Harbor

Harbor

无论是使用Docker-distribution去自建仓库，还是通过官方镜像跑容器的方式去自建仓库，通过前面的演示我们可以发现其是非常的简陋的，还不如直接使用官方的Docker Hub去管理镜像来得方便，至少官方的Docker Hub能够通过web界面来管理镜像，还能在web界面执行搜索，还能基于Dockerfile利用Webhooks和Automated Builds实现自动构建镜像的功能，用户不需要在本地执行docker build，而是把所有build上下文的文件作为一个仓库推送到github上，让Docker Hub可以从github上去pull这些文件来完成自动构建。

但无论官方的Docker Hub有多强大，它毕竟是在国外，所以速度是最大的瓶颈，我们很多时候是不可能去考虑使用官方的仓库的，但是上面说的两种自建仓库方式又十分简陋，不便管理，所以后来就出现了一个被 CNCF 组织青睐的项目，其名为Harbor。

Harbor简介

Harbor是由VMWare在Docker Registry的基础之上进行了二次封装，加进去了很多额外程序，而且提供了一个非常漂亮的web界面。

• Harbor是一个开源可信的云原生的仓库项目，用于存储、用户管理和查找镜像。
• Harbor通过添加用户通常需要的功能，如安全、身份和管理，扩展了开源Docker分发版。
• Harbor支持高级特性，如用户管理、访问控制、活动监视和实例之间的复制。

Harbor的功能

• 多租户内容签名和验证
• 安全性和漏洞分析
• 审计日志记录
• 身份集成和基于角色的访问控制
• 实例之间的映像复制
• 可扩展API和图形UI
• 国际化(目前为中英文化)

Docker compose

Harbor在物理机上部署是非常难的，而为了简化Harbor的应用，Harbor官方直接把Harbor做成了在容器中运行的应用，而且这个容器在Harbor中依赖类似redis、mysql、pgsql等很多存储系统，所以它需要编排很多容器协同起来工作，因此VMWare Harbor在部署和使用时，需要借助于Docker的单机编排

Compose是一个用于定义和运行多容器Docker应用程序的工具。使用Compose，您可以使用YAML文件来配置应用程序的服务。然后，通过一个命令，您可以创建并启动配置中的所有服务。

Docker Compose官方文档

Harbor安装

Harbor官方文档
harbor-offline-installer-v2.3.5.tgz

//修改主机名
[root@localhost ~]# hostname harbor.example.com
[root@localhost ~]# bash


//关闭防火墙
[root@harbor ~]# systemctl disable --now firewalld.service 
[root@harbor ~]# sed -i s/SELINUX=enforing/SELINUX=disabled/g /etc/selinux/config 
[root@harbor ~]# setenforce 0
[root@harbor ~]# reboot

//安装docker
[root@harbor ~]# yum -y install docker-ce
[root@harbor ~]# systemctl enable --now docker
Created symlink /etc/systemd/system/multi-user.target.wants/docker.service → /usr/lib/systemd/system/docker.service.


//安装docker-compose（centos8）
[root@harbor ~]# curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   664  100   664    0     0    837      0 --:--:-- --:--:-- --:--:--   836
100 12.1M  100 12.1M    0     0   181k      0  0:01:08  0:01:08 --:--:--  690k


[root@harbor ~]# chmod +x /usr/local/bin/docker-compose
[root@harbor ~]# ll /usr/local/bin/
总用量 12440
-rwxr-xr-x. 1 root root 12737304 12月 16 03:01 docker-compose
[root@harbor ~]# which docker-compose
/usr/local/bin/docker-compose



//下载安装harbor并解压
[root@harbor ~]# wget -c https://github.com/goharbor/harbor/releases/download/v2.3.5/harbor-offline-installer-v2.3.5.tgz
[root@harbor ~]# ls
anaconda-ks.cfg  harbor-offline-installer-v2.3.5.tgz
[root@harbor ~]# tar xf harbor-offline-installer-v2.3.5.tgz -C /usr/local/
[root@harbor ~]# ls /usr/local/
bin  etc  games  harbor  include  lib  lib64  libexec  sbin  share  src


