简介: docker私有镜像仓库的搭建及认证
前言
在生产上使用的 Docker 镜像可能包含我们的代码、配置信息等,不想被外部人员获取,只允许内
网的开发人员下载。
Docker 官方提供了一个叫做 registry 的镜像用于搭建本地私有仓库使用。在内部网络搭建的 Docker 私有仓库可以使内网人员下载、上传都非常快速,不受外网带宽等因素的影响,同时不在内网的人员也无法下载我们的镜像,并且私有仓库也支持配置仓库认证功能。接下来详细讲解 registry 私有仓库的搭建过程。
配置私有仓库(无认证)
拉取私有仓库镜像
docker pull registry
修改配置文件
修改 daemon.json 文件。
添加以下内容,用于让 Docker 信任私有仓库地址,保存退出。
vim /etc/docker/daemon.json
注意json文件,除了最后一行不加逗号,前面的行末尾都要加逗号,否则下面restart将踩坑
{
"registry-mirrors":["http://hub-mirror.c.163.com","https://docker.mirrors.ustc.edu.cn"],
"insecure-registries":["192.168.135.10:5000"]
}
重新加载配置信息及重启 Docker 服务。
# 重新加载某个服务的配置文件
sudo systemctl daemon-reload
# 重新启动 docker
sudo systemctl restart docker
创建私有仓库容器
[root@centos8 docker_registry]# docker run -id --name registry -p 5000:5000 -v /root/mydate/docker_registry:/var/lib/registry registry
-v :将容器内 /var/lib/registry 目录下的数据挂载至宿主机 /root/mydate/docker_registry目录下
打开浏览器输入:http://192.168.135.10:5000/v2/_catalog 看到 {"repositories":[]} 表示私有
仓库搭建成功并且内容为空。
这里的192.168.135.10这个ip即你的Linux的ip,每个人都不同,自己手动查阅
推送镜像至私有仓库
先给镜像设置标签
再将镜像推送至私有仓库
docker tag local-image:tagname new-repo:tagname
docker push new-repo:tagname
[root@centos8 docker_registry]#docker tag mycentos:7 192.168.135.10:5000/mycentos7:1.0
[root@centos8 docker_registry]#docker push 192.168.135.10:5000/mycentos7:1.0
[root@centos8 docker_registry]#docker tag hello-world:latest 192.168.135.10:5000/myhelloworld
[root@centos8 docker_registry]#docker push 192.168.135.10:5000/myhelloworld
由于我们做了目录挂载,因此可以在宿主机/root/mydate/docker_registry/docker/registry/v2/repositories目录下查看
[root@centos8 repositories]# pwd
/root/mydate/docker_registry/docker/registry/v2/repositories
[root@centos8 repositories]# ls
mycentos7 myhelloworld
此时无认证情况下拉取镜像
docker pull 192.168.135.10:5000/myhelloworld
[root@centos8 repositories]# docker rmi 192.168.135.10:5000/myhelloworld:latest
Untagged: 192.168.135.10:5000/myhelloworld:latest
Untagged: 192.168.135.10:5000/myhelloworld@sha256:f54a58bc1aac5ea1a25d796ae155dc228b3f0e11d046ae276b39c4bf2f13d8c4
[root@centos8 repositories]# docker pull 192.168.135.10:5000/myhelloworld
Using default tag: latest
latest: Pulling from myhelloworld
Digest: sha256:f54a58bc1aac5ea1a25d796ae155dc228b3f0e11d046ae276b39c4bf2f13d8c4
Status: Downloaded newer image for 192.168.135.10:5000/myhelloworld:latest
192.168.135.10:5000/myhelloworld:latest
[root@centos8 repositories]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
mycentos 7 1b99ed7bf2b5 18 hours ago 525MB
192.168.135.10:5000/mycentos7 1.0 1b99ed7bf2b5 18 hours ago 525MB
redis 6 7faaec683238 5 days ago 113MB
redis latest 7faaec683238 5 days ago 113MB
nginx latest 87a94228f133 6 days ago 133MB
192.168.135.10:5000/myhelloworld latest feb5d9fea6a5 3 weeks ago 13.3kB
hello-world latest feb5d9fea6a5 3 weeks ago 13.3kB
registry latest b2cb11db9d3d 6 weeks ago 26.2MB
配置私有仓库(认证)
私有仓库已经搭建好了,要确保私有仓库的安全性,还需要一个安全认证证书,防止发生意想不到的事情。所以需要在搭建私有仓库的 Docker 主机上先生成自签名证书。
创建证书存储目录
[root@centos8 /]# mkdir -p /usr/local/registry/certs
生成自签名证书命令
[root@centos8 /]# openssl req -newkey rsa:2048 -nodes -sha256 -keyout /usr/local/registry/certs/domain.key -x509 -days 365 -out /usr/local/registry/certs/domain.crt
openssl req :创建证书签名请求等功能;
-newkey :创建 CSR 证书签名文件和 RSA 私钥文件;
rsa:2048 :指定创建的 RSA 私钥长度为 2048;
-nodes :对私钥不进行加密;
-sha256 :使用 SHA256 算法;
-keyout :创建的私钥文件名称及位置;
-x509 :自签发证书格式;
-days :证书有效期;
