Harbor: 企业级Registry的构建利器
Docker的镜像的管理，出于各种考虑，很多企业会搭建自己的私有仓库。而为企业提供私有仓库的搭建，从商业的到开源的Harbor都不是第一个。Docker的V2也能方便的提供类似功能，但是原生态的V2给人感觉更接近于原始态，当然这个只是其将用户引导到收费的dockerhub上的工具，自然可以理解。而Vmware给出的开源的企业级Registry的解决方案，让人觉得使用起来更加方便。并且这似乎是vmware中国团队提供的功能，无形之中又有了更多的亲切感，看到越来越多的中国团队出现在开源的前沿，实在是很开心的一件事情。
Why harbor
以下是harbor自己认为自己做的好的地方。
| 优势 | 详细说明 |
|---|---|
| 安全 | 确保知识产权在自己组织内部的管控之下。 |
| 效率 | 搭建组织内部的私有容器Registry服务，可显著降低访问公共Registry服务的网络需求。 |
| 访问控制 | 提供基于角色的访问控制，可集成企业目前拥有的用户管理系统（如:AD/LDAP）。 |
| 审计 | 所有访问Registry服务的操作均被记录，便于日后审计。 |
| 管理界面 | 具有友好易用图形管理界面。 |
| 镜像复制 | 在实例之间复制镜像。 |
安装方式
Habor提供了两种安装方式，一种是从源码，一种是下载编译好的二进制包。本着没事不找事，有现成的不亲力亲为的懒人原则，咱们使用后者。
| 参照内容 | link |
|---|---|
| 二进制包 | https://github.com/vmware/harbor/releases |
| 安装文档 | https://github.com/vmware/harbor/blob/master/docs/installation_guide.md |
下载二进制包并解压
下载命令：
wget https://github.com/vmware/harbor/releases/download/0.3.0/harbor-0.3.0.tgz
PS: 10M不到，下载很慢，请准备好零食。
解压
[root@host34 tmp]# ll harbor-0.3.0.tgz
-rw-r--r--. 1 root root 10231101 Aug 15 04:09 harbor-0.3.0.tgz
[root@host34 tmp]#
[root@host34 tmp]# tar xvpf harbor-0.3.0.tgz设定habor.cfg
解压后生成了habor的目录，这个目录中的habor.cfg文件需要进行自定义的设定，harbor0.30的default的habor.cfg是长成这个样子的。
[root@host34 harbor]# cat harbor.cfg
## Configuration file of Harbor
#The IP address or hostname to access admin UI and registry service.
#DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname = reg.mydomain.com
#The protocol for accessing the UI and token/notification service, by default it is http.
#It can be set to https if ssl is enabled on nginx.
ui_url_protocol = http
#Email account settings for sending out password resetting emails.
email_server = smtp.mydomain.com
email_server_port = 25
email_username = [email protected]
email_password = abc
email_from = admin
email_ssl = false
##The password of Harbor admin, change this before any production use.
harbor_admin_password = Harbor12345
##By default the auth mode is db_auth, i.e. the credentials are stored in a local database.
#Set it to ldap_auth if you want to verify a user's credentials against an LDAP server.
auth_mode = db_auth
#The url for an ldap endpoint.
ldap_url = ldaps://ldap.mydomain.com
#The basedn template to look up a user in LDAP and verify the user's password.
#For AD server, uses this template:
#ldap_basedn = CN=%s,OU=Dept1,DC=mydomain,DC=com
ldap_basedn = uid=%s,ou=people,dc=mydomain,dc=com
#The password for the root user of mysql db, change this before any production use.
db_password = root123
#Turn on or off the self-registration feature
self_registration = on
#Determine whether the UI should use compressed js files.
#For production, set it to on. For development, set it to off.
use_compressed_js = on
#Maximum number of job workers in job service
max_job_workers = 3
#Determine whether the job service should verify the ssl cert when it connects to a remote registry.
