十三、搭建Harbor私有镜像仓库

1、介绍

Docker容器应用的开发和运行离不开可靠的镜像管理，虽然Docker官方也提供了公共的镜像仓库，但是从安全和效率等方面考虑，部署我们私有环境内的Registry也是非常必要的。Harbor是由VMware公司开源的企业级的Docker Registry管理项目，它包括权限管理(RBAC)、LDAP、日志审核、管理界面、自我注册、镜像复制和中文支持等功能。

2、前提准备

确认已安装好docker、docker-compose

[root@MyCentos7-1 harbor]# docker version

Client:

 Version:         1.13.1

 API version:     1.26

 Package version: docker-1.13.1-63.git94f4240.el7.centos.x86_64

 Go version:      go1.9.4

 Git commit:      94f4240/1.13.1

 Built:           Fri May 18 15:44:33 2018

 OS/Arch:         linux/amd64

 

Server:

 Version:         1.13.1

 API version:     1.26 (minimum version 1.12)

 Package version: docker-1.13.1-63.git94f4240.el7.centos.x86_64

 Go version:      go1.9.4

 Git commit:      94f4240/1.13.1

 Built:           Fri May 18 15:44:33 2018

 OS/Arch:         linux/amd64

 Experimental:    false

[root@MyCentos7-1 harbor]# docker-compose version

docker-compose version 1.12.0, build b31ff33

docker-py version: 2.2.1

CPython version: 2.7.13

OpenSSL version: OpenSSL 1.0.1t  3 May 2016

3、安装Harbor

3.1下载Harbor安装文件并解压（离线包）

[root@MyCentos7-1 docker]# wget https://storage.googleapis.com/harbor-releases/release-1.5.0/harbor-offline-installe-v1.5.1.tgz

[root@MyCentos7-1 docker]# tar xvf harbor-offline-installer-v1.5.1.tgz

3.2修改配置文件harbor.cfg（红色字体为改动部分）

解压缩之后，目录下回生成harbor.cfg文件，该文件就是Harbor的配置文件

[root@MyCentos7-1 harbor]# vi harbor.cfg

 

## Configuration file of Harbor

#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!

_version = 1.5.0

#The IP address or hostname to access admin UI and registry service.

#DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.

hostname = MyCentos7-1          ##设置访问地址，可以使用ip、主机名，不可以设置为127.0.0.1或localhost

 

#The protocol for accessing the UI and token/notification service, by default it is http.

#It can be set to https if ssl is enabled on nginx.

ui_url_protocol = http　　　　　　##设置访问协议，默认http，若设为https则nginx ssl需要设置on

#Maximum number of job workers in job service 

max_job_workers = 50

#Determine whether or not to generate certificate for the registry's token.

#If the value is on, the prepare script creates new root cert and private key

#for generating token to access the registry. If the value is off the default key/cert will be used.

#This flag also controls the creation of the notary signer's cert.

customize_crt = on

 

#The path of cert and key files for nginx, they are applied only the protocol is set to https

ssl_cert = /data/cert/server.crt           ##若没有此目录则需要手动建立

ssl_cert_key = /data/cert/server.key

 

#The path of secretkey storage

secretkey_path = /data

 

#Admiral's url, comment this attribute, or set its value to NA when Harbor is standalone

admiral_url = NA

 

#Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.

log_rotate_count = 50

#Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.

#If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G

#are all valid.

log_rotate_size = 200M

 

#Config http proxy for Clair, e.g. http://my.proxy.com:3128

#Clair doesn't need to connect to harbor ui container via http proxy.

http_proxy =

https_proxy =

no_proxy = 127.0.0.1,localhost,ui

 

#NOTES: The properties between BEGIN INITIAL PROPERTIES and END INITIAL PROPERTIES

#only take effect in the first boot, the subsequent changes of these properties

#should be performed on web ui

 

#************************BEGIN INITIAL PROPERTIES************************

 

#Email account settings for sending out password resetting emails.

