【Docker】搭建企业级私有harbor仓库全流程详解

前情提要：本篇博客详细介绍了harbor仓库的部署和使用的全部流程，通过本篇博客你可以学会并且部署一个私有的harbor仓库并且管理

系统：RHEL9.3

一、harbor仓库简介

Harbor 是由vmware公司开源的企业级 Docker Registry 项目。

它提供了以下主要功能和特点：

基于角色的访问控制（RBAC）：可以为不同的用户和用户组分配不同的权限，增强了安全性和管理的灵活性。
镜像复制：支持在不同的 Harbor 实例之间复制镜像，方便在多个数据中心或环境中分发镜像。
图形化用户界面（UI）：提供了直观的 Web 界面，便于管理镜像仓库、项目、用户等。
审计日志：记录了对镜像仓库的各种操作，有助于追踪和审查活动。
垃圾回收：可以清理不再使用的镜像，节省存储空间。

二、部署harbor

本次使用的是harbor离线安装包，下载地址https://github.com/goharbor/harbor/releases/download/v2.15.0/harbor-offline-installer-v2.15.0.tgz

2.1 下载harbor离线安装包

cpp 复制代码

# 下载harbor仓库软件包
[root@docker-node1 ~]# wget https://github.com/goharbor/harbor/releases/download/v2.15.0/harbor-offline-installer-v2.15.0.tgz
[root@docker-node1 ~]# ls
busy-latest.tar  docker  harbor-offline-installer-v2.15.0.tgz  mario-latest.tar  nginx-1.26.tar  registry.tar

# 解压
[root@docker-node1 ~]# tar zxf harbor-offline-installer-v2.15.0.tgz 
[root@docker-node1 ~]# ls harbor
common.sh  harbor.v2.15.0.tar.gz  harbor.yml.tmpl  install.sh  LICENSE  prepare

[root@docker-node1 ~]# cp -rp harbor /usr/local/

# 准备安装
[root@docker-node1 ~]# cd /usr/local/harbor/
[root@docker-node1 harbor]# docker load -i harbor.v2.15.0.tar.gz
[root@docker-node1 harbor]# docker images
                                                                                                                  i Info →   U  In Use
IMAGE                                   ID             DISK USAGE   CONTENT SIZE   EXTRA
goharbor/harbor-core:v2.15.0            87a862e24da8        210MB             0B        
goharbor/harbor-db:v2.15.0              e66097841983        274MB             0B        
goharbor/harbor-exporter:v2.15.0        13f0dff4f807        112MB             0B        
goharbor/harbor-jobservice:v2.15.0      2fe35692621f        185MB             0B        
goharbor/harbor-log:v2.15.0             9e71d0bc1e73        170MB             0B        
goharbor/harbor-portal:v2.15.0          b3939ccdd07f        166MB             0B        
goharbor/harbor-registryctl:v2.15.0     4b2b3294a46c        166MB             0B        
goharbor/nginx-photon:v2.15.0           77728976f2e8        158MB             0B        
goharbor/prepare:v2.15.0                029f75920a4b        199MB             0B        
goharbor/redis-photon:v2.15.0           4ed296911e8b        173MB             0B        
goharbor/registry-photon:v2.15.0        5b02673a2fa2       87.7MB             0B        
goharbor/trivy-adapter-photon:v2.15.0   e9d91b67c413        408MB             0B

2.2 配置SSL证书

cpp 复制代码

# 创建证书存放目录
[root@docker-node1 ~]# mkdir /etc/docker/certs -p

# 生成key和证书
[root@docker-node1 ~]# mkdir /etc/docker/certs -p
[root@docker-node1 ~]# openssl req -newkey rsa:4096 \
> -nodes -sha256 -keyout /etc/docker/certs/doubledragon.org.key \
> -addext "subjectAltName = DNS:reg.doubledragon.org" \
> -x509 -days 365 -out /etc/docker/certs/doubledragon.org.crt 

Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:shannxi
Locality Name (eg, city) [Default City]:xian
Organization Name (eg, company) [Default Company Ltd]:docker
Organizational Unit Name (eg, section) []:dragon
Common Name (eg, your name or your server's hostname) []:reg.doubledragon.org   # 该处需要与上面指定的域名一致
Email Address []:admin@123

# 查看证书信息
[root@docker-node1 ~]# ls /etc/docker/certs/
doubledragon.org.crt  doubledragon.org.key

# 需要注意的是docker本身是不信任你自己制作的证书的，所以需要将证书放在docker的信任目录中
[root@docker-node1 ~]# mkdir /etc/docker/certs.d/reg.doubledragon.org -p
[root@docker-node1 ~]# cp -p /etc/docker/certs/doubledragon.org.crt /etc/docker/certs.d/reg.doubledragon.org
[root@docker-node1 ~]# systemctl restart docker