#Set this flag to off when the remote registry uses a self-signed or untrusted certificate.
verify_remote_cert = on
#Determine whether or not to generate certificate for the registry's token.
#If the value is on, the prepare script creates new root cert and private key
#for generating token to access the registry. If the value is off, a key/certificate must
#be supplied for token generation.
customize_crt = on
#Information of your organization for certicate
crt_country = CN
crt_state = State
crt_location = CN
crt_organization = organization
crt_organizationalunit = organizational unit
crt_commonname = example.com
crt_email = [email protected]
#####
[root@host34 harbor]# 最低限度要设定一下hostname，设定成IP吧。
hostname = 192.168.32.34
prepare
prepare是Harbor提供的一个python脚本，做配置之后启动之前的准备活动。
[root@host34 tmp]# pwd
/tmp
[root@host34 tmp]# cd harbor
[root@host34 harbor]# ll
total 24
drwxr-xr-x. 6 root root 59 Jul 15 05:34 config
drwxr-xr-x. 2 root root 69 Jul 15 05:34 db
-rw-r--r--. 1 root root 1838 Jul 15 04:21 docker-compose.yml
-rw-r--r--. 1 root root 2393 Jul 15 05:34 harbor.cfg
drwxr-xr-x. 2 root root 40 Jul 15 05:34 jobservice
-rwxr-xr-x. 1 root root 666 Jul 15 04:21 load_image.sh
drwxr-xr-x. 2 root root 96 Jul 15 05:34 log
-rwxr-xr-x. 1 root root 6842 Jul 15 05:34 prepare
-rwxr-xr-x. 1 root root 942 Jul 15 04:21 save_image.sh
drwxr-xr-x. 6 root root 56 Jul 15 05:34 templates
drwxr-xr-x. 4 root root 93 Jul 15 05:34 ui
[root@host34 harbor]# ./prepare
Generated configuration file: ./config/ui/env
Generated configuration file: ./config/ui/app.conf
Generated configuration file: ./config/registry/config.yml
Generated configuration file: ./config/db/env
Generated configuration file: ./config/jobservice/env
Clearing the configuration file: ./config/ui/private_key.pem
Clearing the configuration file: ./config/registry/root.crt
Generated configuration file: ./config/ui/private_key.pem
Generated configuration file: ./config/registry/root.crt
The configuration files are ready, please use docker-compose to start the service.
[root@host34 harbor]#关于load_image.sh，看了一下，就是一个无比简单的脚本，使用docker load -i将offline下载下来的包load进去，考虑到直接上不了网或者各种proxy设定的情况，很贴心。
代理设定
代理的设定只有在内网的时候，需要通过代理访问外网才需要执行此步
设定环境变量
# export http_proxy=http://proxyserver.com:8080/
# export https_proxy=http://proxyserver.com:8080/
# export no_proxy=localhost,127.0.0.1修正docker-compose.yml的ui和jobservice的build段：加上proxy环境变量
ui:
build:
context: ./ui/
args:
- http_proxy
- https_proxy
- no_proxy jobservice:
build:
context: ./jobservice/
args:
- http_proxy
- https_proxy
- no_proxysyslog-tag标签
修正docker-compose.yml的logging段的syslog-tag标签，因为我用的docker是1.12版，已经提示不认识了，所以不得不修改如下。
如果是旧的版本的话应该不用修改。
[root@host34 harbor]# grep tag: docker-compose.yml
tag: "registry"
tag: "mysql"
tag: "ui"
tag: "jobservice"
tag: "proxy"
[root@host34 harbor]#启动Habor
docker-compose up的时候，会自动下载其用到的镜像。第一次执行时会自动进行build，打出类似如下的build信息。
Building log
Step 1 : FROM library/ubuntu:14.04