-out :指定 CSR 输出文件名称及位置
生成自签名证书
通过 openssl 先生成自签名证书,运行命令以后需要填写一些证书信息,里面最关键的部分是:
Common Name (eg, your name or your server's hostname) []:
这里填写的是私有仓库的地址。如本文即填写192.168.135.10
[root@centos8 /]# openssl req -newkey rsa:2048 -nodes -sha256 -keyout /usr/local/registry/certs/domain.key -x509 -days 365 -out /usr/local/registry/certs/domain.crt
Generating a RSA private key
...........................+++++
............................+++++
writing new private key to '/usr/local/registry/certs/domain.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:cn
Locality Name (eg, city) [Default City]:cn
Organization Name (eg, company) [Default Company Ltd]:cn
Organizational Unit Name (eg, section) []:cn
Common Name (eg, your name or your server's hostname) []:192.168.135.10
Email Address []:68725032@qq.com
[root@centos8 /]#
生成鉴权密码文件
# 创建存储鉴权密码文件目录
[root@centos8 /]# mkdir -p /usr/local/registry/auth
# 如果没有 htpasswd 功能需要安装 httpd
[root@centos8 /]# yum install -y httpd-tools
# 创建用户和密码 root 和 123
[root@centos8 /]# htpasswd -Bbn root 123 > /usr/local/registry/auth/htpasswd
htpasswd 是 apache http 的基本认证文件,使用 htpasswd 命令可以生成用户及密码文件。
创建私有仓库容器
先把之前创建的无认证的容器删掉
[root@centos8 auth]# docker stop registry
registry
[root@centos8 auth]# docker rm registry
registry
docker run -id --name registry -p 5000:5000 \
-v /root/mydate/docker_registry:/var/lib/registry \
-v /usr/local/registry/certs:/certs \
-v /usr/local/registry/auth:/auth \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
registry
[root@centos8 auth]# docker run -id --name registry -p 5000:5000 \
> -v /root/mydate/docker_registry:/var/lib/registry \
> -v /usr/local/registry/certs:/certs \
> -v /usr/local/registry/auth:/auth \
> -e "REGISTRY_AUTH=htpasswd" \
> -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
> -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
> -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
> -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
> registry
b6a53df1dfe60ac2ca77b278a315abc59cd20b2a378dbd7cea6d18ddeac92dca
[root@centos8 auth]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b6a53df1dfe6 registry "/entrypoint.sh /etc…" 4 minutes ago Up 4 minutes 0.0.0.0:5000->5000/tcp, :::5000->5000/tcp registry
推送镜像至私有仓库失败
先给镜像设置标签
再将镜像推送至私有仓库
docker tag local-image:tagname new-repo:tagname
docker push new-repo:tagname
[root@centos8 docker_registry]#docker tag hello-world:latest 192.168.135.10:5000/myhelloworld
[root@centos8 auth]# docker push 192.168.135.10:5000/myhelloworld
Using default tag: latest
The push refers to repository [192.168.135.10:5000/myhelloworld]
e07ee1baac5f: Preparing
no basic auth credentials
如果直接 push 镜像肯定会失败,并且出现 no basic auth credentials(没有基本的身份验证凭据)的错误,这是因为我们没有进行登录认证。
登录账号
通过 docker login ip:port 命令输入账号密码登录私有仓库
[root@centos8 auth]# docker login 192.168.135.10:5000
Username: root
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
推送镜像至私有仓库成功
再次 push 镜像,发现已经可以推送成功了
[root@centos8 auth]# docker push 192.168.135.10:5000/myhelloworld
Using default tag: latest
The push refers to repository [192.168.135.10:5000/myhelloworld]
e07ee1baac5f: Layer already exists
latest: digest: sha256:f54a58bc1aac5ea1a25d796ae155dc228b3f0e11d046ae276b39c4bf2f13d8c4 size: 525
退出账号
通过 docker logout ip:port命令退出账号
[root@centos8 auth]# docker logout 192.168.135.10:5000
Removing login credentials for 192.168.135.10:5000