 

#Email server uses the given username and password to authenticate on TLS connections to host and act as identity.

#Identity left blank to act as username.

email_identity =             ##邮件设置，发送重置密码邮件时使用

 

email_server = smtp.mydomain.com

email_server_port = 25

email_username = [email protected]

email_password = abc

email_from = admin

email_ssl = false

email_insecure = false

 

##The initial password of Harbor admin, only works for the first time when Harbor starts.

#It has no effect after the first launch of Harbor.

#Change the admin password from UI after launching Harbor.

harbor_admin_password = 12345    ##启动Harbor后，管理员UI登录的密码，默认是Harbor12345

 

##By default the auth mode is db_auth, i.e. the credentials are stored in a local database.

#Set it to ldap_auth if you want to verify a user's credentials against an LDAP server.

auth_mode = db_auth   ##认证方式，这里支持多种认证方式，如LADP、本次存储、数据库认证。默认是db_auth，mysql数据库认证

 

#The url for an ldap endpoint.  ##LDAP认证时配置项

ldap_url = ldaps://ldap.mydomain.com

 

#A user's DN who has the permission to search the LDAP/AD server.

#If your LDAP/AD server does not support anonymous search, you should configure this DN and ldap_search_pwd.

#ldap_searchdn = uid=searchuser,ou=people,dc=mydomain,dc=com

 

#the password of the ldap_searchdn

#ldap_search_pwd = password

 

#The base DN from which to look up a user in LDAP/AD

ldap_basedn = ou=people,dc=mydomain,dc=com

 

#Search filter for LDAP/AD, make sure the syntax of the filter is correct.

#ldap_filter = (objectClass=person)

 

# The attribute used in a search to match a user, it could be uid, cn, email, sAMAccountName or other attributes depending on your LDAP/AD 

ldap_uid = uid

 

#the scope to search for users, 0-LDAP_SCOPE_BASE, 1-LDAP_SCOPE_ONELEVEL, 2-LDAP_SCOPE_SUBTREE

ldap_scope = 2

 

#Timeout (in seconds)  when connecting to an LDAP Server. The default value (and most reasonable) is 5 seconds.

ldap_timeout = 5

 

#Verify certificate from LDAP server

ldap_verify_cert = true

 

#The base dn from which to lookup a group in LDAP/AD

ldap_group_basedn = ou=group,dc=mydomain,dc=com

 

#filter to search LDAP/AD group

ldap_group_filter = objectclass=group

#The attribute used to name a LDAP/AD group, it could be cn, name

ldap_group_gid = cn

 

#The scope to search for ldap groups. 0-LDAP_SCOPE_BASE, 1-LDAP_SCOPE_ONELEVEL, 2-LDAP_SCOPE_SUBTREE

ldap_group_scope = 2

 

#Turn on or off the self-registration feature

self_registration = on     ##是否开启自注册

 

#The expiration time (in minute) of token created by token service, default is 30 minutes

token_expiration = 30      ##Token有效时间，默认30分钟

 

#The flag to control what users have permission to create projects

#The default value "everyone" allows everyone to creates a project.

#Set to "adminonly" so that only admin user can create project.

project_creation_restriction = everyone     ##用户创建项目权限控制，默认是everyone（所有人），也可以设置为adminonly（只能管理员）

 

#************************END INITIAL PROPERTIES************************

 

#######Harbor DB configuration section#######

 

#The address of the Harbor database. Only need to change when using external db.

db_host = mysql

 

#The password for the root user of Harbor DB. Change this before any production use.

db_password = root123

 

#The port of Harbor database host

db_port = 3306

 

#The user name of Harbor database

db_user = root

 

##### End of Harbor DB configuration#######

 

#The redis server address. Only needed in HA installation.

#address:port[,weight,password,db_index]

#redis_url = redis:6379
redis_url =
 

 

##########Clair DB configuration############

 

#Clair DB host address. Only change it when using an exteral DB.

clair_db_host = postgres

 

#The password of the Clair's postgres database. Only effective when Harbor is deployed with Clair.

