Harbor仓库部署
Harbor仓库部署
Harbor简介
官方的Docker Hub能够通过web界面来管理镜像，还能在web界面执行搜索，还能基于Dockerfile利用Webhooks和Automated Builds实现自动构建镜像的功能，用户把所有build上下文的文件作为一个仓库推送到github上，让Docker Hub可以从github上去pull这些文件来完成自动构建。
但无论官方的Docker Hub有多强大，它毕竟是在国外，所以速度是最大的瓶颈，我们很多时候是不可能去考虑使用官方的仓库的，但是上面说的两种自建仓库方式又十分简陋，不便管理，所以后来就出现了一个被 CNCF 组织青睐的项目，其名为Harbor。
Harbor是由VMWare在Docker Registry的基础之上进行了二次封装，加进去了很多额外程序，而且提供了一个非常漂亮的web界面。
Project Harbor 是一个开源的可信云原生注册表项目，用于存储、签名和扫描上下文。
Harbor 通过添加用户通常需要的功能（如安全性、身份和管理）来扩展开源 Docker 分发版。
Harbor 支持高级功能，例如用户管理、访问控制、活动监控和实例间复制。
Harbor的功能
Feathers：
- 多租户内容签名和验证
- 安全性和漏洞分析
- 审核日志记录
- 身份集成和基于角色的访问控制
- 实例之间的映像复制
- 可扩展的 API 和图形用户界面
- 国际化（现为英文和中文）
部署Docker compose
部署docker compose前需要部署docker
Harbor在物理机上部署是非常难的，而为了简化Harbor的应用，Harbor官方直接把Harbor做成了在容器中运行的应用，而且这个容器在Harbor中依赖类似redis、mysql、pgsql等很多存储系统，所以它需要编排很多容器协同起来工作，因此VMWare Harbor在部署和使用时，需要借助于Docker的单机编排工具(Docker compose)来实现。
Compose 是用于定义和运行多容器 Docker 应用程序的工具。使用 Compose，您可以使用 YAML 文件来配置应用程序的服务。然后，使用单个命令，从配置中创建并启动所有服务。
[Docker Compose安装文档](安装 Docker Compose CLI 插件|Docker 文档)
下载并安装撰写 CLI 插件
[root@harbor ~]# DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
[root@harbor ~]# mkdir -p $DOCKER_CONFIG/cli-plugins
[root@harbor ~]# curl -SL https://github.com/docker/compose/releases/download/v2.7.0/docker-compose-linux-x86_64 -o $DOCKER_CONFIG/cli-plugins/docker-compose
[root@harbor ~]# cd .docker/cli-plugins/
[root@harbor cli-plugins]# ls
docker-compose
给予docker-compose执行权限，并制作软连接
[root@harbor cli-plugins]# chmod +x docker-compose
[root@harbor cli-plugins]# ll
total 25188
-rwxr-xr-x. 1 root root 25792512 Aug 11 19:23 docker-compose
[root@harbor cli-plugins]# pwd
/root/.docker/cli-plugins
[root@harbor cli-plugins]# ls
docker-compose
[root@harbor cli-plugins]# ln -s /root/.docker/cli-plugins/docker-compose /usr/bin/
[root@harbor ~]# which docker-compose
/usr/bin/docker-compose
Harbor部署
修改主机名
[root@harbor ~]# hostnamectl set-hostname harbor.example.com
[root@harbor ~]# bash
[root@harbor ~]# hostname
harbor.example.com
#下载并解压harbor的包
[root@harbor ~]# cd /usr/src/
[root@harbor src]# wget https://github.com/goharbor/harbor/releases/download/v2.5.3/harbor-offline-installer-v2.5.3.tgz
[root@harbor src]# ls
debug harbor-offline-installer-v2.5.3.tgz kernels
[root@harbor src]# tar xf harbor-offline-installer-v2.5.3.tgz -C /usr/local/
[root@harbor src]# cd /usr/local/harbor/
[root@harbor harbor]# ls
LICENSE harbor.v2.5.3.tar.gz install.sh
common.sh harbor.yml.tmpl prepare
[root@harbor harbor]# cp harbor.yml.tmpl harbor.yml
#配置harbor
[root@harbor harbor]# vim harbor.yml
hostname: harbor.example.com #将此处修改为本机的主机名
# https related config
#https: #注释掉此行
# https port for harbor, default is 443
# port: 443 #注释掉此行
# The path of cert and key files for nginx
#certificate: /your/certificate/path #注释掉此行
#private_key: /your/private/key/path #注释掉此行
harbor_admin_password: Harbor12345 #此处为控制台admin的密码可自行修改
#执行安装脚本
[root@harbor harbor]# ./install.sh
[root@harbor harbor]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 127.0.0.1:1514 0.0.0.0:*
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:80 [::]:*
LISTEN 0 128 [::]:22 [::]:*
使用IP登录管理harbor：
登录成功后：
部署开机自启
[root@harbor ~]# vim /etc/rc.local
#!/bin/bash //开头位置
cd /usr/lcoal/harbor //添加
docker-compose start //添加
[root@harbor ~]# chmod +x /etc/rc.d/rc.local
[root@harbor ~]# ll /etc/rc.d/rc.local
-rwxr-xr-x. 1 root root 516 Aug 13 16:19 /etc/rc.d/rc.local
//重启查看是否开机自启
[root@harbor ~]# reboot
[root@harbor ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 127.0.0.1:1514 0.0.0.0:*
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:80 [::]:*
LISTEN 0 128 [::]:22 [::]:*
[root@harbor ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
601aa35c6bbd goharbor/harbor-jobservice:v2.5.3 "/harbor/entrypoint.…" 31 hours ago Up 41 seconds (healthy) harbor-jobservice
7d680f5526a0 goharbor/nginx-photon:v2.5.3 "nginx -g 'daemon of…" 31 hours ago Up 41 seconds (healthy) 0.0.0.0:80->8080/tcp, :::80->8080/tcp nginx
d47d3c39ef4a goharbor/harbor-core:v2.5.3 "/harbor/entrypoint.…" 31 hours ago Up 43 seconds (healthy) harbor-core
