226 lines
8.0 KiB
Markdown
226 lines
8.0 KiB
Markdown
# Docker Registry
|
||
|
||
Docker Register作为Docker的核心组件之一负责镜像内容的存储与分发，客户端的docker pull以及push命令都将直接与register进行交互，最初版本的registry由python实现的，由于涉及初期在安全性、性能以及API的设计上有着诸多的缺陷，该版本在0.9之后停止了开发，由新的项目distribution（新的docker register被称为Distribution）来重新设计并开发了下一代的registry，新的项目由go语言开发，所有的api底层存储方式，系统架构都进行了全面的重新设计已解决上一代registry的问题。
|
||
|
||
官方文档地址：https://docs.docker.com/registry
|
||
|
||
官方github地址: https://github.com/docker/distribution
|
||
|
||
## 搭建镜像
|
||
|
||
- 下载docker registry镜像
|
||
|
||
```bash
|
||
[root@docker-server ~]# docker pull registry
|
||
```
|
||
|
||
- 创建授权使用目录
|
||
|
||
```bash
|
||
[root@docker-server ~]# mkdir /docker/auth -p
|
||
[root@docker-server ~]# cd /docker
|
||
```
|
||
|
||
- 创建用户
|
||
|
||
```bash
|
||
[root@docker-server docker]# yum install httpd-tools.x86_64 -y
|
||
[root@docker-server docker]# htpasswd -Bbn jack 123456 > auth/htpasswd
|
||
[root@docker-server docker]# cat auth/htpasswd
|
||
jack:$2y$05$a2wtUYyoC8p/eXzoseT9Q.dhMDgQgwkUiKVfs1z6zijk6M4UIiUsq
|
||
[root@docker-server docker]# docker run -d -p 5000:5000 -v /docker/auth/:/auth -e \
|
||
"REGISTRY_AUTH=htpasswd" \
|
||
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
|
||
-e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" registry
|
||
7be5539c6cbef114b33a083ef976836a44b97ea54a7c41beb1b568878794b22a
|
||
[root@docker-server docker]# docker ps -l
|
||
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
|
||
7be5539c6cbe registry "/entrypoint.sh /etc…" 7 seconds ago Up 6 seconds 0.0.0.0:5000->5000/tcp, :::5000->5000/tcp nostalgic_stonebraker
|
||
[root@docker-server docker]#
|
||
[root@docker-server docker]#
|
||
[root@docker-server docker]#
|
||
[root@docker-server docker]#
|
||
[root@docker-server docker]# curl http://jack:123456@127.0.0.1:5000/v2/_catalog
|
||
{"repositories":[]}
|
||
[root@docker-server docker]# docker login 127.0.0.1:5000
|
||
Username: jack
|
||
Password:
|
||
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
|
||
Configure a credential helper to remove this warning. See
|
||
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
|
||
|
||
Login Succeeded
|
||
[root@docker-server docker]#
|
||
```
|
||
|
||
将本机的镜像push到仓库中
|
||
|
||
```bash
|
||
[root@localhost ~]# docker pull centos:7
|
||
[root@localhost ~]# docker tag centos:7 127.0.0.1:5000/test/centos:9
|
||
[root@localhost ~]# docker push 127.0.0.1:5000/test/centos:9
|
||
The push refers to repository [127.0.0.1:5000/test/centos]
|
||
74ddd0ec08fa: Pushed
|
||
9: digest: sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc size: 529
|
||
[root@localhost ~]# curl http://jack:123456@127.0.0.1:5000/v2/_catalog
|
||
{"repositories":["test/centos"]}
|
||
```
|
||
|
||
添加本地信任，信任之后就可以从自己的仓库下载东西了，由于我们测试的是127.0.0.1的地址，不用添加
|
||
|
||
```bash
|
||
cat /etc/docker/daemon.json
|
||
{
|
||
"registry-mirrors": ["远程的仓库地址"],
|
||
"insecure-registries": ["远程的仓库地址"],
|
||
"exec-opts": ["native.cgroupdriver=systemd"]
|
||
}
|
||
```
|
||
|
||
先删除本地的nginx镜像，然后尝试从远程下载一次
|
||
|
||
```bash
|
||
[root@localhost ~]# docker pull 127.0.0.1:5000/test/centos:9
|
||
9: Pulling from test/centos
|
||
a1d0c7532777: Pull complete
|
||
Digest: sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc
|
||
Status: Downloaded newer image for 127.0.0.1:5000/test/centos:9
|
||
127.0.0.1:5000/test/centos:9
|
||
```
|
||
|
||
# Docker 仓库之分布式harbor
|
||
|
||
参考网址：https://goharbor.io/docs/2.3.0/install-config/
|
||
|
||
Harbor是一个用于存储和分发Docker镜像的企业级Registry服务器，由vmware开源，其通过添加一些企业必须的功能特性，例如安全、标识和管理等，扩展了开源的Docker Distribution。Harbor也提供了高级的安全特性，诸如用户管理，访问控制和活动审计等。
|
||
|
||
## 安装
|
||
|
||
- 下载镜像
|
||
|
||
```bash
