1. Harbor概述
Habor是由VMware公司开源的容器镜像仓库。事实上，Habor是在Docker Registry上进行相应的企业级扩展，从而获得了更加广泛的应用，这些新的企业级特性包括：管理用户界面，基于角色的访问控制，AD/LDAP集成以及审计日志等，足以满足基本企业需求。
官方地址：https://vmware.github.io/harbor/cn/
image.png
2. Harbor部署
Harbor安装有3种方式：
- 在线安装：从Docker Hub下载Harbor相关镜像，因此安装软件包非常小
- 离线安装：安装包包含部署的相关镜像，因此安装包比较大
- OVA安装程序：当用户具有vCenter环境时，使用此安装程序，在部署OVA后启动Harbor
harbor下载地址
https://github.com/goharbor/harbor/releases
找到对应版本，这里下载1.6.1版本，找到Download Binary，点击Harbor offline installer下载离线包
安装依赖
curl -L "https://github.com/docker/compose/releases/download/1.25.5/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
示例：
[root@docker ~]# curl -L "https://github.com/docker/compose/releases/download/1.25.5/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
---安装依赖
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 638 100 638 0 0 371 0 0:00:01 0:00:01 --:--:-- 371
100 16.7M 100 16.7M 0 0 2224k 0 0:00:07 0:00:07 --:--:-- 3772k
[root@docker ~]# ls ---上传harbor-offline-installer-v1.6.1.tgz php.ini
Dockerfile harbor-offline-installer-v1.6.1.tgz php.ini
Dockerfile-nginx jenkins.war wordpress-4.9.4-zh_CN.tar.gz
Dockerfile-php nginx.conf
Dockerfile-tomcat php-fpm.conf
[root@docker ~]# ls /usr/local/bin/
docker-compose
[root@docker ~]# chmod +x /usr/local/bin/docker-compose ---赋予执行权限
[root@docker ~]# docker-compose ps
ERROR:
Can't find a suitable configuration file in this directory or any
parent. Are you in the right directory?
Supported filenames: docker-compose.yml, docker-compose.yaml ---提示缺少yml文件
[root@docker ~]# mkdir dockerfile ---清理当前目录，只剩下harbor-offline-installer-v1.6.1.tgz
[root@docker ~]# mv * dockerfile/
mv: cannot move ‘dockerfile’ to a subdirectory of itself, ‘dockerfile/dockerfile’
[root@docker ~]# mv dockerfile/harbor-offline-installer-v1.6.1.tgz ./
[root@docker ~]# ls
dockerfile harbor-offline-installer-v1.6.1.tgz
[root@docker ~]# tar zxf harbor-offline-installer-v1.6.1.tgz
[root@docker ~]# cd harbor
[root@docker harbor]# ls
common docker-compose.clair.yml docker-compose.yml harbor.cfg install.sh NOTICE prepare
docker-compose.chartmuseum.yml docker-compose.notary.yml ha harbor.v1.6.1.tar.gz LICENSE open_source_license
[root@docker harbor]# vi harbor.cfg ---修改配置文件
hostname = 192.168.9.50 ---可以设置域名或IP
ui_url_protocol = http ---可以使用http或https
harbor_admin_password = Harbor12345 ---这是admin的默认密码
[root@docker harbor]# ./prepare ---配置
Generated and saved secret to file: /data/secretkey
Generated configuration file: ./common/config/nginx/nginx.conf
Generated configuration file: ./common/config/adminserver/env
Generated configuration file: ./common/config/ui/env
Generated configuration file: ./common/config/registry/config.yml
Generated configuration file: ./common/config/db/env
Generated configuration file: ./common/config/jobservice/env
Generated configuration file: ./common/config/jobservice/config.yml
Generated configuration file: ./common/config/log/logrotate.conf
Generated configuration file: ./common/config/registryctl/env
Generated configuration file: ./common/config/ui/app.conf
Generated certificate, key file: ./common/config/ui/private_key.pem, cert file: ./common/config/registry/root.crt
The configuration files are ready, please use docker-compose to start the service.
