【registry】CentOS7.x上|【registry】CentOS7.x上 registry server的安装使用【registry】CentOS7.x上registryser

一、实验背景当执行 docker pull 的时候，你可能会比较好奇，docker 会去哪儿查找并下载镜像呢？
它实际上是从 registry.hub.docker.com 这个地址去查找，这就是Docker公司为我们提供的公共仓库，上面的镜像，大家都可以看到，也可以使用。所以，我们也可以带上仓库地址去拉取镜像，如：docker pull registry.hub.docker.com/library/alpine，不过要注意，这种方式下载的镜像的默认名称就会长一些。

如果要在公司中使用 Docker，我们基本不可能把商业项目上传到公共仓库中，那如果要多个机器共享，又能怎么办呢？正因为这种需要，所以私有仓库也就有用武之地了。所谓私有仓库，也就是在本地（局域网）搭建的一个类似公共仓库的东西，搭建好之后，我们可以将镜像提交到私有仓库中。这样我们既能使用 Docker 来运行我们的项目镜像，也避免了商业项目暴露出去的风险。

# pingregistry.hub.docker.com
# echo > /dev/tcp/3.224.62.138/80
# echo > /dev/tcp/3.224.62.138/443
# echo> /dev/tcp/registry.hub.docker.com/80
# echo> /dev/tcp/registry.hub.docker.com/443

文章图片
# curl -Ihttp://registry.hub.docker.com
# curl -Ihttps://registry.hub.docker.com

文章图片

# docker search alpine
# docker pullalpine
# docker pull registry.hub.docker.com/library/alpine
# docker images

文章图片

文章图片
二、实验环境

操作系统： CentOS7.5 Minimal
registryServer： 192.168.1.105
registryClient： 192.168.1.102

三、安装docker

在registryServer和registryClient服务器

下载docker二进制安装包
# yum-y installwget
# wgethttps://download.docker.com/linux/static/stable/x86_64/docker-18.06.0-ce.tgz

文章图片
#tar -zxfdocker-18.06.0-ce.tgz
#ll./docker
# cp ./docker/docker*/usr/bin

文章图片
创建docker服务的unit文件
# vim/etc/systemd/system/docker.service
##############################################################
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service
Wants=network-online.target
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd
ExecReload=/bin/kill -s HUP $MAINPID
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
# Uncomment TasksMax if your systemd version supports it.
# Only systemd 226 and above support this version.
#TasksMax=infinity
TimeoutStartSec=0
# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes
# kill only the docker process, not all processes in the cgroup
KillMode=process
# restart the docker process if it exits prematurely
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s
[Install]
WantedBy=multi-user.target
#######################################################

文章图片
启动docker服务，设置开机自启
# systemctl daemon-reload
# systemctl start docker
# systemctlstatus docker
# systemctl enable docker
# dockerinfo
# dockerversion

文章图片
设置镜像加速
#curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io
#systemctl restart docker

四、安装 registry server

拉取docker registry官方镜像
# docker pull registry
# docker run-it --rm registrycat /etc/shells
# docker run-it --rm registrycat /etc/issue
# docker run-it --rm registrysh-c "registry-h"
# docker run-it --rm registrysh-c "registry-v"

文章图片
创建registry server相关目录
#mkdir-p/opt/registry/data
#mkdir-p/opt/registry/config
#mkdir -p/opt/registry/certs
# mnkir-p/opt/registry/auth

文章图片
生产外挂配置文件
# docker run-it--rmregistrysh-c'cat /etc/docker/registry/config.yml'>/opt/registry/config/config.yml
#cat/opt/registry/config/config.yml

文章图片
自建CA，生成自签名证书
##########################################################
# openssl req -x509 \

-nodes \
-newkey rsa:4096 \
-days 3650 \
-sha256 \
-subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=CA/OU=CA/CN=www.ca.com" \
-keyout /opt/registry/certs/ca.key \
-out/opt/registry/certs/ca.crt

# openssl req \
-nodes \
-newkey rsa:4096 \
-sha256 \
-subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=Test/OU=Test/CN=www.registry.com" \
-keyout /opt/registry/certs/registry.key \
-out/opt/registry/certs/registry.csr
echo "
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName=IP:192.168.1.105,DNS:www.registry.com
" > extfile.cnf

# openssl x509 -req \
-days 3650 \
-CAcreateserial \
-CA/opt/registry/certs/ca.crt \
-CAkey /opt/registry/certs/ca.key \
-extfile extfile.cnf \
-in/opt/registry/certs/registry.csr \
-out /opt/registry/certs/registry.crt
#####################################################################

文章图片
#ls -l/opt/registry/certs

文章图片
生成认证用账号密码文件
# docker run--entrypointhtpasswdregistry-BbntestTest@123>/opt/registry/auth/htpasswd
# cat/opt/registry/auth/htpasswd

文章图片
创建服务的service文件
#vim/etc/systemd/system/registry.service
################################################
[Unit]
Description=Registry Server
After=network-online.target docker.service
Requires=docker.service
[Service] ExecStartPre=-/usr/bin/docker rm -f registry
ExecStart=/usr/bin/docker run \
--name registry \
-v /opt/registry/data:/var/lib/registry \
-v /opt/registry/config/config.yml:/etc/docker/registry/config.yml \
-v /opt/registry/certs:/certs \
-e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \
-v /opt/registry/auth:/auth \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
-p 443:443 \
registry
ExecStop=/usr/bin/docker stop registry
LimitNOFILE=65535
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s
[Install] WantedBy=multi-user.target
################################################