#Please update it before deployment. Subsequent update will cause Clair's API server and Harbor unable to access Clair's database.

clair_db_password = password

 

#Clair DB connect port

clair_db_port = 5432

 

#Clair DB username

clair_db_username = postgres

 

#Clair default database

clair_db = postgres

 

##########End of Clair DB configuration############

 

#The following attributes only need to be set when auth mode is uaa_auth

uaa_endpoint = uaa.mydomain.org

uaa_clientid = id

uaa_clientsecret = secret

uaa_verify_cert = true

uaa_ca_cert = /path/to/ca.pem

 

 

### Docker Registry setting ###

#registry_storage_provider can be: filesystem, s3, gcs, azure, etc.

registry_storage_provider_name = filesystem

#registry_storage_provider_config is a comma separated "key: value" pairs, e.g. "key1: value, key2: value2".

#Refer to https://docs.docker.com/registry/configuration/#storage for all available configuration.

registry_storage_provider_config =

 

3.3安装并启动

修改完配置文件后，在的当前目录执行./install.sh，Harbor服务就会根据当期目录下的docker-compose.yml开始下载依赖的镜像，检测并按照顺序依次启动各服务

[root@MyCentos7-1 harbor]# ./install.sh

[Step 0]: checking installation environment ...



Note: docker version: 1.13.1



Note: docker-compose version: 1.12.0



[Step 1]: loading Harbor images ...

52ef9064d2e4: Loading layer [==================================================>] 135.9 MB/135.9 MB

4a6862dbadda: Loading layer [==================================================>] 23.25 MB/23.25 MB

58b7d0c522b2: Loading layer [==================================================>]  24.4 MB/24.4 MB

9cd4bb748634: Loading layer [==================================================>] 7.168 kB/7.168 kB

c81302a14908: Loading layer [==================================================>] 10.56 MB/10.56 MB

7848e9ba72a3: Loading layer [==================================================>] 24.39 MB/24.39 MB

Loaded image: vmware/harbor-ui:v1.5.1

f1691b5a5198: Loading layer [==================================================>] 73.15 MB/73.15 MB

a529013c99e4: Loading layer [==================================================>] 3.584 kB/3.584 kB

d9b4853cff8b: Loading layer [==================================================>] 3.072 kB/3.072 kB

3d305073979e: Loading layer [==================================================>] 4.096 kB/4.096 kB

c9e17074f54a: Loading layer [==================================================>] 3.584 kB/3.584 kB

956055840e30: Loading layer [==================================================>] 9.728 kB/9.728 kB

Loaded image: vmware/harbor-log:v1.5.1

185db06a02d0: Loading layer [==================================================>] 23.25 MB/23.25 MB

835213979c70: Loading layer [==================================================>]  20.9 MB/20.9 MB

f74eeb41c1c9: Loading layer [==================================================>]  20.9 MB/20.9 MB

Loaded image: vmware/harbor-jobservice:v1.5.1

9bd5c7468774: Loading layer [==================================================>] 23.25 MB/23.25 MB

5fa6889b9a6d: Loading layer [==================================================>]  2.56 kB/2.56 kB

bd3ac235b209: Loading layer [==================================================>]  2.56 kB/2.56 kB

cb5d493833cc: Loading layer [==================================================>] 2.048 kB/2.048 kB

557669a074de: Loading layer [==================================================>]  22.8 MB/22.8 MB

f02b4f30a9ac: Loading layer [==================================================>]  22.8 MB/22.8 MB

Loaded image: vmware/registry-photon:v2.6.2-v1.5.1

5d3b562db23e: Loading layer [==================================================>] 23.25 MB/23.25 MB

8edca1b0e3b0: Loading layer [==================================================>] 12.16 MB/12.16 MB

ce5f11ea46c0: Loading layer [==================================================>]  17.3 MB/17.3 MB

93750d7ec363: Loading layer [==================================================>] 15.87 kB/15.87 kB

