Docker 私有仓库部署：Registry、加密传输与认证鉴权

bash 复制代码

[root@server1 new]# cd /etc/docker/
[root@server1 docker]# ls
[root@server1 docker]# vim daemon.json
{
  "registry-mirrors": ["https://docker.1ms.run"]
}

[root@server1 docker]# systemctl restart docker
[root@server1 docker]# docker info

[root@server1 docker]# docker pull registry

bash 复制代码

#运行registry仓库
[root@server1 docker]# cd
[root@server1 ~]# docker run -d --name registry -p 5000:5000 -v /opt/registry:/var/lib/registry registry
5e06a869e893ee177e57cd77b00e54664d528f257b3767b8ab3aa83a7255fb29

#列出容器
[root@server1 ~]# docker ps
CONTAINER ID   IMAGE      COMMAND                  CREATED              STATUS              PORTS                                       NAMES
5e06a869e893   registry   "/entrypoint.sh /etc..."   About a minute ago   Up About a minute   0.0.0.0:5000->5000/tcp, :::5000->5000/tcp   registry

#上传镜像
[root@server1 ~]# docker images webserver
[root@server1 ~]# docker tag webserver:v4 localhost:5000/webserver:v4
[root@server1 ~]# docker push localhost:5000/webserver:v4
[root@server1 ~]# docker tag busybox:latest localhost:5000/busybox:latest
[root@server1 ~]# docker push localhost:5000/busybox:latest

#下载镜像
[root@server1 ~]# docker pull localhost:5000/busybox:latest
latest: Pulling from busybox
Digest: sha256:92b1d1cae5f235812184415e63d9b24464116c58d3ba3c460b1eb0247f0f46e3
Status: Image is up to date for localhost:5000/busybox:latest
localhost:5000/busybox:latest
因为本地已经有该镜像，所以本次下载其实并没有真正下载

bash 复制代码

[root@server1 ~]# vim /etc/systemd/system/registry.service
[Unit]
Description=Registry
Requires=docker.service
After=docker.service

[Service]
Type=simple
Restart=always
ExecStart=/usr/bin/docker start -a registry
ExecStop=/usr/bin/docker stop registry

[Install]
WantedBy=multi-user.target

#刷新配置
[root@server1 ~]# systemctl daemon-reload

#停止容器
[root@server1 ~]# docker stop registry
registry
[root@server1 ~]# docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

#设置开机自启
[root@server1 ~]# systemctl enable --now registry
[root@server1 ~]# docker ps
CONTAINER ID   IMAGE      COMMAND                  CREATED          STATUS          PORTS                                       NAMES
5e06a869e893   registry   "/entrypoint.sh /etc..."   12 minutes ago   Up 40 seconds   0.0.0.0:5000->5000/tcp, :::5000->5000/tcp   registry

bash 复制代码

[root@server1 ~]# wget -O /etc/yum.repos.d/epel.repo https://mirrors.aliyun.com/repo/epel-7.repo
[root@server1 ~]# yum repolist
[root@server1 ~]# yum install -y openssl11

bash 复制代码

[root@server1 ~]# systemctl disable --now registry
[root@server1 ~]# docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
[root@server1 ~]# docker rm registry
registry

bash 复制代码

[root@server1 ~]# vim /etc/hosts
192.168.117.130 server1 reg.westos.org
[root@server1 ~]# mkdir certs
[root@server1 ~]# openssl11 req -newkey rsa:4096 -nodes -sha256 -keyout certs/westos.org.key -addext "subjectAltName = DNS:reg.westos.org" -x509 -days 365 -out certs/westos.org.crt

bash 复制代码

[root@server1 ~]# docker run -d -p 443:443 --restart=always --name registry -v /registry:/var/lib/registry -v /root/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key registry
[root@server1 ~]# docker ps
CONTAINER ID   IMAGE      COMMAND                  CREATED          STATUS          PORTS                                             NAMES
5510da9a1241   registry   "/entrypoint.sh /etc..."   29 seconds ago   Up 27 seconds   0.0.0.0:443->443/tcp, :::443->443/tcp, 5000/tcp   registry

bash 复制代码

[root@server1 ~]# docker tag nginx:latest reg.westos.org/nginx:latest
[root@server1 ~]# docker push reg.westos.org/nginx:latest

bash 复制代码

[root@server1 ~]# mkdir -p /etc/docker/certs.d/reg.westos.org/
[root@server1 ~]# cp /root/certs/westos.org.crt /etc/docker/certs.d/reg.westos.org/ca.crt
[root@server1 ~]# docker push reg.westos.org/nginx:latest

[root@server1 ~]# cd /etc/docker/certs.d/reg.westos.org/
[root@server1 reg.westos.org]# curl -k https://reg.westos.org/v2/_catalog

bash 复制代码

[root@server1 ~]# yum install -y httpd-tools
[root@server1 ~]# mkdir auth
[root@server1 ~]# htpasswd -Bc auth/htpasswd admin
New password:
Re-type new password:
Adding password for user admin

#第二次添加不要加"-c"选项，不然会覆盖
[root@server1 ~]# htpasswd -B auth/htpasswd wxh
New password:
Re-type new password:
Adding password for user wxh

[root@server1 ~]# cat auth/htpasswd
admin:$2y$05$rd1p8MRLXW54F8hkChexeOYRai8mBV8rMikYB9KIks2I0bZKhhOTa
wxh:$2y$05$Klh1mermUwJQrH.C1f1h2.fXgIlN6bN8Go5yAyMJ6MuG8Wz9F6SD2

#删除registry，重建
[root@server1 ~]# docker rm -f registry
[root@server1 ~]# docker run -d -p 443:443 --restart=always --name registry -v /registry:/var/lib/registry -v /root/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -v /root/auth:/auth -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry

#登录仓库，不然无法上传下载
[root@server1 ~]# docker login reg.westos.org
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
[root@server1 ~]# cat .docker/config.json
{
        "auths": {
                "reg.westos.org": {
                        "auth": "YWRtaW46d2VzdG9z"
                }
        }
}

#验证
[root@server1 ~]# docker tag busybox:latest reg.westos.org/busybox:latest
[root@server1 ~]# docker push reg.westos.org/busybox:latest

[root@server1 ~]# curl -k https://reg.westos.org/v2/_catalog  -u admin:westos
{"repositories":["busybox","nginx"]}

#登出
[root@server1 ~]# docker logout reg.westos.org

Docker 私有仓库部署：Registry、加密传输与认证鉴权

文章目录

Docker仓库

registry私有仓库

仓库加密

仓库认证