Docker私有仓库registry
1、docker私有仓库的搭建与使用
docker不仅有一个中央仓库，同时也允许我们搭建自己的私有仓库，如果读者对maven有了解，将很容易理解私有仓库的优势：
1、节省带宽，镜像无需从中央仓库下载，只需要从私有仓库中下载即可
2、对于私有仓库中已经有的镜像，提升了下载速度
3、便于内部镜像的统一管理
2、下面我们来讲解一下如何搭建、使用私有仓库：
1、准备两台安装有docker的Centos7的机器，主机规划如下：
主机 IP 角色
node1 192.168.56.11 docker开发机
node2 192.168.56.12 docker私有仓库
3、安装、使用私有仓库
1、使用域名搭建https的私有仓库
1、首先修改两台机器的hosts,配置192.168.56.12到 docker.reg.com的映射，如果内部有 DNS，则不需要这样配置
echo '192.168.56.12 docker.reg.com'>> /etc/hosts
操作方法：[root@linux-node2 ~]# echo '192.168.11.12 docker.reg.com'>> /etc/hosts [root@linux-node2 ~]# [root@linux-node1 ~]# echo '192.168.11.12 docker.reg.com'>> /etc/hosts [root@linux-node1 ~]#2、既然使用https，那么我们需要生成证书，本文讲解的是使用openssl自签名证书，当然也可以使用诸如Let’s Encrypt 等工具生成证书，首先在node2机器上生成key：
[root@linux-node2 ~]# mkdir -p ~/certs [root@linux-node2 ~]# cd certs/ [root@linux-node2 certs]# openssl genrsa -out docker.reg.com.key 2048 Generating RSA private key, 2048 bit long modulus .........+++ ......................................................................................................................................................................+++ e is 65537 (0x10001) [root@linux-node2 certs]# 生成密钥 [root@linux-node2 certs]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout docker.reg.com.key -x509 -days 365 -out docker.reg.com.crt Generating a 4096 bit RSA private key ........................................................................................................++ ..............++ writing new private key to 'docker.reg.com.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN #你的国家 State or Province Name (full name) []:BJ # 省份 Locality Name (eg, city) [Default City]:BJ #城市 Organization Name (eg, company) [Default Company Ltd]:it #组织名称 Organizational Unit Name (eg, section) []:it #组织单元名称 Common Name (eg, your name or your server's hostname) []:docker.reg.com #域名 Email Address []:abcd@163.com #邮箱 [root@linux-node2 certs]# [root@linux-node2 certs]# ls docker.reg.com.crt docker.reg.com.key [root@linux-node2 certs]# 这样自制签名就制作完成了
4、 由于是自签名证书，默认是不受Docker信任的，故而需要将证书添加到Docker的根证书中，Docker在CentOS 7中，证书存放路径是/etc/docker/certs.d/域名：
node2端： [root@linux-node2 ~]# mkdir -p /etc/docker/certs.d/docker.reg.com [root@linux-node2 ~]# cp ~/certs/docker.reg.com.crt /etc/docker/certs.d/docker.reg.com/ [root@linux-node2 ~]# node1端：将生成的证书现在到根证书路径 [root@linux-node1 ~]# mkdir -p /etc/docker/certs.d/docker.reg.com [root@linux-node1 ~]# scp root@192.168.56.12:/root/certs/docker.reg.com.crt /etc/docker/certs.d/docker.reg.com/ The authenticity of host '192.168.56.12 (192.168.56.12)' can't be established. ECDSA key fingerprint is d7:ed:3d:79:50:c5:da:99:13:be:13:65:fe:5a:ec:a6. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.56.12' (ECDSA) to the list of known hosts. root@192.168.56.12's password: docker.reg.com.crt 100% 2057 2.0KB/s 00:00 [root@linux-node1 ~]# ll /etc/docker/certs.d/docker.reg.com/ total 4 -rw-r--r-- 1 root root 2057 Aug 28 10:58 docker.reg.com.crt [root@linux-node1 ~]# 重启node1和node2的 Docker [root@linux-node1 ~]# systemctl restart docker [root@linux-node1 ~]# [root@linux-node2 ~]# systemctl restart docker [root@linux-node2 ~]#
5、在node2上启动私有仓库
首先切换到家目录，这一步不能少，原因下面的-v挂载了证书，如果不切换，将会引领不到证书
cd ~
6、启动docker私有仓库