36f81937e80d: Loading layer [==================================================>] 3.072 kB/3.072 kB

37e5df92b624: Loading layer [==================================================>] 29.46 MB/29.46 MB

Loaded image: vmware/notary-server-photon:v0.5.1-v1.5.1

0a2f8f90bd3a: Loading layer [==================================================>] 401.3 MB/401.3 MB

41fca4deb6bf: Loading layer [==================================================>] 9.216 kB/9.216 kB

f2e28262e760: Loading layer [==================================================>] 9.216 kB/9.216 kB

68677196e356: Loading layer [==================================================>]  7.68 kB/7.68 kB

2b006714574e: Loading layer [==================================================>] 1.536 kB/1.536 kB

Loaded image: vmware/mariadb-photon:v1.5.1

a8c4992c632e: Loading layer [==================================================>] 156.3 MB/156.3 MB

0f37bf842677: Loading layer [==================================================>] 10.75 MB/10.75 MB

9f34c0cd38bf: Loading layer [==================================================>] 2.048 kB/2.048 kB

91ca17ca7e16: Loading layer [==================================================>] 48.13 kB/48.13 kB

5a7e0da65127: Loading layer [==================================================>]  10.8 MB/10.8 MB

Loaded image: vmware/clair-photon:v2.0.1-v1.5.1

0e782fe069e7: Loading layer [==================================================>] 23.25 MB/23.25 MB

67fc1e2f7009: Loading layer [==================================================>] 15.36 MB/15.36 MB

8db2141aa82c: Loading layer [==================================================>] 15.36 MB/15.36 MB

Loaded image: vmware/harbor-adminserver:v1.5.1

3f87a34f553c: Loading layer [==================================================>] 4.772 MB/4.772 MB

Loaded image: vmware/nginx-photon:v1.5.1

Loaded image: vmware/photon:1.0

ad58f3ddcb1b: Loading layer [==================================================>] 10.95 MB/10.95 MB

9b50f12509bf: Loading layer [==================================================>]  17.3 MB/17.3 MB

2c21090fd212: Loading layer [==================================================>] 15.87 kB/15.87 kB

38bec864f23e: Loading layer [==================================================>] 3.072 kB/3.072 kB

6e81ea7b0fa6: Loading layer [==================================================>] 28.24 MB/28.24 MB

Loaded image: vmware/notary-signer-photon:v0.5.1-v1.5.1

897a26fa09cb: Loading layer [==================================================>] 95.02 MB/95.02 MB

16e3a10a21ba: Loading layer [==================================================>] 6.656 kB/6.656 kB

85ecac164331: Loading layer [==================================================>] 2.048 kB/2.048 kB

37a2fb188706: Loading layer [==================================================>]  7.68 kB/7.68 kB

Loaded image: vmware/postgresql-photon:v1.5.1

bed9f52be1d1: Loading layer [==================================================>] 11.78 kB/11.78 kB

d731f2986f6e: Loading layer [==================================================>]  2.56 kB/2.56 kB

c3fde9a69f96: Loading layer [==================================================>] 3.072 kB/3.072 kB

Loaded image: vmware/harbor-db:v1.5.1

7844feb13ef3: Loading layer [==================================================>] 78.68 MB/78.68 MB

de0fd8aae388: Loading layer [==================================================>] 3.072 kB/3.072 kB

3f79efb720fd: Loading layer [==================================================>]  59.9 kB/59.9 kB

1c02f801c2e8: Loading layer [==================================================>] 61.95 kB/61.95 kB

Loaded image: vmware/redis-photon:v1.5.1

454c81edbd3b: Loading layer [==================================================>] 135.2 MB/135.2 MB

e99db1275091: Loading layer [==================================================>] 395.4 MB/395.4 MB

051e4ee23882: Loading layer [==================================================>] 9.216 kB/9.216 kB

6cca4437b6f6: Loading layer [==================================================>] 9.216 kB/9.216 kB

1d48fc08c8bc: Loading layer [==================================================>]  7.68 kB/7.68 kB

0419724fd942: Loading layer [==================================================>] 1.536 kB/1.536 kB

543c0c1ee18d: Loading layer [==================================================>] 655.2 MB/655.2 MB

4190aa7e89b8: Loading layer [==================================================>] 103.9 kB/103.9 kB

Loaded image: vmware/harbor-migrator:v1.5.0





[Step 2]: preparing environment ...

