insecure-registries": ["192.168.253.139:5000"]
}
[root@localhost ~]# systemctl restart docker
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
httpd latest f2a976f932ec 9 days ago 145MB
busybox latest beae173ccac6 7 months ago 1.24MB
centos latest 5d0da3dc9764 10 months ago 231MB
[root@localhost ~]# docker tag busybox:latest 192.168.253.139:5000/busybox:v1
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
httpd latest f2a976f932ec 9 days ago 145MB
192.168.253.139:5000/busybox v1 beae173ccac6 7 months ago 1.24MB
busybox latest beae173ccac6 7 months ago 1.24MB
centos latest 5d0da3dc9764 10 months ago 231MB
[root@localhost ~]# docker push 192.168.253.139:5000/busybox:v1
The push refers to repository [192.168.253.139:5000/busybox]
Get "https://192.168.253.139:5000/v2/": http: server gave HTTP response to HTTPS client
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
httpd latest f2a976f932ec 9 days ago 145MB
192.168.253.139:5000/busybox v1 beae173ccac6 7 months ago 1.24MB
busybox latest beae173ccac6 7 months ago 1.24MB
centos latest 5d0da3dc9764 10 months ago 231MB
使用官方镜像自建Registry
[root@localhost ~]# docker run -dit --name registry -p 5000:5000 -v /opt/registry:/tmp/registry registry
Unable to find image 'registry:latest' locally
latest: Pulling from library/registry
79e9f2f55bf5: Pull complete
0d96da54f60b: Pull complete
5b27040df4a2: Pull complete
e2ead8259a04: Pull complete
3790aef225b9: Pull complete
Digest: sha256:169211e20e2f2d5d115674681eb79d21a217b296b43374b8e39f97fcf866b375
Status: Downloaded newer image for registry:latest
91d17ca6b711ecfee336552d90e63920e146ccd43180fa40c2b8e5870d7c816c
[root@localhost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
91d17ca6b711 registry "/entrypoint.sh /etc…" 9 seconds ago Up 8 seconds 0.0.0.0:5000->5000/tcp, :::5000->5000/tcp registry
[root@localhost ~]# docker tag busybox:latest 192.168.253.139:5000/runtime:v1
[root@localhost ~]# docker push 192.168.253.139:5000/runtime:v1
Harbor
Harbor是由VMWare在Docker Registry的基础之上进行了二次封装，加进去了很多额外程序，而且提供了一个非常漂亮的web界面。
Project Harbor 是一个开源可信的云原生注册表项目，用于存储、签名和扫描上下文。
Harbor 通过添加用户通常需要的功能（如安全、身份和管理）来扩展开源 Docker Distribution。
Harbor 支持高级功能，例如用户管理、访问控制、活动监控和实例之间的复制。
Harbor的功能:
Feathers：
- 多租户内容签名和验证
- 安全和脆弱性分析
- 审计日志
- 身份集成和基于角色的访问控制
- 实例之间的映像复制
- 可扩展API和图形用户界面
- 国际化（目前为英文和中文）
Docker compose
Harbor在物理机上部署是非常难的，而为了简化Harbor的应用，Harbor官方直接把Harbor做成了在容器中运行的应用，而且这个容器在Harbor中依赖类似redis、mysql、pgsql等很多存储系统，所以它需要编排很多容器协同起来工作，因此VMWare Harbor在部署和使用时，需要借助于Docker的单机编排工具(Docker compose)来实现。
Compose 是一个用于定义和运行多容器 Docker 应用程序的工具。使用 Compose，您可以使用 YAML 文件来配置应用程序的服务。然后，使用一个命令，您可以从您的配置中创建并启动所有服务。
Harbor部署
压缩包下载地址：(https://github.com/goharbor/harbor/releases)
开始之前先删除所有容器
# 下载压缩包
[root@localhost ~]# wget https://github.com/goharbor/harbor/releases/download/v2.4.3/harbor-offline-installer-v2.4.3.tgz
[root@localhost ~]# curl -SL https://github.com/docker/compose/releases/download/v2.7.0/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
[root@localhost ~]# cd /usr/local/bin/
[root@localhost bin]# chmod +x docker-compose
[root@localhost bin]# ll
总用量 25188
-rwxr-xr-x. 1 root root 25792512 8月 11 16:25 docker-compose
[root@localhost bin]# ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
[root@localhost ~]# tar xf harbor-offline-installer-v2.4.3.tgz -C /usr/local/
[root@localhost ~]# ls /usr/local/
bin etc games harbor include lib lib64 libexec sbin share src
[root@localhost ~]# cd /usr/local/harbor/
[root@localhost harbor]# ls
common.sh harbor.v2.4.3.tar.gz harbor.yml.tmpl install.sh LICENSE prepare
[root@localhost harbor]# mv harbor.yml.tmpl harbor.yml
[root@localhost harbor]# vim harbor.yml
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: 192.168.253.139 //改为当前的IP，如果配置了域名映射也可以使用域名
·····
#https: //在此处添加注释
# https port for harbor, default is 443
# port: 443 //注释
# The path of cert and key files for nginx
#certificate: /your/certificate/path //注释
#private_key: /your/private/key/path //注释
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: Harbor12345 //登录密码
# Harbor DB configuration
database:
# The password for the root user of Harbor DB. Change this before any production use.
password: root123 //数据库密码
[root@localhost harbor]# cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://docker.mirrors.ustc.edu.cn/"],
"bip": "192.168.88.8/24",
"insecure-registries": ["192.168.253.139"]
}
[root@localhost harbor]# systemctl daemon-reload
[root@localhost harbor]# systemctl restart docker.service
[root@localhost harbor]# ./install.sh
[+] Running 10/10
⠿ Network harbor_harbor Created 0.2s
⠿ Container harbor-log Started 0.6s
⠿ Container redis Started 2.0s
⠿ Container registryctl Started 1.9s
⠿ Container harbor-db Started 1.5s
⠿ Container harbor-portal Started 2.1s
⠿ Container registry Started 1.6s
⠿ Container harbor-core Started 2.5s
⠿ Container harbor-jobservice Started 3.2s
⠿ Container nginx Started 3.2s
✔ ----Harbor has been installed and started successfully.----
# 设置开机自启
[root@localhost ~]# vim /usr/local/harbor/startall.sh
#!/bin/bash
cd /usr/local/harbor/
/usr/local/bin/docker-compose stop
/usr/local/bin/docker-compose start
[root@localhost ~]# vim /etc/rc.d/rc.local
/bin/bash /usr/local/harbor/startall.sh
[root@localhost ~]# chmod +x /etc/rc.d/rc.local
[root@localhost ~]# ll -d /etc/rc.d/rc.local
-rwxr-xr-x. 1 root root 519 8月 11 16:49 /etc/rc.d/rc.local
[root@localhost ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
767a11424694 goharbor/nginx-photon:v2.4.3 "nginx -g 'daemon of…" 9 minutes ago Up 9 minutes (healthy) 0.0.0.0:80->8080/tcp, :::80->8080/tcp nginx
0a3b23ed5b69 goharbor/harbor-jobservice:v2.4.3 "/harbor/entrypoint.…" 9 minutes ago Up 9 minutes (healthy) harbor-jobservice
cd2e07648cef goharbor/harbor-core:v2.4.3 "/harbor/entrypoint.…" 9 minutes ago Up 9 minutes (healthy) harbor-core
8f6f9646c17e goharbor/harbor-portal:v2.4.3 "nginx -g 'daemon of…" 9 minutes ago Up 9 minutes (healthy) harbor-portal
dfea45f38ab7 goharbor/registry-photon:v2.4.3 "/home/harbor/entryp…" 9 minutes ago Up 9 minutes (healthy) registry
1855170676ec goharbor/redis-photon:v2.4.3 "redis-server /etc/r…" 9 minutes ago Up 9 minutes (healthy) redis
b17501a19052 goharbor/harbor-registryctl:v2.4.3 "/home/harbor/start.…" 9 minutes ago Up 9 minutes (healthy) registryctl
f954d658158f goharbor/harbor-db:v2.4.3 "/docker-entrypoint.…" 9 minutes ago Up 9 minutes (healthy) harbor-db
1c13d3ea5235 goharbor/harbor-log:v2.4.3 "/bin/sh -c /usr/loc…" 9 minutes ago Up 9 minutes (healthy) 127.0.0.1:1514->10514/tcp harbor-log
测试
[root@localhost ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
767a11424694 goharbor/nginx-photon:v2.4.3 "nginx -g 'daemon of…" 9 minutes ago Up 9 minutes (healthy) 0.0.0.0:80->8080/tcp, :::80->8080/tcp nginx
0a3b23ed5b69 goharbor/harbor-jobservice:v2.4.3 "/harbor/entrypoint.…" 9 minutes ago Up 9 minutes (healthy) harbor-jobservice