//编写yaml文件
[root@harbor ~]# cd /usr/local/harbor/
[root@harbor harbor]# ls
common.sh  harbor.v2.3.5.tar.gz  harbor.yml.tmpl  install.sh  LICENSE  prepare
[root@harbor harbor]# cp harbor.yml.tmpl harbor.yml


//添加解析地址
[root@harbor ~]# cat /etc/hosts 
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.129.205 harbor.example.com

//修改配置文件
[root@harbor ~]# cat /usr/local/harbor/harbor.yml
hostname: harbor.example.com     #主机名修改为域名（也可以是ip）

#注释掉以下没注释的
# https related config
# https:
  # https port for harbor, default is 443     #因为未做https，所以将https全部注释
  # port: 443
  # The path of cert and key files for nginx
  # certificate: /your/certificate/path
  # private_key: /your/private/key/path

harbor_admin_password: Harbor12345               #web界面登录密码

//执行脚本
[root@harbor harbor]# ./install.sh 
[Step 5]: starting Harbor ...
Creating network "harbor_harbor" with the default driver
Creating harbor-log ... done
Creating harbor-portal ... done
Creating harbor-db     ... done
Creating registry      ... done
Creating redis         ... done
Creating registryctl   ... done
Creating harbor-core   ... done
Creating harbor-jobservice ... done
Creating nginx             ... done
✔ ----Harbor has been installed and started successfully.----



//查看镜像
[root@harbor harbor]# docker images
REPOSITORY                      TAG       IMAGE ID       CREATED      SIZE
goharbor/harbor-exporter        v2.3.5    1730c6f650e2   5 days ago   81.9MB
goharbor/chartmuseum-photon     v2.3.5    47004f032938   5 days ago   179MB
goharbor/redis-photon           v2.3.5    3d0cedc89a0d   5 days ago   156MB
goharbor/trivy-adapter-photon   v2.3.5    5c0212e98070   5 days ago   133MB
goharbor/notary-server-photon   v2.3.5    f20a76c65359   5 days ago   111MB
goharbor/notary-signer-photon   v2.3.5    b9fa38eef4d7   5 days ago   108MB
goharbor/harbor-registryctl     v2.3.5    7a52567a76ca   5 days ago   133MB
goharbor/registry-photon        v2.3.5    cf22d3e386b8   5 days ago   82.6MB
goharbor/nginx-photon           v2.3.5    5e3b6d9ce11a   5 days ago   45.7MB
goharbor/harbor-log             v2.3.5    a03e4bc963d6   5 days ago   160MB
goharbor/harbor-jobservice      v2.3.5    2ac32df5a2e0   5 days ago   211MB
goharbor/harbor-core            v2.3.5    23baee01156f   5 days ago   193MB
goharbor/harbor-portal          v2.3.5    bb545cdedf5a   5 days ago   58.9MB
goharbor/harbor-db              v2.3.5    9826c57a5749   5 days ago   221MB
goharbor/prepare                v2.3.5    a1ceaabe47b2   5 days ago   255MB

//查看容器
[root@harbor harbor]# docker ps 
CONTAINER ID   IMAGE                                COMMAND                  CREATED              STATUS                        PORTS                                   NAMES
403896c4af54   goharbor/nginx-photon:v2.3.5         "nginx -g 'daemon of…"   About a minute ago   Up 58 seconds (healthy)       0.0.0.0:80->8080/tcp, :::80->8080/tcp   nginx
ecc76340dbe1   goharbor/harbor-jobservice:v2.3.5    "/harbor/entrypoint.…"   About a minute ago   Up 58 seconds (healthy)                                               harbor-jobservice
fd93cfe6fe4f   goharbor/harbor-core:v2.3.5          "/harbor/entrypoint.…"   About a minute ago   Up 59 seconds (healthy)                                               harbor-core
914c3db5b295   goharbor/harbor-registryctl:v2.3.5   "/home/harbor/start.…"   About a minute ago   Up About a minute (healthy)                                           registryctl
d5c4fcfee5a1   goharbor/redis-photon:v2.3.5         "redis-server /etc/r…"   About a minute ago   Up About a minute (healthy)                                           redis
315e81f521ff   goharbor/registry-photon:v2.3.5      "/home/harbor/entryp…"   About a minute ago   Up About a minute (healthy)                                           registry
9db3154f5897   goharbor/harbor-db:v2.3.5            "/docker-entrypoint.…"   About a minute ago   Up About a minute (healthy)                                           harbor-db
c43131757640   goharbor/harbor-portal:v2.3.5        "nginx -g 'daemon of…"   About a minute ago   Up About a minute (healthy)                                           harbor-portal
9d7a887bed8a   goharbor/harbor-log:v2.3.5           "/bin/sh -c /usr/loc…"   About a minute ago   Up About a minute (healthy)   127.0.0.1:1514->10514/tcp               harbor-log