Generated and saved secret to file: /data/secretkey

Generated configuration file: ./common/config/nginx/nginx.conf

Generated configuration file: ./common/config/adminserver/env

Generated configuration file: ./common/config/ui/env

Generated configuration file: ./common/config/registry/config.yml

Generated configuration file: ./common/config/db/env

Generated configuration file: ./common/config/jobservice/env

Generated configuration file: ./common/config/jobservice/config.yml

Generated configuration file: ./common/config/log/logrotate.conf

Generated configuration file: ./common/config/jobservice/config.yml

Generated configuration file: ./common/config/ui/app.conf

Generated certificate, key file: ./common/config/ui/private_key.pem, cert file: ./common/config/registry/root.crt

The configuration files are ready, please use docker-compose to start the service.





[Step 3]: checking existing instance of Harbor ...





[Step 4]: starting Harbor ...

Creating network "harbor_harbor" with the default driver

Creating harbor-log

Creating harbor-adminserver

Creating redis

Creating harbor-db

Creating registry

Creating harbor-ui

Creating nginx

Creating harbor-jobservice



✔ ----Harbor has been installed and started successfully.----



Now you should be able to visit the admin portal at http://MyCentos7-1.

For more details, please visit https://github.com/vmware/harbor .

4、访问Harbor

启动完成后，我们访问刚设置的hostname即可 http://MyCentos7-1，默认是80端口，如果端口占用，我们可以去修改docker-compose.yml文件中，对应服务的端口映射。windos，hosts文件地址：C:\Windows\System32\drivers\etc，将域名与ip添加进去即可。 （或直接访问harbor所在物理机地址：http://192.168.126.131:80）

输入用户名admin，默认密码（或已修改密码）登录系统

 

我们可以看到系统各个模块如下：

• 项目：新增/删除项目，查看镜像仓库，给项目添加成员、查看操作日志、复制项目等
• 日志：仓库各个镜像create、push、pull等操作日志
• 系统管理 
  • 用户管理：新增/删除用户、设置管理员等
  • 复制管理：新增/删除从库目标、新建/删除/启停复制规则等
  • 配置管理：认证模式、复制、邮箱设置、系统设置等
• 其他设置 
  • 用户设置：修改用户名、邮箱、名称信息
  • 修改密码：修改用户密码

注意：非系统管理员用户登录，只能看到有权限的项目和日志，其他模块不可见。

 

• 新建项目

我们新建一个名称为wanyang的项目，设置不公开。注意：当项目设为公开后，任何人都有此项目下镜像的读权限。命令行用户不需要“docker login”就可以拉取此项目下的镜像。 

 

新建项目完毕后，我们就可以用admin账户提交本地镜像到Harbor仓库了。例如我们提交本地nginx镜像

1、admin登录

$ docker login mycentos7-1

Username: admin

Password:

Login Succeeded

 

2、给镜像打tag【tag 修改 image 的名字. 格式为: userip/项目名/image名字:版本号】

$ docker tag nginx 192.168.126.131/docker/nginx:latest

$ docker images

REPOSITORY                         TAG                 IMAGE ID            CREATED             SIZE

nginx                              latest              958a7ae9e569        2 weeks ago         109 MB

mycentos7-1/docker/nginx         latest                958a7ae9e569        2 weeks ago         109 MB

 

3、push到仓库

$ docker push mycentos7-1/docker/nginx

The push refers to a repository [docker.bksx.com/docker/nginx]

a552ca691e49: Pushed

7487bf0353a7: Pushed

8781ec54ba04: Pushed

latest: digest: sha256:41ad9967ea448d7c2b203c699b429abe1ed5af331cd92533900c6d77490e0268 size: 948