|
||
[root@docker-server1 ~]# wget https://github.com/goharbor/harbor/releases/download/v2.3.1/harbor-offline-installer-v2.3.1.tgz
|
||
```
|
||
|
||
- 解压缩
|
||
|
||
```bash
|
||
[root@docker-server1 ~]# tar xzvf harbor-offline-installer-v2.3.1.tgz
|
||
[root@docker-server1 ~]# ln -sv /root/harbor /usr/local/
|
||
"/usr/local/harbor" -> "/root/harbor"
|
||
```
|
||
|
||
- 安装harbor
|
||
|
||
```bash
|
||
[root@docker-server1 harbor]# cp harbor.yml.tmpl harbor.yml
|
||
[root@docker-server1 harbor]# grep -Ev '#|^$' harbor.yml.tmpl > harbor.yml
|
||
[root@docker-server1 harbor]# cat harbor.yml
|
||
hostname: 192.168.80.10
|
||
http:
|
||
port: 80
|
||
harbor_admin_password: Harbor12345
|
||
database:
|
||
password: root123
|
||
max_idle_conns: 100
|
||
max_open_conns: 900
|
||
data_volume: /data
|
||
trivy:
|
||
ignore_unfixed: false
|
||
skip_update: false
|
||
insecure: false
|
||
jobservice:
|
||
max_job_workers: 10
|
||
notification:
|
||
webhook_job_max_retry: 10
|
||
chart:
|
||
absolute_url: disabled
|
||
log:
|
||
level: info
|
||
local:
|
||
rotate_count: 50
|
||
rotate_size: 200M
|
||
location: /var/log/harbor
|
||
_version: 2.3.0
|
||
proxy:
|
||
http_proxy:
|
||
https_proxy:
|
||
no_proxy:
|
||
components:
|
||
- core
|
||
- jobservice
|
||
- trivy
|
||
[root@docker-server1 harbor]# curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
|
||
[root@localhost harbor]# chmod +x /usr/local/bin/docker-compose
|
||
[root@localhost harbor]# docker-compose --version
|
||
docker-compose version 1.29.2, build 5becea4c
|
||
[root@docker-server1 harbor]# ./prepare
|
||
[root@docker-server1 harbor]# ./install.sh
|
||
|
||
[root@docker-server1 harbor]# ss -tnl
|
||
State Recv-Q Send-Q Local Address:Port Peer Address:Port
|
||
LISTEN 0 128 *:80 *:*
|
||
LISTEN 0 128 *:22 *:*
|
||
LISTEN 0 100 127.0.0.1:25 *:*
|
||
LISTEN 0 128 127.0.0.1:1514 *:*
|
||
LISTEN 0 128 :::80 :::*
|
||
LISTEN 0 128 :::22 :::*
|
||
LISTEN 0 100 ::1:25 :::*
|
||
|
||
---
|
||
# 之后的启动关闭可以通过docker-compose管理，自动生成docker-compose.yml文件
|
||
[root@docker-server1 harbor]# ls
|
||
common docker-compose.yml harbor.yml install.sh prepare
|
||
common.sh harbor.v2.3.1.tar.gz harbor.yml.tmpl LICENSE
|
||
```
|
||
|
||
## web访问
|
||
|
||
默认用户名和密码在harbor.yml中设置为：harbor_admin_password: Harbor12345
|
||
|
||
<img src="09.docker%E4%BB%93%E5%BA%93%E7%AE%A1%E7%90%86/image-20250327203442486.png" alt="image-20250327203442486" style="zoom:80%;" />
|
||
|
||
<img src="09.docker%E4%BB%93%E5%BA%93%E7%AE%A1%E7%90%86/image-20250327203501846.png" alt="image-20250327203501846" style="zoom:80%;" />
|
||
|
||
## 推送镜像
|
||
|
||
一、创建项目
|
||
|
||
|
||
|
||
二、docker 登录仓库
|
||
|
||
- 登录后推送镜像
|
||
|
||
```bash
|
||
[root@localhost ~]# cat /etc/docker/daemon.json
|
||
{
|
||
"registry-mirrors": ["http://192.168.88.10:80/"],
|
||
"insecure-registries": ["192.168.88.10:80"]
|
||
}
|
||
[root@localhost ~]# systemctl restart docker
|
||
|
||
# 私有仓库需要在此登录
|
||
[root@localhost ~]# docker login 192.168.88.10
|
||
Username: admin
|
||
Password:
|
||
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
|
||
Configure a credential helper to remove this warning. See
|
||
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
|
||
|
||
Login Succeeded
|
||
```
|
||
|
||
- 打标签推送镜像
|
||
|
||
```bash
|
||
[root@localhost harbor]# docker tag centos:7 192.168.88.10/eagleslab/centos:9
|
||
[root@localhost harbor]# docker push 192.168.88.10/eagleslab/centos:9
|
||
The push refers to repository [192.168.173.136/eagleslab/centos]
|
||
74ddd0ec08fa: Pushed
|
||
9: digest: sha256:a1801b843b1bfaf77c501e7a6d3f709401a1e0c83863037fa3aab063a7fdb9dc size: 529
|
||
```
|
||
|
||
|
||
|