[root@harbor harbor]# ss -antl
State      Recv-Q     Send-Q         Local Address:Port         Peer Address:Port     Process     
LISTEN     0          128                127.0.0.1:1514              0.0.0.0:*                    
LISTEN     0          128                  0.0.0.0:80                0.0.0.0:*                    
LISTEN     0          128                  0.0.0.0:22                0.0.0.0:*                    
LISTEN     0          128                     [::]:80                   [::]:*                    
LISTEN     0          128                        *:8080                    *:*                    
LISTEN     0          128                     [::]:22                   [::]:*                    

使用IP登录管理Harbor：

账户：admin
密码：Harbor12345

登录

//在docker主机上测试

//做域名解析
[root@docker ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.47.131 harbor.example.com

[root@docker ~]# ping harbor.example.com
PING harbor.example.com (192.168.47.131) 56(84) bytes of data.
64 bytes from harbor.example.com (192.168.47.131): icmp_seq=1 ttl=64 time=0.249 ms
64 bytes from harbor.example.com (192.168.47.131): icmp_seq=2 ttl=64 time=0.305 ms
64 bytes from harbor.example.com (192.168.47.131): icmp_seq=3 ttl=64 time=0.385 ms
^C
--- harbor.example.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2001ms
rtt min/avg/max/mdev = 0.249/0.313/0.385/0.055 ms


//指定docker镜像仓库
[root@docker ~]# cat /etc/docker/daemon.json 
{
 "insecure-registries": ["harbor.example.com"]
}
[root@docker ~]# systemctl restart docker



//登录
[root@docker ~]# docker login harbor.example.com
Username: admin
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

上传镜像

[root@docker ~]# docker images
REPOSITORY          TAG       IMAGE ID       CREATED        SIZE
jiejiehao/haproxy   v3        e305401a54a4   3 days ago     54.1MB

##修改镜像名
[root@docker ~]# docker tag jiejiehao/haproxy:v3 harbor.example.com/library/haproxy:v3
[root@docker ~]# docker images
REPOSITORY                           TAG       IMAGE ID       CREATED        SIZE
jiejiehao/haproxy                    v3        e305401a54a4   3 days ago     54.1MB
harbor.example.com/library/haproxy   v3        e305401a54a4   3 days ago     54.1MB

##上传镜像
[root@docker ~]# docker push harbor.example.com/library/haproxy:v3
The push refers to repository [harbor.example.com/library/haproxy]
7a059acae635: Pushed 
75be6a7c991c: Pushed 
951dd71af35d: Pushed 
8d3ac3489996: Pushed 
v3: digest: sha256:0115e524d3de916837f851c87ba0b50d5747fef1dcdf810df2f3c137b85aac7e size: 1158

##删除本地镜像
[root@docker ~]# docker rmi jiejiehao/haproxy:v3
Untagged: jiejiehao/haproxy:v3