 上传完毕后，登录Web Harbor，选择项目，项目名称docker，就可以查看刚才上传的nginx image了

---

---

• FAQ
• 配置并启动Harbor之后，本地执行登录操作，报错：

docker login mycentos7-1

Username: admin

Password:

Error response from daemon: Get https://mycentos7-1/v2/users/: dial tcp 192.168.126.131:443: getsockopt: connection refused

这是因为docker1.3.2版本开始默认docker registry使用的是https，我们设置Harbor默认http方式，所以当执行用docker login、pull、push等命令操作非https的docker regsitry的时就会报错。解决办法：

• • 如果系统是MacOS，则可以点击“Preference”里面的“Advanced”在“Insecure 
    Registry”里加上mycentos7-1，重启Docker客户端就可以了。
  • 如果系统是Ubuntu，则修改配置文件/lib/systemd/system/docker.service，修改[Service]下ExecStart参数，增加– insecure-registry=mycentos7-1。
  • 如果系统是Centos，可以修改配置/etc/sysconfig/docker，将OPTIONS增加 --insecure-registry=mycentos7-1。

OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --insecure-registry=mycentos7-1'

• • 如果是新版本的docker在/etc/sysconfig/ 没有docker这个配置文件的情况下。

#在daemon.json中添加以下参数

[root@MyCentos7-1 harbor]# cat /etc/docker/daemon.json

{

  "insecure-registries": [

    "mycentos7-1"

  ]

}

注意：该文件必须符合 json 规范，否则 Docker 将不能启动。

---

 

如果需要修改Harbor的配置文件harbor.cfg，因为Harbor是基于docker-compose服务编排的，我们可以使用docker-compose命令重启Harbor。不修改配置文件，重启Harbor命令：docker-compose start | stop | restart

注：需要在harbor安装目录所在文件夹下执行，否则会报错

[root@MyCentos7-1 ~]# docker-compose up -d

ERROR:

        Can't find a suitable configuration file in this directory or any

        parent. Are you in the right directory?

 

        Supported filenames: docker-compose.yml, docker-compose.yaml

[root@MyCentos7-1 ~]# cd /service/docker/harbor/

[root@MyCentos7-1 harbor]# ll
总用量 856144
drwxr-xr-x. 4 root root 37 6月 11 10:54 common
-rw-r--r--. 1 root root 1185 5月 31 14:45 docker-compose.clair.yml
-rw-r--r--. 1 root root 1725 5月 31 14:45 docker-compose.notary.yml
-rw-r--r--. 1 root root 3596 5月 31 14:45 docker-compose.yml
drwxr-xr-x. 3 root root 156 5月 31 14:45 ha
-rw-r--r--. 1 root root 6687 6月 11 18:47 harbor.cfg
-rw-r--r--. 1 root root 6687 6月 11 10:24 harbor.cfg.bak
-rw-r--r--. 1 root root 876607879 5月 31 14:46 harbor.v1.5.1.tar.gz
-rwxr-xr-x. 1 root root 5773 5月 31 14:45 install.sh
-rw-r--r--. 1 root root 10771 5月 31 14:45 LICENSE
-rw-r--r--. 1 root root 482 5月 31 14:45 NOTICE
-rwxr-xr-x. 1 root root 27379 5月 31 14:45 prepare

故应该在/service/docker/harbor目录下执行。

1、停止Harbor

$ docker-compose down -v

Stopping nginx ... done

Stopping harbor-jobservice ... done

......

Removing harbor-log ... done

Removing network harbor_harbor

 

2、启动Harbor

$ docker-compose up -d

Creating network "harbor_harbor" with the default driver

Creating harbor-log ...

......

Creating nginx

Creating harbor-jobservice ... done

 

参考：https://blog.csdn.net/weixin_41465338/article/details/80146218