docker registry私有镜像仓库

前言

环境：centos 7.9 docker 20
docker仓库一般有：公网上的docker hub，而docker的私有仓库一般有2种，docker registry和harbor，前者是docker官方的私有仓库，比较小巧，在一些小业务场景比较合适使用，且没有web页面，后者harbor是VMware 公司中国团队的开源项目，有web页面，比较人性化，企业使用范围较广。本篇先来讲解docker公司的registry镜像仓库。harbor仓库的搭建可以参考https://blog.csdn.net/MssGuo/article/details/126210184
挺好的文章：http://events.jianshu.io/p/de8969f17b53

新项目distribution（新的docker register被称为Distribution）代替了registry，两者其实就是一个意思。docker官网的镜像还是registry。
docker-distribution的2种安装方法：

yum install docker-distribution   			#使用yum安装，systemd管理
systemctl enable docker-distribution.service
systemctl start docker-distribution.service
docker run 									#docker安装

我们讲使用docker 安装镜像仓库。

搭建registry仓库

官网文档：https://docs.docker.com/registry/

#下载镜像
docker pull registry:latest
#使用docker安装并持久化（这里留了个坑，还没有给registry仓库设置账号密码）
docker run -d -p 5000:5000 --restart always --name registry  -v /opt/registry:/var/lib/registry registry:latest 

访问registry镜像（无账号密码）

registry镜像仓库没有图形化，访问如下：

#浏览器web页面访问方式
http://192.168.158.130:5000/v2/_catalog
{"repositories":[]}				#[]显示为空，因为没有任何镜像
#或者Linux命令行curl一下
curl -XGET http://192.168.158.130:5000/v2/_catalog
{"repositories":[]}				#[]显示为空，因为没有任何镜像

推送镜像到registry镜像仓库（无账号密码）

#推送镜像到registry镜像仓库
vim /etc/docker/daemon.json								#编辑docker配置文件，追加下面这行
"insecure-registries": ["192.168.158.130:5000"]
systemctl  restart docker								#重启docker
docker tag nginx:1.18 192.168.158.130:5000/nginx:1.18	#为镜像打一个tag
docker push 192.168.158.130:5000/nginx:1.18				#推送镜像到registry镜像仓库
curl -XGET http://192.168.158.130:5000/v2/_catalog
{"repositories":["nginx"]}

给registry镜像仓库设置账号密码

前面，我们安装registry镜像仓库并没有设置账号密码，随便一个人都能上传镜像到该镜像仓库，很不安全，现在设置账号密码：

#安装httpd-tools工具
yum install  httpd-tools -y
#创建目录
mkdir -p /etc/registry/auth
touch /etc/registry/auth/passwd
#使用htpasswd工具生成秘钥，并存放于/etc/registry/auth/passwd文件。账号是admin，密码是admin123456
htpasswd -Bbn admin admin123456 > /etc/registry/auth/passwd	
# 
docker stop registry && docker rm registry
docker run -d -p 5000:5000 --restart always --name registry \
-v /opt/registry:/var/lib/registry \
-v /etc/registry/auth:/etc/registry/auth  \						#将auth目录挂载到容器
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e "REGISTRY_AUTH_HTPASSWD_PATH=/etc/registry/auth/passwd" \	#指定passwd文件
 registry:latest 

账号密码-访问registry镜像

#浏览器页面访问
http://192.168.158.130:5000/v2/_catalog  #弹出一个框显示要输入密码，admin/admin123456
#Linux命令行访问
[root@docker ~]# curl -XGET http://192.168.158.130:5000/v2/_catalog							#没有账号密码访问失败
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}
[root@docker ~]# curl -XGET -u admin:admin123456 http://192.168.158.130:5000/v2/_catalog	#账号密码访问
{"repositories":["nginx"]}

账号密码-推送镜像到registry镜像仓库

docker login -u admin -p admin123456 192.168.158.130:5000
docker tag coredns/coredns:latest 192.168.158.130:5000/coredns/coredns:latest
docker push 192.168.158.130:5000/coredns/coredns:latest
curl -XGET -u admin:admin123456 http://192.168.158.130:5000/v2/_catalog

k8s搭建registry

[root@master ~]# vim deploy-registy.yaml 
---
#passwd这个key的内容就是使用htpasswd -Bbn admin admin123456 命令生成的
apiVersion: v1
data:
  passwd: |+
    admin:$2y$05$XmcyIRU8D7w2jUCYHskSZ.dcwFDS0SlYP4xMUBj1QZJIvgGSPlTAq
kind: ConfigMap
metadata:
  name: registry-cm
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: registry-pvc
  labels:
    release: registry
spec:
  accessModes: 
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
  storageClassName: nfs-storageclass
---
apiVersion: v1
kind: Service
metadata:
  name: "registry-svc"
  labels:
    release: registry
spec:
  ports:
    - name: http-registry
      port: 5000
      nodePort: 5000
      targetPort: 5000
  type: NodePort
  selector:
    release: registry
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: "registry-deployment"
  labels:
    release: registry
spec:
  replicas: 1
  selector:
    matchLabels:
      release: registry
  template:
    metadata:
      labels:
        release: registry
    spec:
      containers:
      - name: registry
        image: registry:latest
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /
            scheme: HTTP
            port: 5000
          initialDelaySeconds: 300
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /
            scheme: HTTP
            port: 5000
          initialDelaySeconds: 2
          periodSeconds: 10
        env:                                    #容器环境变量，传递3个环境变量
        - name: REGISTRY_AUTH
          value: htpasswd
        - name: REGISTRY_AUTH_HTPASSWD_REALM
          value: "Registry Realm"
        - name: REGISTRY_AUTH_HTPASSWD_PATH
          value: "/etc/registry/auth/passwd"
        ports:
        - containerPort: 5000
        volumeMounts:
        - name: registry-data				#使用pvc持久化
          mountPath: /var/lib/registry
        - name: registry-cm					#挂载configmap进去
          mountPath: /etc/registry/auth/passwd
          subPath: passwd
      volumes:
      - name: registry-cm
        configMap:
          name: registry-cm
          items:
            - key: passwd
              path: passwd
      - name: registry-data					#pvc
        persistentVolumeClaim:
          claimName: registry-pvc			#pvc
---

验证镜像仓库是否可用

vim  /etc/docker/daemon.json 						#每个k8s节点都要配置镜像仓库地址
"insecure-registries": ["192.168.158.128:5000"]		#添加这一条
systemctl restart docker							#重启docker

#登录镜像仓库
[root@master ~]# docker login -u admin -p admin123456 192.168.158.128:5000
Login Succeeded
#为镜像打个tag
[root@master ~]# docker tag busybox:1.24.1 192.168.158.128:5000/busybox:1.24.1
#推送镜像到镜像仓库，成功
[root@master ~]# docker push 192.168.158.128:5000/busybox:1.24.1
The push refers to repository [192.168.158.128:5000/busybox]
5f70bf18a086: Pushed 
61e469647daa: Pushed 
1.24.1: digest: sha256:458b359b8cb329f54e965bafee7b41d7557e62ba8d4c061f3dc57c7aaf9c048b size: 733

#查看后端存储，已经持久化了
[root@node2 ~]# ls /k8s_data/default-registry-pvc-pvc-d336e2f7-7bcc-4a79-8e3f-3ccff46c78c9/docker/registry/v2/repositories/
busybox
[root@node2 ~]#