14.04: Pulling from library/ubuntu
064f9af02539: Pull complete
390957b2f4f0: Pull complete
cee0974db2b8: Pull complete
c8144262002c: Pull complete
Digest: sha256:ef500a237fb51cea075b270d811601c7226097f61b34a8ed4b4aa4e350a2c66d
Status: Downloaded newer image for ubuntu:14.04
---> ff6011336327
Step 2 : RUN mv /etc/cron.daily/logrotate /etc/cron.hourly/ && rm /etc/rsyslog.d/* && rm /etc/rsyslog.conf
---> Running in c6f66b4a119b
---> 7ad3979ac880
Removing intermediate container c6f66b4a119b
Step 3 : ADD rsyslog.conf /etc/rsyslog.conf
---> 3d4233511243
Removing intermediate container 9e4c53d9959f
Step 4 : ADD logrotate_docker.conf /etc/logrotate.d/
---> d5cad8b33084
Removing intermediate container d2328387f34b
Step 5 : ADD rsyslog_docker.conf /etc/rsyslog.d/
---> 935de114769d
Removing intermediate container 63e35fcb9fb7
Step 6 : VOLUME /var/log/docker/
---> Running in 4a3a6a4b2002
---> 60b5221e00eb
Removing intermediate container 4a3a6a4b2002
Step 7 : EXPOSE 514
---> Running in 65d3b24e9362
---> 7ea455bb99c7
Removing intermediate container 65d3b24e9362
Step 8 : CMD cron && rsyslogd -n
---> Running in e44c81ecae56
---> 826257404781
Removing intermediate container e44c81ecae56
Successfully built 826257404781
WARNING: Image for service log was built because it did not already exist. To rebuild this image you must use `docker-compose build` or `docker-compose up --build`.
Building ui
Step 1 : FROM golang:1.6.2
1.6.2: Pulling from library/golang
5c90d4a2d1a8: Already exists
ab30c63719b1: Already exists
c6072700a242: Already exists
0ffc1204e0ab: Pull complete
d8a921df8ce9: Pull complete
d34bc98c2770: Pull complete
b0850b14d0d1: Pull complete
Digest: sha256:95875692658d8938644205d5911d655a134b621dd83b94569bd395fb59b08fa9
Status: Downloaded newer image for golang:1.6.2
---> 8ecba0e9bd48
Step 2 : ENV MYSQL_USR root
---> Running in 75421c3fb9d9
---> 671a9449bba1
Removing intermediate container 75421c3fb9d9
Step 3 : ENV MYSQL_PWD root
---> Running in 201fe5e747eb
---> 7f44c3c47a90
Removing intermediate container 201fe5e747eb
Step 4 : ENV MYSQL_PORT_3306_TCP_ADDR localhost
---> Running in 8f340cdd2a4b
---> c0296084029e
Removing intermediate container 8f340cdd2a4b
Step 5 : ENV MYSQL_PORT_3306_TCP_PORT 3306
---> Running in ae5e08e07a42
---> ddb109746d8b
Removing intermediate container ae5e08e07a42
Step 6 : ENV REGISTRY_URL localhost:5000
---> Running in 6d53f6ed644b
---> 5dc6dec3b7b6
Removing intermediate container 6d53f6ed644b
Step 7 : RUN apt-get update -qqy && apt-get install -qqy libldap2-dev
---> Running in 55b3c73e85f2
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package libldap2-dev:amd64.
(Reading database ... 14719 files and directories currently installed.)
Preparing to unpack .../libldap2-dev_2.4.40+dfsg-1+deb8u2_amd64.deb ...
Unpacking libldap2-dev:amd64 (2.4.40+dfsg-1+deb8u2) ...
Setting up libldap2-dev:amd64 (2.4.40+dfsg-1+deb8u2) ...
