Docker私有仓库
Docker Private Registry
文章目录
- Docker Private Registry
-
- Docker Registry
- Docker Private Registry
-
- 使用docker-distribution自建Registry
- 使用官方镜像自建Registry
- Harbor
-
- Harbor简介
- Harbor的功能
- Docker compose
- Harbor部署
Docker Registry
网上有很多的Registry服务器都支持第三方用户注册，而后基于用户名去做自己的仓库，但是使用互联网上的Registry有一个缺陷，那就是我们去推送和下载镜像时都不会很快，而在生产环境中很可能并行启动的容器将达到几十、上百个，而且很有可能每个服务器本地是没有镜像的，此时如果通过互联网去下载镜像会有很多问题，比如下载速度会很慢、带宽会用很多等等，如果带宽不够的话，下载至启动这个过程可能要持续个几十分钟，这已然违背了使用容器会更加轻量、快速的初衷和目的。因此，很多时候我们很有可能需要去做自己的私有Registry。
Registry用于保存docker镜像，包括镜像的层次结构和元数据。用户可以自建Registry，也可以使用官方的Docker Hub。
Docker Registry分类：
- Sponsor Registry：第三方的Registry，供客户和Docker社区使用
- Mirror Registry：第三方的Registry，只让客户使用
- Vendor Registry：由发布docker镜像的供应商提供的registry
- Private Registry：通过设有防火墙和额外的安全层的私有实体提供的registry
事实上，如果运维的系统环境托管在云计算服务上，比如阿里云，那么用阿里云的Registry则是最好的选择。很多时候我们的生产环境不会在本地，而是托管在数据中心机房里，如果我们在数据中心机房里的某台主机上部署Registry，因为都在同一机房，所以属于同一局域网，此时数据传输走内网，效率会极大的提升。
所有的Registry默认情况下都是基于https工作的，这是Docker的基本要求，而我自建Registry时很可能是基于http工作的，但是Docker默认是拒绝使用http提供Registry服务的，除非明确的告诉它，我们就是要用http协议的Registry。
Docker Private Registry
了帮助我们快速创建私有Registry，Docker专门提供了一个名为Docker Distribution的软件包，我们可以通过安装这个软件包快速构建私有仓库。
问：既然Docker是为了运行程序的，Docker Distribution能否运行在容器中？
容器时代，任何程序都应该运行在容器中，除了Kernel和init。而为了能够做Docker Private Registry，Docker Hub官方直接把Registry做成了镜像，我们可以直接将其pull到本地并启动为容器即可快速实现私有Registry。
Registry的主要作用是托管镜像，Registry运行在容器中，而容器自己的文件系统是随着容器的生命周期终止和删除而被删除的，所以当我们把Registry运行在容器中时，客户端上传了很多镜像，随着Registry容器的终止并删除，所有镜像都将化为乌有，因此这些镜像应该放在存储卷上，而且这个存储卷最好不要放在Docker主机本地，而应该放在一个网络共享存储上，比如NFS。不过，镜像文件自己定义的存储卷，还是一个放在Docker本地、Docker管理的卷，我们可以手动的将其改成使用其它文件系统的存储卷。
这就是使用容器来运行Registry的一种简单方式。自建Registry的另一种方式，就是直接安装docker-distribution软件。
使用docker-distribution自建Registry
自建Registry
[root@localhost ~]# yum install -y http://mirror.centos.org/centos/7/extras/x86_64/Packages/docker-distribution-2.6.2-2.git48294d9.el7.x86_64.rpm
[root@localhost ~]# cd /etc/docker-distribution/registry/
[root@localhost registry]# ls
config.yml
[root@localhost registry]# vim config.yml
[root@localhost registry]# cat config.yml
version: 0.1
log:
fields:
service: registry
storage:
cache:
layerinfo: inmemory
filesystem:
rootdirectory: /var/lib/registry # 修改此处为一个容量大的磁盘分区目录
http:
addr: :5000
[root@localhost registry]#
[root@localhost ~]# systemctl start docker-distribution.service
[root@localhost ~]# ss -antl
LISTEN 0 128 *:5000 *:*
使用自建的Registry去上传镜像
[root@localhost ~]# vim /etc/docker/daemon.json
[root@localhost ~]# cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://26d44yal.mirror.aliyuncs.com"],
"insecure-registries": ["192.168.89.151:5000"]
}
[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# systemctl restart docker
