《Netkiller Virtualization 手札》 · 搭建 Docker 私有倉庫
阿新 • • 發佈：2019-03-06
Netkiller Virtualization 手札
Docker, KVM, OpenVZ, Vagrant, VirtualBox ...
Mr. Neo Chan, 陳景峰(BG7NYT)
中國廣東省深圳市望海路半島城邦三期
518067
+86 13113668890
<[email protected] >
YSF80337 - CN China 1 - W24166/TG46001
BM_China_46001 - DMR Radio ID 4600441
2015-07-14
版權 © 2015-2019 Netkiller(Neo Chan). All rights reserved.
版權宣告
轉載請與作者聯絡，轉載時請務必標明文章原始出處和作者資訊及本宣告。
|
|
|
|
1.10. 私有倉庫
1.10.1. 搭建私有倉庫
搭建私有倉庫只需兩步
docker pull registry docker run -d -p 5000:5000 -v /opt/registry:/var/lib/registry --name registry registry
操作演示
neo@ubuntu:~$ docker pull registry Using default tag: latest latest: Pulling from library/registry 169185f82c45: Pull complete 046e2d030894: Pull complete 188836fddeeb: Pull complete 832744537747: Pull complete 7ceea07e80be: Pull complete Digest: sha256:870474507964d8e7d8c3b53bcfa738e3356d2747a42adad26d0d81ef4479eb1b Status: Downloaded newer image for registry:latest neo@ubuntu:~$ docker run -d -p 5000:5000 -v /opt/registry:/tmp/registry registry 38a6d3b5e18e378b7765fa00374426db3a06c64f4b9219a1f85dc42a6a66ef28 neo@ubuntu:~$ docker ps | grep registry 38a6d3b5e18e registry "/entrypoint.sh /etc…" 35 seconds ago Up 33 seconds 0.0.0.0:5000->5000/tcp
/etc/default/docker 中加入下面內容
neo@ubuntu:~$ sudo vim /etc/default/docker DOCKER_OPTS="--insecure-registry 0.0.0.0:5000"
修改 /lib/systemd/system/docker.service
# 加入 EnvironmentFile=/etc/default/docker # 尾部加入 $DOCKER_OPTS ExecStart=/usr/bin/dockerd -H fd:// -H unix:///var/run/docker.sock -H tcp://0.0.0.0:2375 $DOCKER_OPTS
完整的例子
neo@ubuntu:~$ sudo vim /lib/systemd/system/docker.service [Unit] Description=Docker Application Container Engine Documentation=https://docs.docker.com After=network-online.target docker.socket firewalld.service Wants=network-online.target Requires=docker.socket [Service] Type=notify # the default is not to use systemd for cgroups because the delegate issues still # exists and systemd currently does not support the cgroup feature set required EnvironmentFile=/etc/default/docker # for containers run by docker ExecStart=/usr/bin/dockerd -H fd:// -H unix:///var/run/docker.sock -H tcp://0.0.0.0:2375 $DOCKER_OPTS ExecReload=/bin/kill -s HUP $MAINPID LimitNOFILE=1048576 # Having non-zero Limit*s causes performance problems due to accounting overhead # in the kernel. We recommend using cgroups to do container-local accounting. LimitNPROC=infinity LimitCORE=infinity # Uncomment TasksMax if your systemd version supports it. # Only systemd 226 and above support this version. TasksMax=infinity TimeoutStartSec=0 # set delegate yes so that systemd does not reset the cgroups of docker containers Delegate=yes # kill only the docker process, not all processes in the cgroup KillMode=process # restart the docker process if it exits prematurely Restart=on-failure StartLimitBurst=3 StartLimitInterval=60s [Install] WantedBy=multi-user.target
重啟 Docker