[root@docker harbor]# ./install.sh ---安装
[root@docker harbor]# docker-compose ps ---列出配置文件
Name Command State Ports
-------------------------------------------------------------------------------------------------------------------------------------
harbor-adminserver /harbor/start.sh Up (healthy)
harbor-db /entrypoint.sh postgres Up (healthy) 5432/tcp
harbor-jobservice /harbor/start.sh Up
harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp
harbor-ui /harbor/start.sh Up (healthy)
nginx nginx -g daemon off; Up (healthy) 0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp, 0.0.0.0:80->80/tcp
redis docker-entrypoint.sh redis ... Up 6379/tcp
registry /entrypoint.sh /etc/regist ... Up (healthy) 5000/tcp
访问Harbor
登录
Harbor主界面
用户管理：创建用户、配置用户、删除用户等。
仓库管理：创建仓库、配置仓库、删除仓库等。
复制管理：可以创建一个备用仓库，然后同步过去。
配置管理：可以定义数据库认证、LDAP认证等。
点击library进入公共镜像
进入公共镜像
点击推送镜像，显示推送镜像的方法
推送镜像的方法
基本使用
1. 配置http镜像仓库可信任
vi /etc/docker/daemon.json
{"insecure-registries":["reg.ctnrs.com"]}
systemctl restart docker
2. 打标签
docker tag centos:6 reg.ctnrs.com/library/centos:6
3. 上传
docker push reg.ctnrs.com/library/centos:6
4. 下载
docker pull reg.ctnrs.com/library/centos:6
示例
[root@docker ~]# docker images ---查看镜像
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx v1 da68ec297f64 4 days ago 362MB
tomcat v2 0378ce9bdd8c 4 days ago 501MB
tomcat v1 70a752702803 4 days ago 434MB
php v1 beaafb70b1ee 5 days ago 488MB
mysql 5.7 b84d68d0a7db 5 days ago 448MB
centos 7 b5b4d78bc90c 2 weeks ago 203MB
nginx latest 602e111c06b6 4 weeks ago 127MB
busybox latest be5888e67be6 5 weeks ago 1.22MB
hello-world latest bf756fb1ae65 4 months ago 13.3kB
nginx 1.15 53f3fd8007f7 12 months ago 109MB
goharbor/chartmuseum-photon v0.7.1-v1.6.1 f0a2dbee1ff1 19 months ago 350MB
goharbor/harbor-migrator v1.6.1 60e8be845b35 19 months ago 798MB
goharbor/redis-photon v1.6.1 6a67380bb061 19 months ago 210MB
goharbor/clair-photon v2.0.6-v1.6.1 c4fcdbae7df2 19 months ago 302MB
goharbor/notary-server-photon v0.5.1-v1.6.1 f1afd44d9f9b 19 months ago 209MB
goharbor/notary-signer-photon v0.5.1-v1.6.1 83aa51867207 19 months ago 207MB
goharbor/registry-photon v2.6.2-v1.6.1 f4cb5e83f0a4 19 months ago 196MB
goharbor/nginx-photon v1.6.1 9ca888fe33b2 19 months ago 132MB
goharbor/harbor-log v1.6.1 9b1ea3f29465 19 months ago 198MB
goharbor/harbor-jobservice v1.6.1 9ca6fd371ca6 19 months ago 192MB
goharbor/harbor-ui v1.6.1 305ee5b8952c 19 months ago 215MB
goharbor/harbor-adminserver v1.6.1 a3e95f74984e 19 months ago 181MB
goharbor/harbor-db v1.6.1 3bea3bff0190 19 months ago 219MB
[root@docker ~]# docker tag nginx:v1 192.168.9.50/library/nginx:v1 ---打标签
[root@docker ~]# docker images ---已经打好标签
REPOSITORY TAG IMAGE ID CREATED SIZE
192.168.9.50/library/nginx v1 da68ec297f64 4 days ago 362MB
nginx v1 da68ec297f64 4 days ago 362MB
tomcat v2 0378ce9bdd8c 4 days ago 501MB
tomcat v1 70a752702803 4 days ago 434MB
php v1 beaafb70b1ee 5 days ago 488MB
mysql 5.7 b84d68d0a7db 5 days ago 448MB
centos 7 b5b4d78bc90c 2 weeks ago 203MB
nginx latest 602e111c06b6 4 weeks ago 127MB
busybox latest be5888e67be6 5 weeks ago 1.22MB
hello-world latest bf756fb1ae65 4 months ago 13.3kB
nginx 1.15 53f3fd8007f7 12 months ago 109MB
goharbor/chartmuseum-photon v0.7.1-v1.6.1 f0a2dbee1ff1 19 months ago 350MB
goharbor/harbor-migrator v1.6.1 60e8be845b35 19 months ago 798MB
goharbor/redis-photon v1.6.1 6a67380bb061 19 months ago 210MB
goharbor/clair-photon v2.0.6-v1.6.1 c4fcdbae7df2 19 months ago 302MB
goharbor/notary-server-photon v0.5.1-v1.6.1 f1afd44d9f9b 19 months ago 209MB
goharbor/notary-signer-photon v0.5.1-v1.6.1 83aa51867207 19 months ago 207MB
goharbor/registry-photon v2.6.2-v1.6.1 f4cb5e83f0a4 19 months ago 196MB
goharbor/nginx-photon v1.6.1 9ca888fe33b2 19 months ago 132MB
goharbor/harbor-log v1.6.1 9b1ea3f29465 19 months ago 198MB
goharbor/harbor-jobservice v1.6.1 9ca6fd371ca6 19 months ago 192MB
goharbor/harbor-ui v1.6.1 305ee5b8952c 19 months ago 215MB
goharbor/harbor-adminserver v1.6.1 a3e95f74984e 19 months ago 181MB
