aaronxu/Cloud-book
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
Cloud-book/Docker/09.docker仓库管理.md
AaronXu 8d84941d62 07-15-周三_15-28-35
2026-07-15 15:28:36 +08:00

8.0 KiB
Raw Permalink Blame History

Docker Registry

Docker Register作为Docker的核心组件之一负责镜像内容的存储与分发，客户端的docker pull以及push命令都将直接与register进行交互，最初版本的registry由python实现的，由于涉及初期在安全性、性能以及API的设计上有着诸多的缺陷，该版本在0.9之后停止了开发，由新的项目distribution（新的docker register被称为Distribution）来重新设计并开发了下一代的registry，新的项目由go语言开发，所有的api底层存储方式，系统架构都进行了全面的重新设计已解决上一代registry的问题。

官方文档地址：https://docs.docker.com/registry

官方github地址: https://github.com/docker/distribution

搭建镜像

  • 下载docker registry镜像
[root@docker-server ~]# docker pull registry
  • 创建授权使用目录
[root@docker-server ~]# mkdir /docker/auth -p
[root@docker-server ~]# cd /docker
  • 创建用户
[root@docker-server docker]# yum install httpd-tools.x86_64 -y
[root@docker-server docker]# htpasswd -Bbn jack 123456 > auth/htpasswd
[root@docker-server docker]# cat auth/htpasswd 
jack:$2y$05$a2wtUYyoC8p/eXzoseT9Q.dhMDgQgwkUiKVfs1z6zijk6M4UIiUsq
[root@docker-server docker]# docker run -d -p 5000:5000 -v /docker/auth/:/auth -e \
 "REGISTRY_AUTH=htpasswd" \
 -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
 -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" registry
7be5539c6cbef114b33a083ef976836a44b97ea54a7c41beb1b568878794b22a
[root@docker-server docker]# docker ps -l
CONTAINER ID   IMAGE      COMMAND                  CREATED         STATUS         PORTS                                       NAMES
7be5539c6cbe   registry   "/entrypoint.sh /etc…"   7 seconds ago   Up 6 seconds   0.0.0.0:5000->5000/tcp, :::5000->5000/tcp   nostalgic_stonebraker
[root@docker-server docker]# 
[root@docker-server docker]# 
[root@docker-server docker]# 
[root@docker-server docker]# 
[root@docker-server docker]# curl http://jack:123456@127.0.0.1:5000/v2/_catalog
{"repositories":[]}
[root@docker-server docker]# docker login  127.0.0.1:5000
Username: jack
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
[root@docker-server docker]#

将本机的镜像push到仓库中

[root@localhost ~]# docker pull centos:7
[root@localhost ~]# docker tag centos:7 127.0.0.1:5000/test/centos:9
[root@localhost ~]# docker push 127.0.0.1:5000/test/centos:9
The push refers to repository [127.0.0.1:5000/test/centos]
74ddd0ec08fa: Pushed 
9: digest: sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc size: 529
[root@localhost ~]# curl http://jack:123456@127.0.0.1:5000/v2/_catalog
{"repositories":["test/centos"]}

添加本地信任，信任之后就可以从自己的仓库下载东西了，由于我们测试的是127.0.0.1的地址，不用添加

cat /etc/docker/daemon.json
{
    "registry-mirrors": ["远程的仓库地址"],
    "insecure-registries": ["远程的仓库地址"],
    "exec-opts": ["native.cgroupdriver=systemd"]
}

先删除本地的nginx镜像，然后尝试从远程下载一次

[root@localhost ~]# docker pull 127.0.0.1:5000/test/centos:9
9: Pulling from test/centos
a1d0c7532777: Pull complete 
Digest: sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc
Status: Downloaded newer image for 127.0.0.1:5000/test/centos:9
127.0.0.1:5000/test/centos:9

Docker 仓库之分布式harbor

参考网址：https://goharbor.io/docs/2.3.0/install-config/

Harbor是一个用于存储和分发Docker镜像的企业级Registry服务器，由vmware开源，其通过添加一些企业必须的功能特性，例如安全、标识和管理等，扩展了开源的Docker Distribution。Harbor也提供了高级的安全特性，诸如用户管理，访问控制和活动审计等。

安装

  • 下载镜像
[root@docker-server1 ~]# wget https://github.com/goharbor/harbor/releases/download/v2.3.1/harbor-offline-installer-v2.3.1.tgz
  • 解压缩
[root@docker-server1 ~]# tar xzvf harbor-offline-installer-v2.3.1.tgz 
[root@docker-server1 ~]# ln -sv /root/harbor /usr/local/
"/usr/local/harbor" -> "/root/harbor"
  • 安装harbor
[root@docker-server1 harbor]# cp harbor.yml.tmpl harbor.yml
[root@docker-server1 harbor]# grep -Ev '#|^$' harbor.yml.tmpl > harbor.yml
[root@docker-server1 harbor]# cat harbor.yml
hostname: 192.168.80.10
http:
  port: 80
harbor_admin_password: Harbor12345
database:
  password: root123
  max_idle_conns: 100
  max_open_conns: 900
data_volume: /data
trivy:
  ignore_unfixed: false
  skip_update: false
  insecure: false
jobservice:
  max_job_workers: 10
notification:
  webhook_job_max_retry: 10
chart:
  absolute_url: disabled
log:
  level: info
  local:
    rotate_count: 50
    rotate_size: 200M
    location: /var/log/harbor
_version: 2.3.0
proxy:
  http_proxy:
  https_proxy:
  no_proxy:
  components:
    - core
    - jobservice
    - trivy
[root@docker-server1 harbor]# curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
[root@localhost harbor]# chmod +x /usr/local/bin/docker-compose
[root@localhost harbor]# docker-compose --version
docker-compose version 1.29.2, build 5becea4c
[root@docker-server1 harbor]# ./prepare 
[root@docker-server1 harbor]# ./install.sh 

[root@docker-server1 harbor]# ss -tnl
State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN     0      128             *:80                          *:*                  
LISTEN     0      128             *:22                          *:*                  
LISTEN     0      100     127.0.0.1:25                          *:*                  
LISTEN     0      128     127.0.0.1:1514                        *:*                  
LISTEN     0      128            :::80                         :::*                  
LISTEN     0      128            :::22                         :::*                  
LISTEN     0      100           ::1:25                         :::*  

---
# 之后的启动关闭可以通过docker-compose管理，自动生成docker-compose.yml文件
[root@docker-server1 harbor]# ls
common     docker-compose.yml    harbor.yml       install.sh  prepare
common.sh  harbor.v2.3.1.tar.gz  harbor.yml.tmpl  LICENSE

web访问

默认用户名和密码在harbor.yml中设置为：harbor_admin_password: Harbor12345

image-20250327203442486 image-20250327203501846

推送镜像

一、创建项目

image-20250327203600071

二、docker 登录仓库

  • 登录后推送镜像
[root@localhost ~]# cat /etc/docker/daemon.json
{
    "registry-mirrors": ["http://192.168.88.10:80/"],
    "insecure-registries": ["192.168.88.10:80"]
}
[root@localhost ~]# systemctl restart docker

# 私有仓库需要在此登录
[root@localhost ~]# docker login 192.168.88.10
Username: admin
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
  • 打标签推送镜像
[root@localhost harbor]# docker tag centos:7 192.168.88.10/eagleslab/centos:9
[root@localhost harbor]# docker push 192.168.88.10/eagleslab/centos:9
The push refers to repository [192.168.173.136/eagleslab/centos]
74ddd0ec08fa: Pushed 
9: digest: sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc size: 529

image-20220922115258105