Docker(四) docker本地鏡像倉庫學習
阿新 • • 發佈:2018-12-08
hot local mar storage rpo enter ive 127.0.0.1 運行 1. Docker registry
#檢查端口5000是否被占用 netstat -tunlp | grep 5000 # the local host ip is 172.17.0.1 # pull registry mkdir -p /opt/myregistry docker run -d -p 5000:5000 --name registry --restart=always -v /opt/myregistry:/var/lib/registry registry:2.4.1 # double check the registry is ok. curl http://172.17.0.1:5000/v2 # modify https to http echo "{"insecure-registries:["172.17.0.1:5000"]"}" docker pull busybox docker tag busybox 172.17.0.1:5000/busybox01 docker rmi busybox docker push 172.17.0.1:5000/busybox01 docker rmi 172.17.0.1:5000/busybox01 docker pull 172.17.0.1:5000/busybox01
2. Docker hub
- docker hub
3. harbor
download harbor offline tar package
wget https://github.com/vmware/harbor/releases/download/v1.2.2/harbor-offline-installer-v1.2.2.tgz -o /home/marion/docker
tar xf /home/marion/docker/harbor-offline-installer-v1.2.2.tgz
cd /home/marion/docker/harbor
安裝環境依賴
apt-get install openssl python
安裝harbor
配置ssl證書
openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 3650 -out ca.crt Generating a 4096 bit RSA private key ................................................................................................................................................................................................++ ....++ writing new private key to ‘ca.key‘ ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.‘, the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:BeiJin Locality Name (eg, city) []:BeiJin Organization Name (eg, company) [Internet Widgits Pty Ltd]:haha Organizational Unit Name (eg, section) []:haha-ops Common Name (e.g. server FQDN or YOUR name) []:harbor.haha.link Email Address []:[email protected] root@harbor:~/harbor/harborcert# openssl req -newkey rsa:4096 -nodes -sha256 -keyout haha.link.key -out haha.link.csr Generating a 4096 bit RSA private key ...........................................................................................................................++ ...++ writing new private key to ‘haha.link.key‘ ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.‘, the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:BeiJin Locality Name (eg, city) []:BeiJin Organization Name (eg, company) [Internet Widgits Pty Ltd]:haha Organizational Unit Name (eg, section) []:haha-ops Common Name (e.g. server FQDN or YOUR name) []:harbor.haha.link Email Address []:[email protected] Please enter the following ‘extra‘ attributes to be sent with your certificate request A challenge password []:admin123 An optional company name []:haha root@harbor:~/harbor/harborcert# openssl x509 -req -days 3650 -in haha.link.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out haha.link.crt Signature ok subject=/C=CN/ST=BeiJin/L=BeiJin/O=haha/OU=haha-ops/CN=harbor.haha.link/[email protected] Getting CA Private Key mkdir -pv /etc/docker/certs.d/harbor.haha.link root@harbor:~/harbor/harborcert# cp ca.crt /etc/docker/certs.d/harbor.haha.link/ root@harbor:~/harbor/harborcert# cp haha.link.crt /usr/local/share/ca-certificates/harbor.haha.link.crt root@harbor:~/harbor/harborcert# update-ca-certificates Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d... done.