[root@docker ~]# docker rmi -f harbor.example.com/library/haproxy:v3
Untagged: harbor.example.com/library/haproxy:v3
Untagged: harbor.example.com/library/haproxy@sha256:0115e524d3de916837f851c87ba0b50d5747fef1dcdf810df2f3c137b85aac7e
Deleted: sha256:e305401a54a4b8442dc7cc73bd89658f1c1c9d0da7cfaa1288cab830dde2cc0f
Deleted: sha256:87440c805cd745aa5ad0a2265d108b5b4ac359ae85c31ee961247b9a35c313ab
Deleted: sha256:61674612695341855cfc4457a9d729ed18bfebfe2068930c0c2bcc0182eac54b
Deleted: sha256:ce807334d5f95736d923e7d46692d3a67200f6b0224deed4772dfc2ccdd9b8a6
Deleted: sha256:93e3037c53636d53932f68e56c2d898dc83299b5a336e5ae5105e833f83edae0
Deleted: sha256:3673cd75ed158a60d6b40477f688b49a2ab3ad67f3256f0d7975c2de7678c54f
[root@docker ~]# docker images
REPOSITORY          TAG       IMAGE ID       CREATED        SIZE


## 拉取镜像
[root@docker ~]# docker pull harbor.example.com/library/haproxy:v3
v3: Pulling from library/haproxy
59bf1c3509f3: Already exists 
7be42fc4f105: Already exists 
ce118a4c48f3: Already exists 
81b133204876: Already exists 
Digest: sha256:0115e524d3de916837f851c87ba0b50d5747fef1dcdf810df2f3c137b85aac7e
Status: Downloaded newer image for harbor.example.com/library/haproxy:v3
harbor.example.com/library/haproxy:v3
[root@docker ~]# docker images
REPOSITORY                           TAG       IMAGE ID       CREATED        SIZE
harbor.example.com/library/haproxy   v3        e305401a54a4   3 days ago     54.1MB

查看web界面

使用Harbor的注意事项：

• 在客户端上传镜像时一定要记得执行docker login进行用户认证，否则无法直接push
• 在客户端使用的时候如果不是用的https则必须要在客户端的/etc/docker/daemon.json配置文件中配置insecure-registries参数
• 数据存放路径应在配置文件中配置到一个容量比较充足的共享存储中
• Harbor是使用docker-compose命令来管理的，如果需要停止Harbor也应用docker-compose stop来停止，其他参数请–help

Harbor命令管理

可以使用命令 docker restart containerID逐个重启，也可以使用docker-compose进行重新启动：
（此命令需要在安装目录下执行）

[root@harbor harbor]# docker-compose stop
Stopping harbor-jobservice ... done
Stopping harbor-core       ... done
Stopping harbor-portal     ... done
Stopping harbor-db         ... done
Stopping registryctl       ... done
Stopping redis             ... done
Stopping registry          ... done
Stopping harbor-log        ... done
[root@harbor harbor]# docker ps 
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES


//重新构建
[root@harbor harbor]# docker-compose start
Starting harbor-log ... done
Starting harbor-db     ... done
Starting registryctl   ... done
Starting redis         ... done
Starting harbor-portal ... done
Starting registry      ... done
Starting harbor-core   ... done
Starting harbor-jobservice ... done
Starting nginx             ... done

[root@harbor harbor]# docker ps
CONTAINER ID   IMAGE                                COMMAND                  CREATED          STATUS                             PORTS                                   NAMES
403896c4af54   goharbor/nginx-photon:v2.3.5         "nginx -g 'daemon of…"   36 minutes ago   Up 10 seconds (health: starting)   0.0.0.0:80->8080/tcp, :::80->8080/tcp   nginx
ecc76340dbe1   goharbor/harbor-jobservice:v2.3.5    "/harbor/entrypoint.…"   36 minutes ago   Up 10 seconds (health: starting)                                           harbor-jobservice
fd93cfe6fe4f   goharbor/harbor-core:v2.3.5          "/harbor/entrypoint.…"   36 minutes ago   Up 11 seconds (health: starting)                                           harbor-core
914c3db5b295   goharbor/harbor-registryctl:v2.3.5   "/home/harbor/start.…"   36 minutes ago   Up 11 seconds (health: starting)                                           registryctl
d5c4fcfee5a1   goharbor/redis-photon:v2.3.5         "redis-server /etc/r…"   36 minutes ago   Up 11 seconds (health: starting)                                           redis
315e81f521ff   goharbor/registry-photon:v2.3.5      "/home/harbor/entryp…"   36 minutes ago   Up 11 seconds (health: starting)                                           registry
9db3154f5897   goharbor/harbor-db:v2.3.5            "/docker-entrypoint.…"   36 minutes ago   Up 12 seconds (health: starting)                                           harbor-db
c43131757640   goharbor/harbor-portal:v2.3.5        "nginx -g 'daemon of…"   36 minutes ago   Up 11 seconds (health: starting)                                           harbor-portal
9d7a887bed8a   goharbor/harbor-log:v2.3.5           "/bin/sh -c /usr/loc…"   36 minutes ago   Up 13 seconds (health: starting)   127.0.0.1:1514->10514/tcp               harbor-log