[root@localhost ~]#
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
busybox latest beae173ccac6 7 months ago 1.24MB
nginx latest 605c77e624dd 7 months ago 141MB
httpd latest dabbfbe0c57b 7 months ago 144MB
centos latest 5d0da3dc9764 10 months ago 231MB
[root@localhost ~]# docker tag busybox:latest 192.168.89.151:5000/busybox:v1
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
192.168.89.151:5000/busybox v1 beae173ccac6 7 months ago 1.24MB
busybox latest beae173ccac6 7 months ago 1.24MB
nginx latest 605c77e624dd 7 months ago 141MB
httpd latest dabbfbe0c57b 7 months ago 144MB
centos latest 5d0da3dc9764 10 months ago 231MB
[root@localhost ~]# docker push 192.168.89.151:5000/busybox:v1
The push refers to repository [192.168.89.151:5000/busybox]
01fd6df81c8e: Pushed
v1: digest: sha256:62ffc2ed7554e4c6d360bce40bbcf196573dd27c4ce080641a2c59867e732dee size: 527
[root@localhost ~]#
使用官方镜像自建Registry
[root@localhost ~]# systemctl stop docker-distribution.service
[root@localhost ~]# cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://26d44yal.mirror.aliyuncs.com"],
"insecure-registries": ["192.168.89.151:5000"]
}
[root@localhost ~]# docker run -dit --name registry -p 5000:5000 -v /opt/registry:/tmp/registry registry
839d3b1d4e004aaad2abb37fe0ecb227e427f8a0d26611169fb1312fe4bedad9
[root@localhost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
839d3b1d4e00 registry "/entrypoint.sh /etc…" About a minute ago Up About a minute 0.0.0.0:5000->5000/tcp, :::5000->5000/tcp registry
[root@localhost ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:5000 0.0.0.0:*
LISTEN 0 128 [::]:5000 [::]:*
将镜像上传到镜像仓库
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
192.168.89.151:5000/busybox v1 beae173ccac6 7 months ago 1.24MB
busybox latest beae173ccac6 7 months ago 1.24MB
nginx latest 605c77e624dd 7 months ago 141MB
httpd latest dabbfbe0c57b 7 months ago 144MB
registry latest b8604a3fe854 9 months ago 26.2MB
centos latest 5d0da3dc9764 10 months ago 231MB
[root@localhost ~]# docker rmi 192.168.89.151:5000/busybox:v1
Untagged: 192.168.89.151:5000/busybox:v1
Untagged: 192.168.89.151:5000/busybox@sha256:62ffc2ed7554e4c6d360bce40bbcf196573dd27c4ce080641a2c59867e732dee
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
busybox latest beae173ccac6 7 months ago 1.24MB
nginx latest 605c77e624dd 7 months ago 141MB
httpd latest dabbfbe0c57b 7 months ago 144MB
registry latest b8604a3fe854 9 months ago 26.2MB
centos latest 5d0da3dc9764 10 months ago 231MB
[root@localhost ~]# docker tag busybox:latest 192.168.89.151:5000/abc:v1
[root@localhost ~]# docker push 192.168.89.151:5000/abc:v1