c0ac23f5ef17 goharbor/harbor-registryctl:v2.5.3 "/home/harbor/start.…" 31 hours ago Up 42 seconds (healthy) registryctl
f0068adfefe5 goharbor/redis-photon:v2.5.3 "redis-server /etc/r…" 31 hours ago Up 42 seconds (healthy) redis
051b842d4e02 goharbor/registry-photon:v2.5.3 "/home/harbor/entryp…" 31 hours ago Up 42 seconds (healthy) registry
b7c839f33ec9 goharbor/harbor-db:v2.5.3 "/docker-entrypoint.…" 31 hours ago Up 43 seconds (healthy) harbor-db
50df79ea393f goharbor/harbor-portal:v2.5.3 "nginx -g 'daemon of…" 31 hours ago Up 43 seconds (healthy) harbor-portal
fda7a58ba8be goharbor/harbor-log:v2.5.3 "/bin/sh -c /usr/loc…" 31 hours ago Up 43 seconds (healthy) 127.0.0.1:1514->10514/tcp harbor-log
使用Harbor的注意事项：
在客户端上传镜像时一定要记得执行docker login进行用户认证，否则无法直接push
在客户端使用的时候如果不是用的https则必须要在客户端的/etc/docker/daemon.json配置文件中配置insecure-registries参数
数据存放路径应在配置文件中配置到一个容量比较充足的共享存储中
Harbor是使用docker-compose命令来管理的，如果需要停止Harbor也应用docker-compose stop来停止，其他参数请--help
harbor仓库应用
实验环境：
需要2台虚拟机
| 虚拟机名字 | IP | 安装软件 | |
|---|---|---|---|
| 服务端 | harbor | 192.168.118.137 | docker ，harbor |
| 客户端 | client | 192.168.118.136 | docker |
client无法ping通harbor虚拟机的域名，所以给他添加一个映射关系
[root@harbor ~]# hostname
harbor.example.com
[root@client ~]# ping harbor.example.com
ping: harbor.example.com: Name or service not known
[root@client ~]# vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.118.137 harbor.example.com #添加此行
[root@client ~]# ping harbor.example.com
PING harbor.example.com (192.168.118.137) 56(84) bytes of data.
64 bytes from harbor.example.com (192.168.118.137): icmp_seq=1 ttl=64 time=0.537 ms
64 bytes from harbor.example.com (192.168.118.137): icmp_seq=2 ttl=64 time=0.218 ms
64 bytes from harbor.example.com (192.168.118.137): icmp_seq=3 ttl=64 time=0.287 ms
^C
--- harbor.example.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2051ms
rtt min/avg/max/mdev = 0.218/0.347/0.537/0.137 ms
client登录harbor
[root@client ~]# vim /etc/docker/daemon.json
{
"registry-mirrors": ["https://pyn8gzi5.mirror.aliyuncs.com"],
"insecure-registries": ["harbor.example.com"] #添加此行
}
[root@client ~]# systemctl restart docker
[root@client ~]# docker login harbor.example.com
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
a3171344634/httpd v0.1 169b852685dc 2 days ago 763MB
httpd latest dabbfbe0c57b 7 months ago 144MB
将自己创建的镜像上传到harbor上
[root@client ~]# docker tag a3171344634/httpd:v0.1 harbor.example.com/library/httpd:v1.1 #打个标签
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
harbor.example.com/library/httpd v1.1 169b852685dc 2 days ago 763MB
a3171344634/httpd v0.1 169b852685dc 2 days ago 763MB
httpd latest dabbfbe0c57b 7 months ago 144MB
#上传镜像
[root@client ~]# docker push harbor.example.com/library/httpd:v1.1
The push refers to repository [harbor.example.com/library/httpd]
3176bbf5fec3: Pushed
74ddd0ec08fa: Pushed
v1.1: digest: sha256:418e4e4d903fe75959e23ad693261d42ba9ad5bc220113ff906cea5d8c99ca9c size: 742
查看上传镜像效果：
测试镜像能否拉取：
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
a3171344634/httpd v0.1 169b852685dc 2 days ago 763MB
harbor.example.com/library/httpd v1.1 169b852685dc 2 days ago 763MB
httpd latest dabbfbe0c57b 7 months ago 144MB
[root@client ~]# docker rmi -f harbor.example.com/library/httpd:v1.1
Untagged: harbor.example.com/library/httpd:v1.1
Untagged: harbor.example.com/library/httpd@sha256:418e4e4d903fe75959e23ad693261d42ba9ad5bc220113ff906cea5d8c99ca9c
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
a3171344634/httpd v0.1 169b852685dc 2 days ago 763MB
httpd latest dabbfbe0c57b 7 months ago 144MB
[root@client ~]# docker pull harbor.example.com/library/httpd:v1.1
v1.1: Pulling from library/httpd
Digest: sha256:418e4e4d903fe75959e23ad693261d42ba9ad5bc220113ff906cea5d8c99ca9c
Status: Downloaded newer image for harbor.example.com/library/httpd:v1.1
harbor.example.com/library/httpd:v1.1
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
a3171344634/httpd v0.1 169b852685dc 2 days ago 763MB
harbor.example.com/library/httpd v1.1 169b852685dc 2 days ago 763MB
httpd latest dabbfbe0c57b 7 months ago 144MB