---> d7025c8b962b
Removing intermediate container 55b3c73e85f2
Step 8 : ADD ui /go/bin/harbor_ui
---> f6574df26e8d
Removing intermediate container e1f16e0be353
Step 9 : ADD views /go/bin/views
---> f6889bf5956a
Removing intermediate container 4f690fa9cbe2
Step 10 : ADD static /go/bin/static
---> a791108c3961
Removing intermediate container 44f2f09bca0a
Step 11 : COPY favicon.ico /go/bin/favicon.ico
---> c1f22764e9c5
Removing intermediate container 283f26b66643
Step 12 : COPY jsminify.sh /tmp/jsminify.sh
---> 4e16d1f00fa1
Removing intermediate container f7d884efa187
Step 13 : RUN chmod u+x /go/bin/harbor_ui
---> Running in 57c2dc7d956f
---> 4e723e897f3a
Removing intermediate container 57c2dc7d956f
Step 14 : RUN sed -i 's/TLS_CACERT/#TLS_CAERT/g' /etc/ldap/ldap.conf
---> Running in 6a0be08d0e27
---> cf5bed44ab07
Removing intermediate container 6a0be08d0e27
Step 15 : RUN sed -i '$a\TLS_REQCERT allow' /etc/ldap/ldap.conf
---> Running in 2e63fbf2f811
---> da2a396807b5
Removing intermediate container 2e63fbf2f811
Step 16 : RUN /tmp/jsminify.sh /go/bin/views/sections/script-include.htm /go/bin/static/resources/js/harbor.app.min.js
---> Running in 6ff19a059d32
This shell will minify the Javascript in Harbor project.
Usage: #jsminify [src] [dest]
Concat js files...
Remove space..
Remove '//'and '/*' annotation...
Remove CR ...
Done.
---> c6ddf043a213
Removing intermediate container 6ff19a059d32
Step 17 : WORKDIR /go/bin/
---> Running in 9d4301d17a28
---> 2cca0c38dc14
Removing intermediate container 9d4301d17a28
Step 18 : ENTRYPOINT /go/bin/harbor_ui
---> Running in 9724a3ea66b2
---> f66405331a0a
Removing intermediate container 9724a3ea66b2
Step 19 : EXPOSE 80
---> Running in 3571d2c88e2c
---> 04c5fb1c334d
Removing intermediate container 3571d2c88e2c
Successfully built 04c5fb1c334d
WARNING: Image for service ui was built because it did not already exist. To rebuild this image you must use `docker-compose build` or `docker-compose up --build`.
Building mysql
Step 1 : FROM mysql:5.6
5.6: Pulling from library/mysql
357ea8c3d80b: Already exists
256a92f57ae8: Pull complete
d5ee0325fe91: Pull complete
a15deb03758b: Pull complete
7b8a8ccc8d50: Pull complete
1a40eeae36e9: Pull complete
4a09128b6a34: Pull complete
587b9302fad1: Pull complete
c0c47ca2042a: Pull complete
fa370478ab1f: Pull complete
952d92d0e00a: Pull complete
Digest: sha256:dcb7adfd0452994933b64cd9a91f70acc89ac8d3f78261827bd8162bc20a737e
Status: Downloaded newer image for mysql:5.6
---> 5e0f1b09e25e
Step 2 : WORKDIR /tmp
---> Running in eacd8724dc0f
---> 5fc66f8cc86b
Removing intermediate container eacd8724dc0f
Step 3 : ADD registry.sql r.sql
---> fc4c1afe1400
Removing intermediate container 9aaed626a349
Step 4 : ADD docker-entrypoint.sh /entrypoint.sh
---> 8e0e76ce7967
Removing intermediate container 031ccc51d5d4
Step 5 : RUN chmod u+x /entrypoint.sh
---> Running in 0c15f566942b
---> 3f1a78b0bf43
Removing intermediate container 0c15f566942b
Successfully built 3f1a78b0bf43
WARNING: Image for service mysql was built because it did not already exist. To rebuild this image you must use `docker-compose build` or `docker-compose up --build`.
