【registry】CentOS7.x上|【registry】CentOS7.x上 registry server的安装使用
一、实验背景
当执行 docker pull 的时候，你可能会比较好奇，docker 会去哪儿查找并下载镜像呢？
它实际上是从 registry.hub.docker.com 这个地址去查找，这就是Docker公司为我们提供的公共仓库，上面的镜像，大家都可以看到，也可以使用。所以，我们也可以带上仓库地址去拉取镜像，如：docker pull registry.hub.docker.com/library/alpine，不过要注意，这种方式下载的镜像的默认名称就会长一些。
如果要在公司中使用 Docker，我们基本不可能把商业项目上传到公共仓库中，那如果要多个机器共享，又能怎么办呢？ 正因为这种需要，所以私有仓库也就有用武之地了。 所谓私有仓库，也就是在本地（局域网）搭建的一个类似公共仓库的东西，搭建好之后，我们可以将镜像提交到私有仓库中。这样我们既能使用 Docker 来运行我们的项目镜像，也避免了商业项目暴露出去的风险。
# pingregistry.hub.docker.com
# echo > /dev/tcp/3.224.62.138/80
# echo > /dev/tcp/3.224.62.138/443
# echo> /dev/tcp/registry.hub.docker.com/80
# echo> /dev/tcp/registry.hub.docker.com/443
文章图片
# curl -Ihttp://registry.hub.docker.com
# curl -Ihttps://registry.hub.docker.com
文章图片
# docker search alpine
# docker pullalpine
# docker pull registry.hub.docker.com/library/alpine
# docker images
文章图片
文章图片
二、实验环境
操作系统： CentOS7.5 Minimal
registryServer： 192.168.1.105
registryClient： 192.168.1.102
三、安装docker
在registryServer和registryClient服务器
下载docker二进制安装包
# yum-y installwget
# wgethttps://download.docker.com/linux/static/stable/x86_64/docker-18.06.0-ce.tgz
文章图片
#tar -zxfdocker-18.06.0-ce.tgz
#ll./docker
# cp ./docker/docker*/usr/bin
文章图片
创建docker服务的unit文件
# vim/etc/systemd/system/docker.service
##############################################################
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service
Wants=network-online.target
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd
ExecReload=/bin/kill -s HUP $MAINPID
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
# Uncomment TasksMax if your systemd version supports it.
# Only systemd 226 and above support this version.
#TasksMax=infinity
TimeoutStartSec=0
# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes
# kill only the docker process, not all processes in the cgroup
KillMode=process
# restart the docker process if it exits prematurely
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s
[Install]
WantedBy=multi-user.target
#######################################################
文章图片
启动docker服务，设置开机自启
# systemctl daemon-reload
# systemctl start docker
# systemctlstatus docker
# systemctl enable docker
# dockerinfo
# dockerversion
文章图片
设置镜像加速
#curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io
#systemctl restart docker
四、安装 registry server
拉取docker registry官方镜像
# docker pull registry
# docker run-it --rm registrycat /etc/shells
# docker run-it --rm registrycat /etc/issue
# docker run-it --rm registrysh-c "registry-h"
# docker run-it --rm registrysh-c "registry-v"
文章图片
创建registry server相关目录
#mkdir-p/opt/registry/data
#mkdir-p/opt/registry/config
#mkdir -p/opt/registry/certs
# mnkir-p/opt/registry/auth
文章图片
生产外挂配置文件
# docker run-it--rmregistrysh-c'cat /etc/docker/registry/config.yml'>/opt/registry/config/config.yml
#cat/opt/registry/config/config.yml
文章图片
自建CA，生成自签名证书
##########################################################
# openssl req -x509 \
-nodes \
-newkey rsa:4096 \
-days 3650 \
-sha256 \
-subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=CA/OU=CA/CN=www.ca.com" \
-keyout /opt/registry/certs/ca.key \
-out/opt/registry/certs/ca.crt
# openssl req \
-nodes \
-newkey rsa:4096 \
-sha256 \
-subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=Test/OU=Test/CN=www.registry.com" \
-keyout /opt/registry/certs/registry.key \
-out/opt/registry/certs/registry.csr
echo "
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName=IP:192.168.1.105,DNS:www.registry.com
" > extfile.cnf
# openssl x509 -req \
-days 3650 \
-CAcreateserial \
-CA/opt/registry/certs/ca.crt \
-CAkey /opt/registry/certs/ca.key \
-extfile extfile.cnf \
-in/opt/registry/certs/registry.csr \
-out /opt/registry/certs/registry.crt
#####################################################################
文章图片
#ls -l/opt/registry/certs
文章图片
生成认证用账号密码文件
# docker run--entrypointhtpasswdregistry-BbntestTest@123>/opt/registry/auth/htpasswd
# cat/opt/registry/auth/htpasswd
文章图片