neo@ubuntu:~$ sudo systemctl daemon-reload neo@ubuntu:~$ sudo systemctl restart docker neo@ubuntu:~$ ps ax | grep docker 19548 ? Ssl 0:00 /usr/bin/dockerd -H fd:// -H unix:///var/run/docker.sock -H tcp://0.0.0.0:2375 --insecure-registry 0.0.0.0:5000
驗證 5000 埠可以訪問
neo@ubuntu:~$ curl -XGET http://localhost:5000/v2/_catalog
{"repositories":[]}
1.10.2. 推送映象到私有倉庫
本地映象推送到遠端私有倉庫
docker pull busybox docker tag busybox docker.netkiller.cn:5000/busybox docker push docker.netkiller.cn:5000/busybox
操作演示
[root@localhost ~]# docker pull busybox Using default tag: latest latest: Pulling from library/busybox 697743189b6d: Pull complete Digest: sha256:061ca9704a714ee3e8b80523ec720c64f6209ad3f97c0ff7cb9ec7d19f15149f Status: Downloaded newer image for busybox:latest [root@localhost ~]# docker tag busybox docker.netkiller.cn:5000/busybox [root@localhost ~]# docker push docker.netkiller.cn:5000/busybox The push refers to repository [docker.netkiller.cn:5000/busybox] adab5d09ba79: Pushed latest: digest: sha256:4415a904b1aca178c2450fd54928ab362825e863c0ad5452fd020e92f7a6a47e size: 527
檢視遠端私有倉庫
[root@localhost ~]# curl -XGET http://docker.netkiller.cn:5000/v2/_catalog
{"repositories":["busybox"]}
[root@localhost ~]# curl -XGET http://docker.netkiller.cn:5000/v2/busybox/tags/list
{"name":"busybox","tags":["latest"]}
從私有倉庫拉映象
docker pull docker.netkiller.cn:5000/busybox
1.10.3. 查詢映象
如果我們想要查詢私有倉庫中的所有映象，使用docker search命令：
docker search registry_ipaddr:5000/
如果要查詢倉庫中指定賬戶下的映象，則使用如下命令：
docker search registry_ipaddr:5000/account/
操作演示
[root@localhost ~]# curl -XGET http://docker.netkiller.cn:5000/v2/_catalog
{"repositories":["busybox"]}
[root@localhost ~]# curl -XGET http://docker.netkiller.cn:5000/v2/busybox/tags/list
{"name":"busybox","tags":["latest"]}
1.10.4. registry 映象高階配置
/etc/docker/registry/config.yml
cat config.yml
version: 0.1
log:
fields:
service: registry
storage:
delete:
enabled: true
cache:
blobdescriptor: inmemory
filesystem:
rootdirectory: /var/lib/registry
http:
addr: :5000
headers:
X-Content-Type-Options: [nosniff]
health:
storagedriver:
enabled: true
interval: 10s
threshold: 3
1.10.4.1. 私有倉庫認證
建立密碼檔案
docker run --entrypoint htpasswd registry -Bbn testuser testpassword > auth/htpasswd
啟動 docker
docker run -d -p 5000:5000 --restart=always --name docker-hub \ -v /opt/registry:/var/lib/registry \ -v /opt/auth:/auth \ -e "REGISTRY_AUTH=htpasswd" \ -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \ -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \ registry
登入
docker login -u testuser -p testpassword docker.netkiller.cn:5000
退出
docker logout docker.netkiller.cn:5000
1.10.5. registry 介面
檢視倉庫 http://registry:5000/v2/_catalog
curl -XGET http://registry:5000/v2/_catalog
檢視映象
curl -XGET http://registry:5000/v2/image_name/tags/list
刪除映象
DELETE /v2/<name>/manifests/<reference> name:映象名稱 reference: 映象對應sha256值
處理器測試
curl -I -X DELETE http://registry:5000/v2/netkiller/manifests/sha256:6a67ba443ac96b1dcffa5e4582a8dd4f81af95b8d3e37aeba72401a5afd7ab8e