goharbor/harbor-db v1.6.1 3bea3bff0190 19 months ago 219MB
[root@docker ~]# docker push 192.168.9.50/library/nginx:v1 ---推送失败，需要配置http镜像仓库可信任
The push refers to repository [192.168.9.50/library/nginx]
Get https://192.168.9.50/v2/: dial tcp 192.168.9.50:443: connect: connection refused
[root@docker ~]# vi /etc/docker/daemon.json
{
"registry-mirrors": ["http://f1361db2.m.daocloud.io"], ---添加逗号
"insecure-registries":["192.168.9.50"] ---添加信任IP或域名
}
[root@docker ~]# systemctl restart docker ---重启容器
[root@docker ~]# cd harbor
[root@docker harbor]# docker-compose ps ---可以看到部分镜像退出了
Name Command State Ports
-------------------------------------------------------------------------------------------------------------------------------------
harbor-adminserver /harbor/start.sh Up (healthy)
harbor-db /entrypoint.sh postgres Up (healthy) 5432/tcp
harbor-jobservice /harbor/start.sh Exit 137
harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp
harbor-ui /harbor/start.sh Up (healthy)
nginx nginx -g daemon off; Up (healthy) 0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp, 0.0.0.0:80->80/tcp
redis docker-entrypoint.sh redis ... Up 6379/tcp
registry /entrypoint.sh /etc/regist ... Up (healthy) 5000/tcp
[root@docker harbor]# docker-compose up -d
harbor-log is up-to-date
harbor-db is up-to-date
registry is up-to-date
redis is up-to-date
harbor-adminserver is up-to-date
harbor-ui is up-to-date
Starting harbor-jobservice ...
Starting harbor-jobservice ... done
[root@docker harbor]# docker-compose ps
Name Command State Ports
-------------------------------------------------------------------------------------------------------------------------------------
harbor-adminserver /harbor/start.sh Up (healthy)
harbor-db /entrypoint.sh postgres Up (healthy) 5432/tcp
harbor-jobservice /harbor/start.sh Up
harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp
harbor-ui /harbor/start.sh Up (healthy)
nginx nginx -g daemon off; Up (healthy) 0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp, 0.0.0.0:80->80/tcp
redis docker-entrypoint.sh redis ... Up 6379/tcp
registry /entrypoint.sh /etc/regist ... Up (healthy) 5000/tcp
[root@docker harbor]# docker info
---省略若干---
Experimental: false
Insecure Registries:
192.168.9.50 ---看到这个说明配置成功了
127.0.0.0/8
Registry Mirrors:
http://f1361db2.m.daocloud.io/
Live Restore Enabled: false
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled
[root@docker harbor]# docker push 192.168.9.50/library/nginx:v1 ---push失败，需要登录
The push refers to repository [192.168.9.50/library/nginx]
8f22dbb76d2c: Preparing
8d612f7647f5: Preparing
113c98c9da2f: Preparing
edf3aa290fb3: Preparing
denied: requested access to the resource is denied
创建测试用户
在library公共库添加测试用户
把test设置为项目管理员
[root@docker harbor]# docker login 192.168.9.50 ---登录测试用户
Username: test
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
[root@docker harbor]# docker push 192.168.9.50/library/nginx:v1 ---推送镜像
The push refers to repository [192.168.9.50/library/nginx]
8f22dbb76d2c: Pushed
8d612f7647f5: Pushed
113c98c9da2f: Pushed
edf3aa290fb3: Pushed
v1: digest: sha256:984aadbd261c57465821e40290203588cb33b2d5047eb5bb9d93f46b14b26cdc size: 1160
推送成功
[root@docker harbor]# docker logout 192.168.9.50 ---退出登录
Removing login credentials for 192.168.9.50
[root@docker harbor]# docker rmi 192.168.9.50/library/nginx:v1 ---删除刚才的镜像
Untagged: 192.168.9.50/library/nginx:v1
Untagged: 192.168.9.50/library/nginx@sha256:984aadbd261c57465821e40290203588cb33b2d5047eb5bb9d93f46b14b26cdc
[root@docker harbor]# docker pull 192.168.9.50/library/nginx:v1 ---下载镜像成功（私有仓库需要登录）
v1: Pulling from library/nginx
Digest: sha256:984aadbd261c57465821e40290203588cb33b2d5047eb5bb9d93f46b14b26cdc
Status: Downloaded newer image for 192.168.9.50/library/nginx:v1
192.168.9.50/library/nginx:v1
[root@docker harbor]# docker run -d 192.168.9.50/library/nginx:v1 ---从镜像仓库启动容器（常用）
d1b87a14a75c07776005a323ff15b4e9ad8810360da7bf584a8123521c925244