Building jobservice
Step 1 : FROM golang:1.6.2
---> 8ecba0e9bd48
Step 2 : MAINTAINER [email protected]
---> Running in 9d2e58613bdf
---> 8402f2cfb451
Removing intermediate container 9d2e58613bdf
Step 3 : RUN apt-get update && apt-get install -y libldap2-dev && rm -r /var/lib/apt/lists/*
---> Running in 198bb3ea5236
Get:1 http://security.debian.org jessie/updates InRelease [63.1 kB]
Ign http://httpredir.debian.org jessie InRelease
Get:2 http://httpredir.debian.org jessie-updates InRelease [142 kB]
Get:3 http://httpredir.debian.org jessie Release.gpg [2373 B]
Get:4 http://security.debian.org jessie/updates/main amd64 Packages [385 kB]
Get:5 http://httpredir.debian.org jessie Release [148 kB]
Get:6 http://httpredir.debian.org jessie-updates/main amd64 Packages [17.6 kB]
Get:7 http://httpredir.debian.org jessie/main amd64 Packages [9032 kB]
Fetched 9790 kB in 40s (242 kB/s)
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
The following NEW packages will be installed:
libldap2-dev
0 upgraded, 1 newly installed, 0 to remove and 12 not upgraded.
Need to get 323 kB of archives.
After this operation, 1411 kB of additional disk space will be used.
Get:1 http://httpredir.debian.org/debian/ jessie/main libldap2-dev amd64 2.4.40+dfsg-1+deb8u2 [323 kB]
debconf: delaying package configuration, since apt-utils is not installed
Fetched 323 kB in 3s (82.7 kB/s)
Selecting previously unselected package libldap2-dev:amd64.
(Reading database ... 14719 files and directories currently installed.)
Preparing to unpack .../libldap2-dev_2.4.40+dfsg-1+deb8u2_amd64.deb ...
Unpacking libldap2-dev:amd64 (2.4.40+dfsg-1+deb8u2) ...
Setting up libldap2-dev:amd64 (2.4.40+dfsg-1+deb8u2) ...
---> e2f67c7c3681
Removing intermediate container 198bb3ea5236
Step 4 : ADD jobservice /go/bin/harbor_jobservice
---> a72e84e1293b
Removing intermediate container d28308d7d390
Step 5 : RUN chmod u+x /go/bin/harbor_jobservice
---> Running in 7f09927d26e3
---> 64bea5147f78
Removing intermediate container 7f09927d26e3
Step 6 : WORKDIR /go/bin/
---> Running in 401c44ce58c1
---> 69bbc8de739a
Removing intermediate container 401c44ce58c1
Step 7 : ENTRYPOINT /go/bin/harbor_jobservice
---> Running in f67941a3fed4
---> 44f9b4f5ffa5
Removing intermediate container f67941a3fed4
Successfully built 44f9b4f5ffa5
WARNING: Image for service jobservice was built because it did not already exist. To rebuild this image you must use `docker-compose build` or `docker-compose up --build`.
Pulling registry (library/registry:2.4.0)...
2.4.0: Pulling from library/registry
8b87079b7a06: Pull complete
a3ed95caeb02: Pull complete
ab57f16e019e: Pull complete
87821bf06837: Pull complete
26c4a2196c76: Pull complete
Digest: sha256:6c65924b0d17593f2a05daa5d5403b47dfdb3aba9e3a0a97e4df75fd1bc27238
Status: Downloaded newer image for registry:2.4.0
Pulling proxy (library/nginx:1.9)...
1.9: Pulling from library/nginx
51f5c6a04d83: Pull complete
a3ed95caeb02: Pull complete
640c8f3d0eb2: Pull complete
a4335300aa89: Pull complete
Digest: sha256:54313b5c376892d55205f13d620bc3dcccc8e70e596d083953f95e94f071f6db
Status: Downloaded newer image for nginx:1.9第一次之后就再也不需要build，启动画面清静很多
[root@host34 harbor]# pwd
/tmp/harbor
[root@host34 harbor]# docker-compose up -d
Starting harbor_log_1
Starting harbor_registry_1
Starting harbor_mysql_1
Starting harbor_ui_1
Starting harbor_jobservice_1
Starting harbor_proxy_1
[root@host34 harbor]#启动登录画面
注册一个用户
用注册的用户登录
查看项目
