Docker(四) docker本地鏡像倉庫學習

1. Docker registry

#檢查端口5000是否被佔用
netstat -tunlp | grep 5000
# the local host ip is 172.17.0.1
# pull registry
mkdir -p /opt/myregistry
docker run -d -p 5000:5000 --name registry --restart=always -v /opt/myregistry:/var/lib/registry registry:2.4.1
# double check the registry is ok.
curl http://172.17.0.1:5000/v2
# modify https to http
echo "{"insecure-registries:["172.17.0.1:5000"]"}"
docker pull busybox
docker tag busybox 172.17.0.1:5000/busybox01
docker rmi busybox
docker push 172.17.0.1:5000/busybox01
docker rmi 172.17.0.1:5000/busybox01
docker pull 172.17.0.1:5000/busybox01

2. Docker hub

• docker hub

3. harbor

download harbor offline tar package

wget https://github.com/vmware/harbor/releases/download/v1.2.2/harbor-offline-installer-v1.2.2.tgz -o /home/marion/docker
tar xf /home/marion/docker/harbor-offline-installer-v1.2.2.tgz
cd /home/marion/docker/harbor

安裝環境依賴

apt-get install openssl python

安裝harbor

配置ssl證書

openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 3650 -out ca.crt
Generating a 4096 bit RSA private key
................................................................................................................................................................................................++
....++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BeiJin
Locality Name (eg, city) []:BeiJin
Organization Name (eg, company) [Internet Widgits Pty Ltd]:haha       
Organizational Unit Name (eg, section) []:haha-ops
Common Name (e.g. server FQDN or YOUR name) []:harbor.haha.link
Email Address []:[email protected]

root@harbor:~/harbor/harborcert# openssl req -newkey rsa:4096 -nodes -sha256 -keyout haha.link.key -out haha.link.csr                
Generating a 4096 bit RSA private key
...........................................................................................................................++
...++
writing new private key to 'haha.link.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:BeiJin   
Locality Name (eg, city) []:BeiJin
Organization Name (eg, company) [Internet Widgits Pty Ltd]:haha
Organizational Unit Name (eg, section) []:haha-ops
Common Name (e.g. server FQDN or YOUR name) []:harbor.haha.link
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:admin123
An optional company name []:haha

root@harbor:~/harbor/harborcert# openssl x509 -req -days 3650 -in haha.link.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out haha.link.crt
Signature ok
subject=/C=CN/ST=BeiJin/L=BeiJin/O=haha/OU=haha-ops/CN=harbor.haha.link/[email protected]
Getting CA Private Key

mkdir -pv /etc/docker/certs.d/harbor.haha.link
root@harbor:~/harbor/harborcert# cp ca.crt /etc/docker/certs.d/harbor.haha.link/
root@harbor:~/harbor/harborcert# cp haha.link.crt /usr/local/share/ca-certificates/harbor.haha.link.crt
root@harbor:~/harbor/harborcert# update-ca-certificates
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

更新harbor配置文件

• 更新harbor.cfg配置文件

  hostname = www.proharbor.com
  ui_url_protocol = https
  ssl_cert = /home/marion/docker/harbor/newcert/proharbor.com.crt
  ssl_cert_key = /home/marion/docker/harbor/newcert/proharbor.com.key