更新harbor配置文件
-
更新harbor.cfg配置文件
hostname = www.proharbor.com ui_url_protocol = https ssl_cert = /home/marion/docker/harbor/newcert/proharbor.com.crt ssl_cert_key = /home/marion/docker/harbor/newcert/proharbor.com.key
-
更新docker-compose.yml
# 創建本地倉庫鏡像的存儲目錄 cd /home/marion/docker/harbor mkdir /home/marion/harborregistry/ vim docker-compose.yml # ------以下是docker-compose.yml修改後的內容------ version: ‘2‘ services: log: image: vmware/harbor-log:v1.2.2 container_name: harbor-log restart: always volumes: - /var/log/harbor/:/var/log/docker/:z ports: - 127.0.0.1:1514:514 networks: - harbor registry: image: registry:2.4.1 #此處可以修改registry的版本 container_name: registry restart: always volumes: - /home/marion/harborregistry:/storage:z #此處可以按需修改到自己想存檔的位置 - ./common/config/registry/:/etc/registry/:z networks: - harbor environment: - GODEBUG=netdns=cgo command: ["serve", "/etc/registry/config.yml"] depends_on: - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "registry" mysql: image: vmware/harbor-db:v1.2.2 container_name: harbor-db restart: always volumes: - /data/database:/var/lib/mysql:z networks: - harbor env_file: - ./common/config/db/env depends_on: - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "mysql" adminserver: image: vmware/harbor-adminserver:v1.2.2 container_name: harbor-adminserver env_file: - ./common/config/adminserver/env restart: always volumes: - /data/config/:/etc/adminserver/config/:z - /data/secretkey:/etc/adminserver/key:z - /data/:/data/:z networks: - harbor depends_on: - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "adminserver" ui: image: vmware/harbor-ui:v1.2.2 container_name: harbor-ui env_file: - ./common/config/ui/env restart: always volumes: - ./common/config/ui/app.conf:/etc/ui/app.conf:z - ./common/config/ui/private_key.pem:/etc/ui/private_key.pem:z - /data/secretkey:/etc/ui/key:z - /data/ca_download/:/etc/ui/ca/:z - /data/psc/:/etc/ui/token/:z networks: - harbor depends_on: - log - adminserver - registry logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "ui" jobservice: image: vmware/harbor-jobservice:v1.2.2 container_name: harbor-jobservice env_file: - ./common/config/jobservice/env restart: always volumes: - /data/job_logs:/var/log/jobs:z - ./common/config/jobservice/app.conf:/etc/jobservice/app.conf:z - /data/secretkey:/etc/jobservice/key:z networks: - harbor depends_on: - ui - adminserver logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "jobservice" proxy: image: vmware/nginx-photon:1.11.13 container_name: nginx restart: always volumes: - ./common/config/nginx:/etc/nginx:z networks: - harbor ports: - 80:80 - 443:443 - 4443:4443 depends_on: - mysql - registry - ui - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "proxy" networks: harbor: external: false
- 倉庫根目錄配置文件
version: 0.1
log:
level: debug
fields:
service: registry
storage:
cache:
layerinfo: inmemory
filesystem:
rootdirectory: /storage
maintenance:
uploadpurging:
enabled: false
delete:
enabled: true
http:
addr: :5000
secret: placeholder
debug:
addr: localhost:5001
auth:
token:
issuer: harbor-token-issuer
realm: https://www.proharbor.com/service/token
rootcertbundle: /etc/registry/root.crt
service: harbor-registry
notifications:
endpoints:
- name: harbor
disabled: false
url: http://ui/service/notifications
timeout: 3000ms
threshold: 5
backoff: 1s
安裝harbor以及notary,clair
cd /home/marion/docker/harbor/
sudo ./install.sh --with-notary --with-clair
#關閉harbor所有的容器(必須在含有docker-compose.yml文件的目錄下執行)
docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml -f ./docker-compose.clair.yml down -v
#啟動harbor相關的所有容器(必須在含有docker-compose.yml文件的目錄下執行)
docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml -f ./docker-compose.clair.yml up -d
驗證查看
!Harbor
- 打開瀏覽器,輸入https://www.proharbor.com
- 用戶名/密碼:admin/Harbor12345(默認的)
- 打開終端:
docker login www.proharbor.com
,用戶名為admin
,密碼為Harbor12345
查看日誌
harbor的運行日誌
#日誌路徑各不相同,具體路徑根據docker-compose.yml或者*/harbor/common/目錄下的配置文件進行確定
cd /var/log/harbor
harbor中鏡像的使用日誌
使用Harbor進行鏡像的管理
push/pull
# push
root@dockermaster:/home/marion/docker/harbor# docker tag redis www.proharbor.com/harborssl/redis:dev
root@dockermaster:/home/marion/docker/harbor# docker push www.proharbor.com/harborssl/redis:dev
The push refers to a repository [www.proharbor.com/harborssl/redis]
d112bb627859: Pushed
265ab1ac61ec: Pushed
2341e66d779d: Pushed
9503917b6420: Pushed
aa84bbcc6553: Pushed
29d71372a492: Pushed
dev: digest: sha256:b707a0c39062f1769c8e16069015e1ba839add849deb441428fc0c1deee67c36 size: 1571
# pull
root@dockermaster:/home/marion/docker/harbor# docker pull www.proharbor.com/harborssl/redis:dev
dev: Pulling from harborssl/redis
Digest: sha256:b707a0c39062f1769c8e16069015e1ba839add849deb441428fc0c1deee67c36
Status: Downloaded newer image for www.proharbor.com/harborssl/redis:dev
鏡像的掃描clair
Docker(四) docker本地鏡像倉庫學習