Centos7搭建私有yum源与docker images仓库

Centos7搭建私有yum源与docker images仓库

系统使用的是centos7-Minimal-2009
磁盘300G，根目录分大点
另外挂载了一个200G的磁盘作为docker images的存储
如果只需要搭建私有yum源，上半部分就可以了

---

私有yum源--yum repo

设置hostname

hostnamectl set-hostname mirrors.your-domain.com

安装net-tool

yum install -y net-tools

我的网络拓扑是nat 加 内网环境

所以静态路由需要配置，不需要就跳过此段

查看路由表

ip route show

添加内网静态路由（重启失效）

ip route add 10.0.0.0/8 via 10.101.2.1 dev ens224
ip route add 172.16.0.0/16 via 10.101.2.1 dev ens224

添加内网静态路由（永久）

cat << EOF > /etc/sysconfig/network-scripts/route-ens224
10.0.0.8/8 via 10.101.2.1 dev ens224
172.16.0.0/16 via 10.101.2.1 dev ens224
EOF

service network restart

关闭selinux、关闭firewall

sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config
setenforce 0
systemctl stop firewalld.service
systemctl disable firewalld.service

安装apache，设置启动

yum install -y httpd
systemctl start httpd.service
systemctl enable httpd.service

试一下apache页面

http://mirrors.your-domain.com

更换默认repo为阿里云

mkdir -p /etc/yum.repos.d/bak/
mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/bak/
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum clean all
yum makecache

可以看一下现在的repo

yum repolist

安装同步工具、repo制作工具

yum install -y yum-utils createrepo wget

创建目录

mkdir -p /var/www/html/repo/centos/7
### base仓同步并创建repo数据
reposync -r base -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/base

###extras仓库同步并创建repo数据
reposync -r extras -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/extras

###updates仓库并创建repo数据
reposync -r updates -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/updates

###epel仓库同步并创建repo数据

reposync -r epel -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/epel

###docker-ce仓库同步并创建repo数据

reposync -r docker-ce-stable -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/docker-ce-stable

手动更新包和更新repodata命令（可选）

reposync -np /var/www/html/repo/centos/7/

createrepo --update /var/www/html/repo/centos/7/base
createrepo --update /var/www/html/repo/centos/7/extras
createrepo --update /var/www/html/repo/centos/7/updates
createrepo --update /var/www/html/repo/centos/7/epel
createrepo --update /var/www/html/repo/centos/7/docker-ce-stable

制作repo指向文件

cat << EOF > /var/www/html/repo/Centos-7.repo
#base仓库
[base]
name=Local CentOS-7  Base
baseurl=http://mirrors.your-domain.com/repo/centos/7/base
enabled=1
gpgcheck=0

# extras仓库
[extras]
name=Local CentOS-7  Extras 
baseurl=http://mirrors.your-domain.com/repo/centos/7/extras
enabled=1
gpgcheck=0

# updates仓库
[updates]
name=Local CentOS-7  Updates
baseurl=http://mirrors.your-domain.com/repo/centos/7/updates
enabled=1
gpgcheck=0

# epel仓库
[epel]
name=Local Extra Packages for Enterprise Linux 7
baseurl=http://mirrors.your-domain.com/repo/centos/7/epel
enabled=1
gpgcheck=0


# docker-ce仓库
[docker-ce-stable]
name=Local docker Packages for Enterprise Linux 7
baseurl=http://mirrors.your-domain.com/repo/centos/7/docker-ce-stable
enabled=1
gpgcheck=0
EOF

设置自动同步

cat << EOF > /var/www/html/sync_yum.sh
#!/bin/bash
echo 'Updating Aliyum Source'
exec > /var/log/sync_yumrepo.log
reposync -np /var/www/html/repo/centos/7/
if [ $? -eq 0 ];then
    createrepo --update /var/www/html/repo/centos/7/base
    createrepo --update /var/www/html/repo/centos/7/extras
    createrepo --update /var/www/html/repo/centos/7/updates
    createrepo --update /var/www/html/repo/centos/7/epel
    createrepo --update /var/www/html/repo/centos/7/docker-ce-stable
    echo "SUCESS: aliyum_yum update successful"
else
   echo "ERROR: aliyum_yum update failed"
fi
EOF

chmod +x /var/www/html/sync_yum.sh

每周一凌晨1点同步
crontab -e
0 1 * * 1 /bin/bash /var/www/html/sync_yum.sh

创建使用说明页面

cat << EOF > /var/www/html/index.html







 



简介

CentOS，是基于 Red Hat Linux 提供的可自由使用源代码的企业级 Linux 发行版本，是一个稳定，可预测，可管理和可复制的免费企业级计算平台。
站点功能:
1.Centos yum repo
2.Docker images registry







一、CentOS 7 配置内部YUM源


1、备份
mkdir -p /etc/yum.repos.d/bak/
mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/bak/


2、下载新的 CentOS-Base.repo 到 /etc/yum.repos.d/ 
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.your-domain.com/repo/Centos-7.repo


3、生成缓存
yum makecache


4、运行 yum repolist   可查看已经生成缓存





二、使用docker images registry仓库



1、下载ssl证书
mkdir -p /etc/docker/certs.d/mirrors.your-domain.com
wget -O /etc/docker/certs.d/mirrors.your-domain.com/ca.crt http://mirrors.your-domain.com/ca.crt