The push refers to repository [192.168.89.151:5000/abc]
01fd6df81c8e: Pushed
v1: digest: sha256:62ffc2ed7554e4c6d360bce40bbcf196573dd27c4ce080641a2c59867e732dee size: 527
[root@localhost ~]#
[root@localhost ~]#
[root@localhost ~]# curl http://192.168.89.151:5000/v2/_catalog
{"repositories":["abc"]}
[root@localhost ~]# curl http://192.168.89.151:5000/v2/abc/tags/list
{"name":"abc","tags":["v1"]}
[root@localhost ~]#
Harbor
无论是使用Docker-distribution去自建仓库，还是通过官方镜像跑容器的方式去自建仓库，通过前面的演示我们可以发现其是非常的简陋的，还不如直接使用官方的Docker Hub去管理镜像来得方便，至少官方的Docker Hub能够通过web界面来管理镜像，还能在web界面执行搜索，还能基于Dockerfile利用Webhooks和Automated Builds实现自动构建镜像的功能，用户不需要在本地执行docker build，而是把所有build上下文的文件作为一个仓库推送到github上，让Docker Hub可以从github上去pull这些文件来完成自动构建。
但无论官方的Docker Hub有多强大，它毕竟是在国外，所以速度是最大的瓶颈，我们很多时候是不可能去考虑使用官方的仓库的，但是上面说的两种自建仓库方式又十分简陋，不便管理，所以后来就出现了一个被 CNCF 组织青睐的项目，其名为Harbor。
Harbor简介
Harbor是由VMWare在Docker Registry的基础之上进行了二次封装，加进去了很多额外程序，而且提供了一个非常漂亮的web界面。
Project Harbor是一个开源的可信云原生注册表项目，用于存储、签名和扫描上下文。
Harbor通过添加用户通常需要的功能（如安全、身份和管理），扩展了开源Docker发行版。
Harbor支持高级功能，如用户管理、访问控制、活动监视和实例之间的复制。
Harbor的功能
羽毛：
- 多租户内容签名和验证
- 安全和漏洞分析
- 审计日志记录
- 身份集成和基于角色的访问控制
- 实例之间的映像复制
- 可扩展API和图形用户界面
- 国际化（目前为英文和中文）
Docker compose
Harbor在物理机上部署是非常难的，而为了简化Harbor的应用，Harbor官方直接把Harbor做成了在容器中运行的应用，而且这个容器在Harbor中依赖类似redis、mysql、pgsql等很多存储系统，所以它需要编排很多容器协同起来工作，因此VMWare Harbor在部署和使用时，需要借助于Docker的单机编排工具(Docker compose)来实现。
Compose是定义和运行多容器Docker应用程序的工具。使用Compose，您可以使用YAML文件来配置应用程序的服务。然后，只需一个命令，就可以从配置中创建并启动所有服务。
Harbor部署
[root@localhost src]# wget https://github.com/goharbor/harbor/releases/download/v2.4.3/harbor-offline-installer-v2.4.3.tgz
[root@localhost src]# ls
debug harbor-offline-installer-v2.4.3.tgz kernels
[root@localhost src]#
[root@localhost ~]# curl -SL https://github.com/docker/compose/releases/download/v2.7.0/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
[root@localhost ~]# ls
docker-compose
[root@localhost ~]# mv docker-compose /usr/local/bin
[root@localhost ~]# chmod +x docker-compose
[root@localhost ~]# ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
[root@localhost ~]# which docker-compose
/usr/local/bin/docker-compose
[root@localhost ~]# docker-compose version
Docker Compose version v2.7.0
[root@localhost ~]#
[root@localhost ~]# cd /usr/local/
[root@localhost local]# ls
apache2 bin etc games harbor include lib lib64 libexec sbin share src
[root@localhost local]# cd harbor/
[root@localhost harbor]# ls
common.sh harbor.v2.4.3.tar.gz harbor.yml.tmpl install.sh LICENSE prepare
[root@localhost harbor]#
[root@localhost harbor]# mv harbor.yml.tmpl harbor.yml
[root@localhost harbor]#
[root@localhost harbor]# vim harbor.yml
5 hostname: 192.168.89.151
...