文章图片
启动服务，设置开机自启
# systemctldaemon-reload
# systemctlstart registry
# systemctlenableregistry
# systemctlstatusregistry

文章图片

# docker ps -a
# docker exec -it registrysh-c"ps aux | grep registry"
# docker exec -it registrysh-c"netstat -anpltu"

文章图片

五、registryClient客户端测试

方式一：通过获取registryServer的CA证书将服务端证书/opt/registry/certs/ca.crt 拷贝到了客户端的 /etc/pki/ca-trust/source/anchors目录下
在registryClient服务器上
#scproot@192.168.1.105:/opt/registry/certs/ca.crt/etc/pki/ca-trust/source/anchors/
# update-ca-trust
# systemctlrestart docker

文章图片
# cat/etc/pki/ca-trust/source/anchors/ca.crt
# openssl x509 -noout -text-in/etc/pki/ca-trust/source/anchors/ca.crt

文章图片

方式二：不通过CA证书，设置客户端docker信任仓库 # systemctlstatus docker

文章图片
# vim/etc/systemd/system/docker.service
#####################################################
ExecStart=/usr/bin/dockerd--insecure-registry 192.168.1.105:443
######################################################

文章图片
# systemctldaemon-reload
# systemctlrestartdocker

六、登录创建的docker仓库

在registryClient服务器上

测试registryserver上443端口的连通性
# echo> /dev/tcp/192.168.1.105/443
# curl -vhttp://192.168.1.105:443

文章图片

# docker login 192.168.1.105:443-u test-p"Test@123"
# cat /root/.docker/config.json

文章图片

测试镜像的pull/push
# docker pull busybox:latest
# docker tagbusybox:latest192.168.1.105:443/test/busybox:1.0.1-RC1
# docker push 192.168.1.105:443/test/busybox:1.0.1-RC1

文章图片

文章图片

七、参考

registry
https://hub.docker.com/_/registry
https://docs.docker.com/registry/deploying

用registry快速搭建私有镜像仓库
https://blog.51cto.com/ganbing/2080140

用docker registry 镜像搭建私有测试仓库
https://www.jianshu.com/p/7337aa3f227b

用nginx 反向代理docker 私有 registry
https://www.jianshu.com/p/143255035496

x509: cannot validate certificate for xx.xx.xx.xx because it doesn't contain any IP SANs
https://stackoverflow.com/questions/54622879/cannot-validate-certificate-for-ip-address-because-it-doesnt-contain-any-ip-s

x509: certificate signed by unknown authority
https://stackoverflow.com/questions/50768317/docker-pull-certificate-signed-by-unknown-authority

docker registry 私有仓库安装配置、查询、删除
https://www.cnblogs.com/elvi/p/8384604.html
https://www.cnblogs.com/elvi/p/8384675.html

Docker私有仓库搭建及镜像删除
http://www.louisvv.com/archives/1130.html

docker registry 镜像删除
https://blog.51cto.com/132408/1946401

docker私有仓库删除image
https://blog.51cto.com/302876016/1966816
https://blog.csdn.net/l6807718/article/details/52886546

Docker Registry之删除镜像、垃圾回收
https://blog.csdn.net/u010884123/article/details/56838644

What is the difference between an image and a repository?
https://stackoverflow.com/questions/31115098/what-is-the-difference-between-an-image-and-a-repository

What is the Differences between Docker registry and repository?
https://stackoverflow.com/questions/34004076/difference-between-docker-registry-and-repository

How To Set Up a Private Docker Registry on Ubuntu 18.04？
【【registry】CentOS7.x上|【registry】CentOS7.x上 registry server的安装使用】https://www.digitalocean.com/community/tutorials/how-to-set-up-a-private-docker-registry-on-ubuntu-18-04

【registry】CentOS7.x上|【registry】CentOS7.x上 registry server的安装使用

推荐阅读

范振华|中国著名康复医学专家范振华逝世：创建中国运动医学与康复医学科

巴彦县商务局|此地紧急通报：这些食品一律不得销售！

戚家刀和苗刀有什么区别？戚家刀真的只开一掌刃吗

mysqlrtrim

0825学习日记|0825学习日记俞慧莉

负债千万,生活到了快崩溃的边缘,哪位贵人指指路？

mysql创建联合主键语句 mysql的联合主键

如何阅读读后感0812

巧诱孩子吃青菜

什么精油可以美白祛斑？地板精油保养地板耐用吗？

帮忙拯救一下旧电脑,怎么升级一下？

八月四号是什么星座八月四号是哪个星座

mysqlbenchmark的简单介绍

何所谓“瘾”

生蚝直接蒸会开囗吗

三星|全球Q1出货量数据曝光！追苹果超三星，OPPO是怎么做到的？

螃蟹常见的养殖方式有哪些螃蟹常见的养殖方式有哪些种类

拼多多怎么退款退货？拼多多退款退货方法【图】

火坩刘明什么意思火坩刘明的来源

寂寥的意思落寞是什么意思