2、测试返回 
curl -Ik https://mirrors.your-domain.com
    HTTP/1.1 200 OK


    Cache-Control: no-cache



3、镜像拉取测试（可选）
docker pull mirrors.your-domain.com/library/ubuntu 


4、使用（以ceph为例）


docker pull mirrors.your-domain.com/ceph/daemon:latest-mimic 






EOF

访问

http://mirrors.your-domain.com

---

其他机器使用私有源

mkdir -p /etc/yum.repos.d/bak/

mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/bak/

curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.your-domain.com/repo/Centos-7.repo

yum makecache

yum update

私有源部分结束

---

docker images registry --images本地仓

添加一个专用磁盘sdb，200G，作为docker images存储

pvcreate /dev/sdb
vgcreate registry_vg /dev/sdb
lvcreate -L 198G -n registry_data registry_vg
mkfs.xfs /dev/mapper/registry_vg-registry_data 
mkdir -p /var/lib/docker/volumes/registry/_data/docker

查一下registry_vg-registry_data的UUID

blkid

[root@mirrors ~]# blkid
/dev/mapper/centos-root: UUID="ff7c3399-c44d-49dc-9e98-570b00bcd84a" TYPE="xfs" 
/dev/sda2: UUID="IuHCZp-JMfJ-f8bi-16x2-2NAx-yd4k-bcusvV" TYPE="LVM2_member" 
/dev/sda1: UUID="4a5490c9-3203-4f96-8191-ad49d3183347" TYPE="xfs" 
/dev/sdb: UUID="i3wvm3-op4P-v2qk-QLc1-Keww-69mG-zgA9SV" TYPE="LVM2_member" 
/dev/mapper/centos-swap: UUID="dd5cdb94-fbeb-4f79-90bf-807fd4b0d581" TYPE="swap" 
/dev/mapper/registry_vg-registry_data: UUID="21d493a8-7329-45e5-82f9-02e97066cdb0" TYPE="xfs" 
/dev/mapper/centos-home: UUID="824c3751-2548-4cd2-9fdd-e0081a444a4e" TYPE="xfs" 

在fstab的最后加一行，UUID替换成registry_vg-registry_data的
vi /etc/fstab

UUID=21d493a8-7329-45e5-82f9-02e97066cdb0 /var/lib/docker/volumes/registry/_data/docker        xfs     defaults        0 0

mount -a

加一个阿里的docker-ce源

yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum makecache

安装docker，并启动

yum install docker-ce -y
systemctl start docker
systemctl enable docker

设置docker kolla.conf,我是用来部署openstack的

mkdir /etc/systemd/system/docker.service.d
tee /etc/systemd/system/docker.service.d/kolla.conf << 'EOF'
[Service]
MountFlags=shared
EOF

创建证书

yum install -y openssl
mkdir -p ~/certs && openssl req -newkey rsa:4096 -nodes -sha256 -keyout ~/certs/domain.key -x509 -days 365 -out ~/certs/domain.crt

一路回车，到Common Name这一步填:mirrors.your-domain.com

Generating a 4096 bit RSA private key
.......................................................................................++
......++
writing new private key to '/root/certs/domain.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:mirrors.your-domain.com

下载registry并获取配置

docker run -it --rm --entrypoint cat registry:2 /etc/docker/registry/config.yml > ~/config.yml

更改 config.yml 配置文件

version: 0.1
log:
  fields:
    service: registry
storage:
  cache:
    blobdescriptor: inmemory
  filesystem:
    rootdirectory: /var/lib/registry
http:
  addr: :5000
  headers:
    X-Content-Type-Options: [nosniff]
  tls:
    certificate: /var/lib/registry/domain.crt
    key: /var/lib/registry/domain.key

health:
  storagedriver:
    enabled: true
    interval: 10s
    threshold: 3

proxy:
  remoteurl: https://p7a8ba4a.mirror.aliyuncs.com

其中，https://p7a8ba4a.mirror.aliyuncs.com 是我个人的阿里云docker加速地址

放置配置文件与证书

mkdir -p /var/lib/docker/volumes/registry/_data/
cp ~/certs/domain.* ~/config.yml /var/lib/docker/volumes/registry/_data/
mkdir -p /etc/docker/certs.d/dev.registry.io
cp ~/certs/domain.crt /etc/docker/certs.d/mirrors.your-domain.com/ca.crt
cp /etc/docker/certs.d/mirrors.your-domain.com/ca.crt /var/www/html/ca.crt

运行 registry container

systemctl restart docker

docker run -d --restart=always -p 443:5000 --name registry -v registry:/var/lib/registry registry:2 /var/lib/registry/config.yml

docker ps

CONTAINER ID   IMAGECOMMAND  CREATED   STATUS  PORTS NAMES
b12c05b4a54a   registry:2   "/entrypoint.sh /var…"   9 hours ago   Up 16 seconds   0.0.0.0:443->5000/tcp, :::443->5000/tcp   registry

访问验证

curl -Ik https://mirrors.your-domain.com

HTTP/2 200
cache-control: no-cache

其他机器使用

先获取证书
mkdir -p /etc/docker/certs.d/mirrors.your-domain.com
wget -O /etc/docker/certs.d/mirrors.your-domain.com/ca.crt http://mirrors.your-domain.com/ca.crt

拉取方式（以ceph为例）

docker pull mirrors.your-domain.com/ceph/daemon:latest-mimic