12 # https related config
13 #https:
14 # https port for harbor, default is 443
15 # port: 443
16 # The path of cert and key files for nginx
17 #certificate: /your/certificate/path
18 #private_key: /your/private/key/path
[root@localhost harbor]# vim /etc/docker/daemon.json
[root@localhost harbor]# cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://26d44yal.mirror.aliyuncs.com"],
"insecure-registries": ["192.168.89.151"]
}
[root@localhost harbor]# ./install.sh
[Step 0]: checking if docker is installed ...
Note: docker version: 20.10.17
[Step 1]: checking docker-compose is installed ...
Note: docker-compose version: 2.7.0
[Step 2]: loading Harbor images ...
Loaded image: goharbor/trivy-adapter-photon:v2.4.3
Loaded image: goharbor/redis-photon:v2.4.3
Loaded image: goharbor/nginx-photon:v2.4.3
Loaded image: goharbor/notary-signer-photon:v2.4.3
Loaded image: goharbor/prepare:v2.4.3
Loaded image: goharbor/harbor-registryctl:v2.4.3
Loaded image: goharbor/harbor-log:v2.4.3
Loaded image: goharbor/harbor-jobservice:v2.4.3
Loaded image: goharbor/harbor-exporter:v2.4.3
Loaded image: goharbor/registry-photon:v2.4.3
Loaded image: goharbor/notary-server-photon:v2.4.3
Loaded image: goharbor/harbor-portal:v2.4.3
Loaded image: goharbor/harbor-core:v2.4.3
Loaded image: goharbor/harbor-db:v2.4.3
Loaded image: goharbor/chartmuseum-photon:v2.4.3
[Step 3]: preparing environment ...
[Step 4]: preparing harbor configs ...
prepare base dir is set to /usr/local/harbor
WARNING:root:WARNING: HTTP protocol is insecure. Harbor will deprecate http protocol in the future. Please make sure to upgrade to https
Clearing the configuration file: /config/portal/nginx.conf
Clearing the configuration file: /config/log/logrotate.conf
Clearing the configuration file: /config/log/rsyslog_docker.conf
Clearing the configuration file: /config/nginx/nginx.conf
Clearing the configuration file: /config/core/env
Clearing the configuration file: /config/core/app.conf
Clearing the configuration file: /config/registry/passwd
Clearing the configuration file: /config/registry/config.yml
Clearing the configuration file: /config/registry/root.crt
Clearing the configuration file: /config/registryctl/env
Clearing the configuration file: /config/registryctl/config.yml
Clearing the configuration file: /config/db/env
Clearing the configuration file: /config/jobservice/env
Clearing the configuration file: /config/jobservice/config.yml
Generated configuration file: /config/portal/nginx.conf
Generated configuration file: /config/log/logrotate.conf
Generated configuration file: /config/log/rsyslog_docker.conf
Generated configuration file: /config/nginx/nginx.conf
Generated configuration file: /config/core/env
Generated configuration file: /config/core/app.conf
Generated configuration file: /config/registry/config.yml
Generated configuration file: /config/registryctl/env
Generated configuration file: /config/registryctl/config.yml
Generated configuration file: /config/db/env
Generated configuration file: /config/jobservice/env
Generated configuration file: /config/jobservice/config.yml
loaded secret from file: /data/secret/keys/secretkey
Generated configuration file: /compose_location/docker-compose.yml
Clean up the input dir
Note: stopping existing Harbor instance ...
[+] Running 10/9
⠿ Container harbor-jobservice Removed 0.1s
⠿ Container registryctl Removed 10.2s
⠿ Container nginx Removed 0.2s
⠿ Container harbor-portal Removed 0.1s
⠿ Container harbor-core Removed 0.1s
⠿ Container harbor-db Removed 0.3s
⠿ Container registry Removed 0.2s
⠿ Container redis Removed 0.2s
⠿ Container harbor-log Removed 10.1s
⠿ Network harbor_harbor Removed 0.1s
[Step 5]: starting Harbor ...