Harbor的开机自启

[root@harbor ~]# cd /usr/local/harbor/
[root@harbor harbor]# vim harbor-start.sh 
[root@harbor harbor]# cat harbor-start.sh 
#!/bin/bash

cd /usr/local/harbor/ && docker-compose start &> /dev/null

[root@harbor harbor]# chmod +x harbor-start.sh


[root@harbor ~]# vim /etc/rc.d/rc.local
[root@harbor harbor]# cat /etc/rc.d/rc.local
#!/bin/bash
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.

touch /var/lock/subsys/local

/usr/local/harbor/harbor-start.sh

[root@harbor ~]# chmod +x /etc/rc.d/rc.local


#测试
[root@harbor ~]# cd /usr/local/harbor/
[root@harbor harbor]# docker-compose stop
Stopping nginx             ... done
Stopping harbor-jobservice ... done
Stopping harbor-core       ... done
Stopping registryctl       ... done
Stopping redis             ... done
Stopping registry          ... done
Stopping harbor-db         ... done
Stopping harbor-portal     ... done
Stopping harbor-log        ... done
[root@harbor harbor]# docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES


[root@harbor harbor]# reboot 

连接断开
连接成功
Last login: Thu Dec 16 04:00:04 2021 from 192.168.47.1
[root@harbor ~]# docker ps
CONTAINER ID   IMAGE                                COMMAND                  CREATED          STATUS                        PORTS                                   NAMES
403896c4af54   goharbor/nginx-photon:v2.3.5         "nginx -g 'daemon of…"   50 minutes ago   Up About a minute (healthy)   0.0.0.0:80->8080/tcp, :::80->8080/tcp   nginx
ecc76340dbe1   goharbor/harbor-jobservice:v2.3.5    "/harbor/entrypoint.…"   50 minutes ago   Up About a minute (healthy)                                           harbor-jobservice
fd93cfe6fe4f   goharbor/harbor-core:v2.3.5          "/harbor/entrypoint.…"   50 minutes ago   Up About a minute (healthy)                                           harbor-core
914c3db5b295   goharbor/harbor-registryctl:v2.3.5   "/home/harbor/start.…"   50 minutes ago   Up About a minute (healthy)                                           registryctl
d5c4fcfee5a1   goharbor/redis-photon:v2.3.5         "redis-server /etc/r…"   50 minutes ago   Up About a minute (healthy)                                           redis
315e81f521ff   goharbor/registry-photon:v2.3.5      "/home/harbor/entryp…"   50 minutes ago   Up About a minute (healthy)                                           registry
9db3154f5897   goharbor/harbor-db:v2.3.5            "/docker-entrypoint.…"   50 minutes ago   Up About a minute (healthy)                                           harbor-db
c43131757640   goharbor/harbor-portal:v2.3.5        "nginx -g 'daemon of…"   50 minutes ago   Up About a minute (healthy)                                           harbor-portal
9d7a887bed8a   goharbor/harbor-log:v2.3.5           "/bin/sh -c /usr/loc…"   50 minutes ago   Up About a minute (healthy)   127.0.0.1:1514->10514/tcp               harbor-log