2.3 配置harbor.yml

cpp 复制代码

# 复制模板文件
[root@docker-node1 harbor]# cp -p harbor.yml.tmpl harbor.yml
[root@docker-node1 harbor]# vim harbor.yml
# 修改以下内容
hostname: reg.doubledragon.org
  certificate: /etc/docker/certs/doubledragon.org.crt
  private_key: /etc/docker/certs/doubledragon.org.key
harbor_admin_password: 123

2.4 安装harbor

cpp 复制代码

# 预安装检查（检测环境是否满足要求）
[root@docker-node1 harbor]# ./prepare 
prepare base dir is set to /usr/local/harbor
Generated configuration file: /config/portal/nginx.conf
Generated configuration file: /config/log/logrotate.conf
Generated configuration file: /config/log/rsyslog_docker.conf
Generated configuration file: /config/nginx/nginx.conf
Generated configuration file: /config/core/env
Generated configuration file: /config/core/app.conf
Generated configuration file: /config/registry/config.yml
Generated configuration file: /config/registryctl/env
Generated configuration file: /config/registryctl/config.yml
Generated configuration file: /config/db/env
Generated configuration file: /config/jobservice/env
Generated configuration file: /config/jobservice/config.yml
copy /data/secret/tls/harbor_internal_ca.crt to shared trust ca dir as name harbor_internal_ca.crt ...
ca file /hostfs/data/secret/tls/harbor_internal_ca.crt is not exist
copy  to shared trust ca dir as name storage_ca_bundle.crt ...
copy None to shared trust ca dir as name redis_tls_ca.crt ...
loaded secret from file: /data/secret/keys/secretkey
Generated configuration file: /compose_location/docker-compose.yml
Clean up the input dir

# 安装
[root@docker-node1 harbor]# ./install.sh
✔ ----Harbor has been installed and started successfully.----

# 或者使用docker-compose直接启动 docker-compose up -d

2.5 验证安装

cpp 复制代码

# 查看容器状态
[root@docker-node1 harbor]# docker compose ps

# 查看日志
[root@docker-node1 harbor]# docker compose logs -f

# 检查服务端口
[root@docker-node1 harbor]# netstat -anplute | grep -E '80|443|5000'
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      0          36483      3460/docker-proxy   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      0          36476      3433/docker-proxy   
tcp        0      0 127.0.0.1:36748         127.0.0.1:1514          ESTABLISHED 0          37180      1436/dockerd        
tcp        0      0 172.20.0.1:51980        172.20.0.2:10514        ESTABLISHED 0          35453      2864/docker-proxy   
tcp6       0      0 :::443                  :::*                    LISTEN      0          36484      3466/docker-proxy   
tcp6       0      0 :::80                   :::*                    LISTEN      0          36477      3440/docker-proxy

三、harbor仓库的维护管理

3.1 常用命令

cpp 复制代码

# 停止Harbor
docker-compose down

# 启动Harbor
docker-compose up -d

# 重启Harbor
docker-compose restart

# 查看日志
docker-compose logs -f [服务名]

# 进入容器
docker-compose exec [服务名] bash

3.2 备份与恢复

cpp 复制代码

# 备份数据卷
tar -czf harbor-backup-$(date +%F).tar.gz /data

# 备份数据库
docker-compose exec -T database pg_dump -U postgres registry > registry.sql

3.3 升级harbor

cpp 复制代码

# 停止旧版本
docker-compose down

# 备份数据
# ...（见上）

# 解压新版本
tar -zxf harbor-offline-installer-v2.14.0.tgz
cd harbor

# 迁移配置
cp ../harbor.yml .

# 执行升级
./install.sh --upgrade

3.4 上传与拉取镜像

cpp 复制代码

# 记得要配置本地解析
# 登陆
# 打标签
[root@docker-node1 ~]# docker tag busybox:latest reg.doubledragon.org/library/busybox:latest

# 上传
[root@docker-node1 ~]# docker push reg.doubledragon.org/library/busybox:latest 
The push refers to repository [reg.doubledragon.org/library/busybox]
495ba00f2547: Pushed 
latest: digest: sha256:91c66c844e6bba57e92e10e755e73a816d0b99edd17eb5297d9ac519ab3a8c81 size: 527

3.5 网页版管理harbor

浏览器访问reg.doubledragon.org或者IP地址（记得配置本地解析）

可以创建项目，删除项目中的镜像

至此docker私有harbor仓库搭建完毕