1、创建Docker私有仓库目录 [root@linux-node2 ~]# mkdir /opt/docker-image -p 2、启动docker私有仓库 [root@linux-node2 ~]# docker run -d -p 443:5000 --restart=always --name registry2 -v `pwd`/certs:/certs -v /opt/docker-image:/var/lib/registry -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/docker.reg.com.crt -e REGISTRY_HTTP_TLS_KEY=/certs/docker.reg.com.key registry:2 Unable to find image 'registry:2' locally 2: Pulling from library/registry 4064ffdc82fe: Pull complete c12c92d1c5a2: Pull complete 4fbc9b6835cc: Pull complete 765973b0f65f: Pull complete 3968771a7c3a: Pull complete Digest: sha256:51bb55f23ef7e25ac9b8313b139a8dd45baa832943c8ad8f7da2ddad6355b3c8 Status: Downloaded newer image for registry:2 f5808ac5c389e81ac91458fa8160605b738b5aadd3f1b202ae5bb951b104b38b [root@linux-node2 ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES f5808ac5c389 registry:2 "/entrypoint.sh /etc…" 32 seconds ago Up 31 seconds 0.0.0.0:443->5000/tcp registry [root@linux-node2 ~]#
其中，之所以挂载/opt/docker-image目录，是为了防止私有仓库容器被删除，私有仓库中的镜像也会丢失
7、在Docker开发机上pull镜像以及上传到私有库
[root@linux-node1 ~]# docker pull nginx Using default tag: latest latest: Pulling from library/nginx be8881be8156: Pull complete 32d9726baeef: Pull complete 87e5e6f71297: Pull complete Digest: sha256:d85914d547a6c92faa39ce7058bd7529baacab7e0cd4255442b04577c4d1f424 Status: Downloaded newer image for nginx:latest [root@linux-node1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE nginx latest c82521676580 4 weeks ago 109MB [root@linux-node1 ~]# [root@linux-node1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE nginx latest c82521676580 4 weeks ago 109MB docker.reg.com/nginx 1 c82521676580 4 weeks ago 109MB [root@linux-node1 ~]# [root@linux-node1 ~]# docker tag nginx docker.reg.com/nginx:1 [root@linux-node1 ~]# docker push docker.reg.com/nginx:1 The push refers to repository [docker.reg.com/nginx] 08d25fa0442e: Pushed a8c4aeeaa045: Pushed cdb3f9544e4c: Pushed 1: digest: sha256:4ffd9758ea9ea360fd87d0cee7a2d1cf9dba630bb57ca36b3108dcd3708dc189 size: 948 说明已经push成功 [root@linux-node1 ~]#
8、在Docker开发机上删除本地docker删除本地镜像缓存，从私有库pull镜像
[root@linux-node1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE nginx latest c82521676580 4 weeks ago 109MB docker.reg.com/nginx 1 c82521676580 4 weeks ago 109MB 删除本机缓存 [root@linux-node1 ~]# docker rmi docker.reg.com/nginx:1 Untagged: docker.reg.com/nginx:1 Untagged: docker.reg.com/nginx@sha256:4ffd9758ea9ea360fd87d0cee7a2d1cf9dba630bb57ca36b3108dcd3708dc189 [root@linux-node1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE nginx latest c82521676580 4 weeks ago 109MB [root@linux-node1 ~]# docker rmi nginx Untagged: nginx:latest Untagged: nginx@sha256:d85914d547a6c92faa39ce7058bd7529baacab7e0cd4255442b04577c4d1f424 Deleted: sha256:c82521676580c4850bb8f0d72e47390a50d60c8ffe44d623ce57be521bca9869 Deleted: sha256:2c1f65d17acf8759019a5eb86cc20fb8f8a7e84d2b541b795c1579c4f202a458 Deleted: sha256:8f222b457ca67d7e68c3a8101d6509ab89d1aad6d399bf5b3c93494bbf876407 Deleted: sha256:cdb3f9544e4c61d45da1ea44f7d92386639a052c620d1550376f22f5b46981af [root@linux-node1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE [root@linux-node1 ~]# docker pull docker.reg.com/nginx:1 1: Pulling from nginx be8881be8156: Pull complete 32d9726baeef: Pull complete 87e5e6f71297: Pull complete Digest: sha256:4ffd9758ea9ea360fd87d0cee7a2d1cf9dba630bb57ca36b3108dcd3708dc189 Status: Downloaded newer image for docker.reg.com/nginx:1 [root@linux-node1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE docker.reg.com/nginx 1 c82521676580 4 weeks ago 109MB [root@linux-node1 ~]#