创建服务的service文件
#vim/etc/systemd/system/registry.service
################################################
[Unit]
Description=Registry Server
After=network-online.target docker.service
Requires=docker.service
[Service]
ExecStartPre=-/usr/bin/docker rm -f registry
ExecStart=/usr/bin/docker run \
--name registry \
-v /opt/registry/data:/var/lib/registry \
-v /opt/registry/config/config.yml:/etc/docker/registry/config.yml \
-v /opt/registry/certs:/certs \
-e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \
-v /opt/registry/auth:/auth \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
-p 443:443 \
registry
ExecStop=/usr/bin/docker stop registry
LimitNOFILE=65535
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s
[Install]
WantedBy=multi-user.target
################################################
文章图片
启动服务，设置开机自启
# systemctldaemon-reload
# systemctlstart registry
# systemctlenableregistry
# systemctlstatusregistry
文章图片
# docker ps -a
# docker exec -it registrysh-c"ps aux | grep registry"
# docker exec -it registrysh-c"netstat -anpltu"
文章图片
五、registryClient客户端测试
方式一：通过获取registryServer的CA证书
将服务端证书/opt/registry/certs/ca.crt 拷贝到了客户端的 /etc/pki/ca-trust/source/anchors目录下
在registryClient服务器上
#scproot@192.168.1.105:/opt/registry/certs/ca.crt/etc/pki/ca-trust/source/anchors/
# update-ca-trust
# systemctlrestart docker
文章图片
# cat/etc/pki/ca-trust/source/anchors/ca.crt
# openssl x509 -noout -text-in/etc/pki/ca-trust/source/anchors/ca.crt
文章图片
方式二：不通过CA证书，设置客户端docker信任仓库
# systemctlstatus docker
文章图片
# vim/etc/systemd/system/docker.service
#####################################################
ExecStart=/usr/bin/dockerd--insecure-registry 192.168.1.105:443
######################################################
文章图片
# systemctldaemon-reload
# systemctlrestartdocker
六、登录创建的docker仓库
在registryClient服务器上
测试registryserver上443端口的连通性
# echo> /dev/tcp/192.168.1.105/443
# curl -vhttp://192.168.1.105:443
文章图片
# docker login 192.168.1.105:443-u test-p"Test@123"
# cat /root/.docker/config.json
文章图片
测试镜像的pull/push
# docker pull busybox:latest
# docker tagbusybox:latest192.168.1.105:443/test/busybox:1.0.1-RC1
# docker push 192.168.1.105:443/test/busybox:1.0.1-RC1
文章图片
文章图片
七、参考
registry
https://hub.docker.com/_/registry
https://docs.docker.com/registry/deploying
用registry快速搭建私有镜像仓库
https://blog.51cto.com/ganbing/2080140
用docker registry 镜像搭建私有测试仓库
https://www.jianshu.com/p/7337aa3f227b
用nginx 反向代理docker 私有 registry
https://www.jianshu.com/p/143255035496
x509: cannot validate certificate for xx.xx.xx.xx because it doesn't contain any IP SANs
https://stackoverflow.com/questions/54622879/cannot-validate-certificate-for-ip-address-because-it-doesnt-contain-any-ip-s
x509: certificate signed by unknown authority
https://stackoverflow.com/questions/50768317/docker-pull-certificate-signed-by-unknown-authority
docker registry 私有仓库 安装配置、查询、删除
https://www.cnblogs.com/elvi/p/8384604.html
https://www.cnblogs.com/elvi/p/8384675.html
Docker私有仓库搭建及镜像删除
http://www.louisvv.com/archives/1130.html
docker registry 镜像删除
https://blog.51cto.com/132408/1946401
docker私有仓库删除image
https://blog.51cto.com/302876016/1966816
https://blog.csdn.net/l6807718/article/details/52886546
Docker Registry之删除镜像、垃圾回收
https://blog.csdn.net/u010884123/article/details/56838644
What is the difference between an image and a repository?
https://stackoverflow.com/questions/31115098/what-is-the-difference-between-an-image-and-a-repository
What is the Differences between Docker registry and repository?
https://stackoverflow.com/questions/34004076/difference-between-docker-registry-and-repository
How To Set Up a Private Docker Registry on Ubuntu 18.04？
【【registry】CentOS7.x上|【registry】CentOS7.x上 registry server的安装使用】https://www.digitalocean.com/community/tutorials/how-to-set-up-a-private-docker-registry-on-ubuntu-18-04
推荐阅读
- 宽容谁
- 我要做大厨
- 增长黑客的海盗法则
- 画画吗（）
- 2019-02-13——今天谈梦想（）
- 远去的风筝
- 三十年后的广场舞大爷
- 叙述作文
- 20190302|20190302 复盘翻盘
- 学无止境，人生还很长