• 更新docker-compose.yml

  # 創建本地倉庫鏡像的存儲目錄
  cd /home/marion/docker/harbor
  mkdir /home/marion/harborregistry/
  vim docker-compose.yml
  # ------以下是docker-compose.yml修改後的內容------
  version: '2'
  services:
  log:
  image: vmware/harbor-log:v1.2.2
  container_name: harbor-log 
  restart: always
  volumes:
    - /var/log/harbor/:/var/log/docker/:z
  ports:
    - 127.0.0.1:1514:514
  networks:
    - harbor
  registry:
  image: registry:2.4.1 #此處可以修改registry的版本
  container_name: registry
  restart: always
  volumes:
    - /home/marion/harborregistry:/storage:z  #此處可以按需修改到自己想存檔的位置
    - ./common/config/registry/:/etc/registry/:z
  networks:
    - harbor
  environment:
    - GODEBUG=netdns=cgo
  command:
    ["serve", "/etc/registry/config.yml"]
  depends_on:
    - log
  logging:
    driver: "syslog"
    options:  
      syslog-address: "tcp://127.0.0.1:1514"
      tag: "registry"
  mysql:
  image: vmware/harbor-db:v1.2.2
  container_name: harbor-db
  restart: always
  volumes:
    - /data/database:/var/lib/mysql:z
  networks:
    - harbor
  env_file:
    - ./common/config/db/env
  depends_on:
    - log
  logging:
    driver: "syslog"
    options:  
      syslog-address: "tcp://127.0.0.1:1514"
      tag: "mysql"
  adminserver:
  image: vmware/harbor-adminserver:v1.2.2
  container_name: harbor-adminserver
  env_file:
    - ./common/config/adminserver/env
  restart: always
  volumes:
    - /data/config/:/etc/adminserver/config/:z
    - /data/secretkey:/etc/adminserver/key:z
    - /data/:/data/:z
  networks:
    - harbor
  depends_on:
    - log
  logging:
    driver: "syslog"
    options:  
      syslog-address: "tcp://127.0.0.1:1514"
      tag: "adminserver"
  ui:
  image: vmware/harbor-ui:v1.2.2
  container_name: harbor-ui
  env_file:
    - ./common/config/ui/env
  restart: always
  volumes:
    - ./common/config/ui/app.conf:/etc/ui/app.conf:z
    - ./common/config/ui/private_key.pem:/etc/ui/private_key.pem:z
    - /data/secretkey:/etc/ui/key:z
    - /data/ca_download/:/etc/ui/ca/:z
    - /data/psc/:/etc/ui/token/:z
  networks:
    - harbor
  depends_on:
    - log
    - adminserver
    - registry
  logging:
    driver: "syslog"
    options:  
      syslog-address: "tcp://127.0.0.1:1514"
      tag: "ui"
  jobservice:
  image: vmware/harbor-jobservice:v1.2.2
  container_name: harbor-jobservice
  env_file:
    - ./common/config/jobservice/env
  restart: always
  volumes:
    - /data/job_logs:/var/log/jobs:z
    - ./common/config/jobservice/app.conf:/etc/jobservice/app.conf:z
    - /data/secretkey:/etc/jobservice/key:z
  networks:
    - harbor
  depends_on:
    - ui
    - adminserver
  logging:
    driver: "syslog"
    options:  
      syslog-address: "tcp://127.0.0.1:1514"
      tag: "jobservice"
  proxy:
  image: vmware/nginx-photon:1.11.13
  container_name: nginx
  restart: always
  volumes:
    - ./common/config/nginx:/etc/nginx:z
  networks:
    - harbor
  ports:
    - 80:80
    - 443:443
    - 4443:4443
  depends_on:
    - mysql
    - registry
    - ui
    - log
  logging:
    driver: "syslog"
    options:  
      syslog-address: "tcp://127.0.0.1:1514"
      tag: "proxy"
  networks:
  harbor:
  external: false

• 倉庫根目錄配置文件

version: 0.1
log:
  level: debug
  fields:
    service: registry
storage:
    cache:
        layerinfo: inmemory
    filesystem:
        rootdirectory: /storage
    maintenance:
        uploadpurging:
            enabled: false
    delete:
        enabled: true
http:
    addr: :5000
    secret: placeholder
    debug:
        addr: localhost:5001
auth:
  token:
    issuer: harbor-token-issuer
    realm: https://www.proharbor.com/service/token
    rootcertbundle: /etc/registry/root.crt
    service: harbor-registry

notifications:
  endpoints:
      - name: harbor
        disabled: false
        url: http://ui/service/notifications
        timeout: 3000ms
        threshold: 5
        backoff: 1s

安裝harbor以及notary,clair

cd /home/marion/docker/harbor/
sudo ./install.sh --with-notary --with-clair
#關閉harbor所有的容器(必須在含有docker-compose.yml文件的目錄下執行)
docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml -f ./docker-compose.clair.yml down -v
#啓動harbor相關的所有容器(必須在含有docker-compose.yml文件的目錄下執行)
docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml -f ./docker-compose.clair.yml up -d

驗證查看

！Harbor

• 打開瀏覽器，輸入https://www.proharbor.com
• 用戶名/密碼：admin/Harbor12345(默認的)
• 打開終端: docker login www.proharbor.com ,用戶名爲admin，密碼爲Harbor12345

查看日誌

harbor的運行日誌

#日誌路徑各不相同，具體路徑根據docker-compose.yml或者*/harbor/common/目錄下的配置文件進行確定
cd /var/log/harbor

harbor中鏡像的使用日誌

使用Harbor進行鏡像的管理

push/pull

# push
root@dockermaster:/home/marion/docker/harbor# docker tag redis www.proharbor.com/harborssl/redis:dev
root@dockermaster:/home/marion/docker/harbor# docker push www.proharbor.com/harborssl/redis:dev
The push refers to a repository [www.proharbor.com/harborssl/redis]
d112bb627859: Pushed 
265ab1ac61ec: Pushed 
2341e66d779d: Pushed 
9503917b6420: Pushed 
aa84bbcc6553: Pushed 
29d71372a492: Pushed 
dev: digest: sha256:b707a0c39062f1769c8e16069015e1ba839add849deb441428fc0c1deee67c36 size: 1571
# pull
root@dockermaster:/home/marion/docker/harbor# docker pull www.proharbor.com/harborssl/redis:dev
dev: Pulling from harborssl/redis
Digest: sha256:b707a0c39062f1769c8e16069015e1ba839add849deb441428fc0c1deee67c36
Status: Downloaded newer image for www.proharbor.com/harborssl/redis:dev

鏡像的掃描clair