[+] Running 10/10
⠿ Network harbor_harbor Created 0.1s
⠿ Container harbor-log Started 0.5s
⠿ Container harbor-portal Started 1.6s
⠿ Container redis Started 1.7s
⠿ Container registry Started 1.7s
⠿ Container registryctl Started 1.7s
⠿ Container harbor-db Started 1.4s
⠿ Container harbor-core Started 2.0s
⠿ Container nginx Started 2.6s
⠿ Container harbor-jobservice Started 2.5s
✔ ----Harbor has been installed and started successfully.----
[root@localhost harbor]#
[root@localhost harbor]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 127.0.0.1:1514 0.0.0.0:*
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 [::]:80 [::]:*
利用脚本使harbor容器开机自启
[root@localhost harbor]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1ce29b48bfb7 goharbor/harbor-jobservice:v2.4.3 "/harbor/entrypoint.…" 4 minutes ago Up 4 minutes (healthy) harbor-jobservice
877f72d0aad0 goharbor/nginx-photon:v2.4.3 "nginx -g 'daemon of…" 4 minutes ago Up 4 minutes (healthy) 0.0.0.0:80->8080/tcp, :::80->8080/tcp nginx
5e874f23c216 goharbor/harbor-core:v2.4.3 "/harbor/entrypoint.…" 4 minutes ago Up 4 minutes (healthy) harbor-core
026ca6519b53 goharbor/harbor-registryctl:v2.4.3 "/home/harbor/start.…" 4 minutes ago Up 4 minutes (healthy) registryctl
11c72b9ae9c2 goharbor/harbor-portal:v2.4.3 "nginx -g 'daemon of…" 4 minutes ago Up 4 minutes (healthy) harbor-portal
f842ad4e607e goharbor/harbor-db:v2.4.3 "/docker-entrypoint.…" 4 minutes ago Up 4 minutes (healthy) harbor-db
d6d95e5a8dcd goharbor/registry-photon:v2.4.3 "/home/harbor/entryp…" 4 minutes ago Up 4 minutes (healthy) registry
8d8771589b65 goharbor/redis-photon:v2.4.3 "redis-server /etc/r…" 4 minutes ago Up 4 minutes (healthy) redis
617f35147aa6 goharbor/harbor-log:v2.4.3 "/bin/sh -c /usr/loc…" 4 minutes ago Up 4 minutes (healthy) 127.0.0.1:1514->10514/tcp harbor-log
[root@localhost harbor]# docker ps |wc -l
10
[root@localhost harbor]# pwd
/usr/local/harbor
[root@localhost harbor]# which docker-compose
/usr/local/bin/docker-compose
[root@localhost harbor]# vim harbordocker.sh
[root@localhost harbor]# cat harbordocker.sh
#!bin/bash
cd /usr/local/harbor
/usr/local/bin/docker-compose stop
/usr/local/bin/docker-compose start
[root@localhost harbor]#
[root@localhost harbor]# chmod +x harbordocker.sh
[root@localhost harbor]# ls
common docker-compose.yml harbor.v2.4.3.tar.gz install.sh prepare
common.sh harbordocker.sh harbor.yml LICENSE
[root@localhost harbor]#
[root@localhost harbor]# vim /etc/rc.d/rc.local
[root@localhost harbor]# cat /etc/rc.d/rc.local
#!/bin/bash
/bin/bash /usr/local/harbor/harbordocker.sh
[root@localhost harbor]# reboot
[root@localhost ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1ce29b48bfb7 goharbor/harbor-jobservice:v2.4.3 "/harbor/entrypoint.…" 23 minutes ago Up 22 seconds (health: starting) harbor-jobservice