cd2e07648cef goharbor/harbor-core:v2.4.3 "/harbor/entrypoint.…" 9 minutes ago Up 9 minutes (healthy) harbor-core
8f6f9646c17e goharbor/harbor-portal:v2.4.3 "nginx -g 'daemon of…" 9 minutes ago Up 9 minutes (healthy) harbor-portal
dfea45f38ab7 goharbor/registry-photon:v2.4.3 "/home/harbor/entryp…" 9 minutes ago Up 9 minutes (healthy) registry
1855170676ec goharbor/redis-photon:v2.4.3 "redis-server /etc/r…" 9 minutes ago Up 9 minutes (healthy) redis
b17501a19052 goharbor/harbor-registryctl:v2.4.3 "/home/harbor/start.…" 9 minutes ago Up 9 minutes (healthy) registryctl
f954d658158f goharbor/harbor-db:v2.4.3 "/docker-entrypoint.…" 9 minutes ago Up 9 minutes (healthy) harbor-db
1c13d3ea5235 goharbor/harbor-log:v2.4.3 "/bin/sh -c /usr/loc…" 9 minutes ago Up 9 minutes (healthy) 127.0.0.1:1514->10514/tcp harbor-log
[root@localhost ~]# reboot
[root@localhost ~]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
767a11424694 goharbor/nginx-photon:v2.4.3 "nginx -g 'daemon of…" 11 minutes ago Up 28 seconds (health: starting) 0.0.0.0:80->8080/tcp, :::80->8080/tcp nginx
0a3b23ed5b69 goharbor/harbor-jobservice:v2.4.3 "/harbor/entrypoint.…" 11 minutes ago Up 28 seconds (health: starting) harbor-jobservice
cd2e07648cef goharbor/harbor-core:v2.4.3 "/harbor/entrypoint.…" 11 minutes ago Up 29 seconds (health: starting) harbor-core
8f6f9646c17e goharbor/harbor-portal:v2.4.3 "nginx -g 'daemon of…" 11 minutes ago Up 29 seconds (health: starting) harbor-portal
dfea45f38ab7 goharbor/registry-photon:v2.4.3 "/home/harbor/entryp…" 11 minutes ago Up 29 seconds (health: starting) registry
1855170676ec goharbor/redis-photon:v2.4.3 "redis-server /etc/r…" 11 minutes ago Up 29 seconds (health: starting) redis
b17501a19052 goharbor/harbor-registryctl:v2.4.3 "/home/harbor/start.…" 11 minutes ago Up 29 seconds (health: starting) registryctl
f954d658158f goharbor/harbor-db:v2.4.3 "/docker-entrypoint.…" 11 minutes ago Up 29 seconds (health: starting) harbor-db
1c13d3ea5235 goharbor/harbor-log:v2.4.3 "/bin/sh -c /usr/loc…" 11 minutes ago Up 30 seconds (healthy) 127.0.0.1:1514->10514/tcp harbor-log
在浏览器上登录
推送镜像
注意：只有管理员才有权限推送镜像
创建一个用户并把它设置为管理员
创建项目one
创建完用户和项目之后在进行推送镜像
[root@localhost ~]# docker tag busybox:latest 192.168.253.139/one/busybox:b1
[root@localhost ~]# docker push 192.168.253.139/one/busybox:b1
The push refers to repository [192.168.253.139/one/busybox]
01fd6df81c8e: Pushed
b1: digest: sha256:62ffc2ed7554e4c6d360bce40bbcf196573dd27c4ce080641a2c59867e732dee size: 527
使用Harbor的注意事项：
- 在客户端上传镜像时一定要记得执行docker login进行用户认证，否则无法直接push
- 在客户端使用的时候如果不是用的https则必须要在客户端的/etc/docker/daemon.json配置文件中配置insecure-registries参数
- 数据存放路径应在配置文件中配置到一个容量比较充足的共享存储中
- Harbor是使用docker-compose命令来管理的，如果需要停止Harbor也应用docker-compose stop来停止，其他参数请–help
本文含有隐藏内容，请 开通VIP 后查看