9、Docker配置登录认证
在很多场景下，我们需要用户登录后才能访问私有仓库，那么我们可以如下操作：
建立在上文升成证书，同时重启docker服务的前提下，我们讲解下如何配置：1、为防止端口冲突，我们首先要停止或删除之前已经启动好的私有仓库：
[root@linux-node2 ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 91c0b79e5aa1 registry:2 "/entrypoint.sh /etc…" 3 hours ago Up 3 hours 0.0.0.0:443->5000/tcp registry2 [root@linux-node2 ~]# docker kill 91c0b79e5aa1 91c0b79e5aa1 [root@linux-node2 ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES [root@linux-node2 ~]#
2、在node2机器上安装httpd-tools:
[root@linux-node2 ~]# yum -y install httpd-tools3、在node2机器上创建密码文件，并添加用户user1,密码user1:
[root@linux-node2 ~]# cd ~ [root@linux-node2 ~]# mkdir auth [root@linux-node2 ~]# htpasswd -Bbn user1 user1 > auth/htpasswd
4、在node2机器上切换到~ 目录，并启动私有仓库
[root@linux-node2 ~]#docker run -d -p 443:5000 --restart=always --name registry3 \-v `pwd`/certs:/certs \-v /opt/docker-image:/var/lib/registry \-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/docker.reg.com.crt \-e REGISTRY_HTTP_TLS_KEY=/certs/docker.reg.com.key \-v `pwd`/auth:/auth -e "REGISTRY_AUTH=htpasswd" \-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry:2
5、在Docker开发机重新push镜像到私有库
[root@linux-node1 ~]# docker tag tomcat docker.reg.com/tomcat:2 [root@linux-node1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE tomcat latest 690cb3b9c7d1 5 days ago 463MB docker.reg.com/tomcat 2 690cb3b9c7d1 5 days ago 463MB docker.reg.com/tomcat latest 690cb3b9c7d1 5 days ago 463MB docker.reg.com/nginx 1 c82521676580 4 weeks ago 109MB [root@linux-node1 ~]# docker push docker.reg.com/tomcat:2 The push refers to repository [docker.reg.com/tomcat] ce40a8407fb4: Preparing 44c236f0f89c: Preparing 968b9f959aa6: Preparing 44ffe8811308: Preparing a158c36dcac9: Preparing b6ffe8dd0a7c: Preparing 1dccf0da88f3: Preparing d2070b14033b: Preparing 63dcf81c7ca7: Preparing ce6466f43b11: Preparing 719d45669b35: Preparing 3b10514a95be: Preparing no basic auth credentials 提示不是被认证的 [root@linux-node1 ~]# 说明需要认证。 我们登陆一下，执行： [root@linux-node1 ~]# docker login docker.reg.com #登录私有库 Username: user1 Password: WARNING! Your password will be stored unencrypted in /root/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/engine/reference/commandline/login/#credentials-store Login Succeeded #登录成功 [root@linux-node1 ~]# docker push docker.reg.com/tomcat:2 The push refers to repository [docker.reg.com/tomcat] ce40a8407fb4: Layer already exists 44c236f0f89c: Layer already exists 968b9f959aa6: Layer already exists 44ffe8811308: Layer already exists a158c36dcac9: Layer already exists b6ffe8dd0a7c: Layer already exists 1dccf0da88f3: Layer already exists d2070b14033b: Layer already exists 63dcf81c7ca7: Layer already exists ce6466f43b11: Layer already exists 719d45669b35: Layer already exists 3b10514a95be: Layer already exists 2: digest: sha256:037e17517ca8a656a2657beeeb4f2f15e6e20db8b12634c0dc2a2afd5e7ca89a size: 2836 [root@linux-node1 ~]#