877f72d0aad0 goharbor/nginx-photon:v2.4.3 "nginx -g 'daemon of…" 23 minutes ago Restarting (1) 5 seconds ago nginx
026ca6519b53 goharbor/harbor-registryctl:v2.4.3 "/home/harbor/start.…" 23 minutes ago Up 22 seconds (health: starting) registryctl
f842ad4e607e goharbor/harbor-db:v2.4.3 "/docker-entrypoint.…" 23 minutes ago Up 22 seconds (health: starting) harbor-db
d6d95e5a8dcd goharbor/registry-photon:v2.4.3 "/home/harbor/entryp…" 23 minutes ago Up 22 seconds (health: starting) registry
617f35147aa6 goharbor/harbor-log:v2.4.3 "/bin/sh -c /usr/loc…" 23 minutes ago Up 22 seconds (health: starting) 127.0.0.1:1514->10514/tcp harbor-log
[root@localhost ~]#
[root@localhost ~]# docker ps|wc -l
10
使用Harbor的注意事项：
1.在客户端上传镜像时一定要记得执行docker login进行用户认证，否则无法直接push
2.在客户端使用的时候如果不是用的https则必须要在客户端的/etc/docker/daemon.json配置文件中配置insecure-registries参数
3.数据存放路径应在配置文件中配置到一个容量比较充足的共享存储中
4.Harbor是使用docker-compose命令来管理的，如果需要停止Harbor也应用docker-compose stop来停止，其他参数请–help
[root@localhost harbor]# docker tag busybox:latest 192.168.89.151/guest/busybox:v1
[root@localhost harbor]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
goharbor/harbor-exporter v2.4.3 776ac6ee91f4 10 days ago 81.5MB
goharbor/chartmuseum-photon v2.4.3 f39a9694988d 10 days ago 172MB
goharbor/redis-photon v2.4.3 b168e9750dc8 10 days ago 154MB
goharbor/trivy-adapter-photon v2.4.3 a406a715461c 10 days ago 251MB
goharbor/notary-server-photon v2.4.3 da89404c7cf9 10 days ago 109MB
goharbor/notary-signer-photon v2.4.3 38468ac13836 10 days ago 107MB
goharbor/harbor-registryctl v2.4.3 61243a84642b 10 days ago 135MB
goharbor/registry-photon v2.4.3 9855479dd6fa 10 days ago 77.9MB
goharbor/nginx-photon v2.4.3 0165c71ef734 10 days ago 44.4MB
goharbor/harbor-log v2.4.3 57ceb170dac4 10 days ago 161MB
goharbor/harbor-jobservice v2.4.3 7fea87c4b884 10 days ago 219MB
goharbor/harbor-core v2.4.3 d864774a3b8f 10 days ago 197MB
goharbor/harbor-portal v2.4.3 85f00db66862 10 days ago 53.4MB
goharbor/harbor-db v2.4.3 7693d44a2ad6 10 days ago 225MB
goharbor/prepare v2.4.3 c882d74725ee 10 days ago 268MB
192.168.89.151/guest/busybox v1 beae173ccac6 7 months ago 1.24MB
192.168.89.151:5000/abc v1 beae173ccac6 7 months ago 1.24MB
busybox latest beae173ccac6 7 months ago 1.24MB
nginx latest 605c77e624dd 7 months ago 141MB
httpd latest dabbfbe0c57b 7 months ago 144MB
registry latest b8604a3fe854 9 months ago 26.2MB
centos latest 5d0da3dc9764 10 months ago 231MB
[root@localhost harbor]# cd
[root@localhost ~]# docker login 192.168.89.151
Username: guest
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
[root@localhost ~]# docker push 192.168.89.151/guest/busybox:v1
The push refers to repository [192.168.89.151/guest/busybox]
01fd6df81c8e: Pushed
v1: digest: sha256:62ffc2ed7554e4c6d360bce40bbcf196573dd27c4ce080641a2c59867e732dee size: 527
[root@localhost ~]#