一、實驗背景

當執行 docker pull 的時候，你可能會比較好奇，docker 會去哪兒查找并下載下傳鏡像呢？

它實際上是從 registry.hub.docker.com 這個位址去查找，這就是Docker公司為我們提供的公共倉庫，上面的鏡像，大家都可以看到，也可以使用。是以，我們也可以帶上倉庫位址去拉取鏡像，如：docker pull registry.hub.docker.com/library/alpine，不過要注意，這種方式下載下傳的鏡像的預設名稱就會長一些。

如果要在公司中使用 Docker，我們基本不可能把商業項目上傳到公共倉庫中，那如果要多個機器共享，又能怎麼辦呢？正因為這種需要，是以私有倉庫也就有用武之地了。所謂私有倉庫，也就是在本地（區域網路）搭建的一個類似公共倉庫的東西，搭建好之後，我們可以将鏡像送出到私有倉庫中。這樣我們既能使用 Docker 來運作我們的項目鏡像，也避免了商業項目暴露出去的風險。

# ping registry.hub.docker.com

# echo > /dev/tcp/3.224.62.138/80

# echo > /dev/tcp/3.224.62.138/443

# echo > /dev/tcp/registry.hub.docker.com/80

# echo > /dev/tcp/registry.hub.docker.com/443

【registry】CentOS7.x上 registry server的安裝使用一、實驗背景二、實驗環境三、安裝docker四、安裝 registry server五、registryClient用戶端測試六、登入建立的docker倉庫七、參考

# curl -I http://registry.hub.docker.com

# curl -I https://registry.hub.docker.com

# docker search alpine

# docker pull alpine

# docker pull registry.hub.docker.com/library/alpine

# docker images

二、實驗環境

作業系統： CentOS7.5 Minimal

registryServer： 192.168.1.105

registryClient： 192.168.1.102

三、安裝docker

在registryServer和registryClient伺服器

下載下傳docker二進制安裝包

# yum -y install wget

# wget https://download.docker.com/linux/static/stable/x86_64/docker-18.06.0-ce.tgz

# tar -zxf docker-18.06.0-ce.tgz

# ll ./docker

# cp ./docker/docker* /usr/bin

建立docker服務的unit檔案

# vim /etc/systemd/system/docker.service

##############################################################

[Unit]

Description=Docker Application Container Engine

Documentation=https://docs.docker.com

After=network-online.target firewalld.service

Wants=network-online.target

[Service]

Type=notify

# the default is not to use systemd for cgroups because the delegate issues still

# exists and systemd currently does not support the cgroup feature set required

# for containers run by docker

ExecStart=/usr/bin/dockerd

ExecReload=/bin/kill -s HUP $MAINPID

# Having non-zero Limit*s causes performance problems due to accounting overhead

# in the kernel. We recommend using cgroups to do container-local accounting.

LimitNOFILE=infinity

LimitNPROC=infinity

LimitCORE=infinity

# Uncomment TasksMax if your systemd version supports it.

# Only systemd 226 and above support this version.

#TasksMax=infinity

TimeoutStartSec=0

# set delegate yes so that systemd does not reset the cgroups of docker containers

Delegate=yes

# kill only the docker process, not all processes in the cgroup

KillMode=process

# restart the docker process if it exits prematurely

Restart=on-failure

StartLimitBurst=3

StartLimitInterval=60s

[Install]

WantedBy=multi-user.target

#######################################################

啟動docker服務，設定開機自啟

# systemctl daemon-reload

# systemctl start docker

# systemctl status docker

# systemctl enable docker

# docker info

# docker version

設定鏡像加速

# curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io

# systemctl restart docker

四、安裝 registry server

拉取docker registry官方鏡像

# docker pull registry

# docker run -it --rm registry cat /etc/shells

# docker run -it --rm registry cat /etc/issue

# docker run -it --rm registry sh -c "registry -h"

# docker run -it --rm registry sh -c "registry -v"

建立registry server相關目錄

# mkdir -p /opt/registry/data

# mkdir -p /opt/registry/config

# mkdir -p /opt/registry/certs

# mnkir -p /opt/registry/auth

生産外挂配置檔案

# docker run -it --rm registry sh -c 'cat /etc/docker/registry/config.yml' > /opt/registry/config/config.yml

# cat /opt/registry/config/config.yml

自建CA，生成自簽名證書

##########################################################

# openssl req -x509 \

-nodes \

-newkey rsa:4096 \

-days 3650 \

-sha256 \

-subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=CA/OU=CA/CN=www.ca.com" \

-keyout /opt/registry/certs/ca.key \

-out /opt/registry/certs/ca.crt

# openssl req \

-nodes \

-newkey rsa:4096 \

-sha256 \

-subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=Test/OU=Test/CN=www.registry.com" \

-keyout /opt/registry/certs/registry.key \

-out /opt/registry/certs/registry.csr

echo "

authorityKeyIdentifier=keyid,issuer

basicConstraints=CA:FALSE

keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment

subjectAltName=IP:192.168.1.105,DNS:www.registry.com

" > extfile.cnf

# openssl x509 -req \

-days 3650 \

-CAcreateserial \

-CA /opt/registry/certs/ca.crt \

-CAkey /opt/registry/certs/ca.key \

-extfile extfile.cnf \

-in /opt/registry/certs/registry.csr \

-out /opt/registry/certs/registry.crt

#####################################################################

# ls -l /opt/registry/certs

生成認證用賬号密碼檔案

# docker run --entrypoint htpasswd registry -Bbn test [email protected] > /opt/registry/auth/htpasswd

# cat /opt/registry/auth/htpasswd

建立服務的service檔案

# vim /etc/systemd/system/registry.service

################################################

[Unit]

Description=Registry Server

After=network-online.target docker.service

Requires=docker.service

[Service]

ExecStartPre=-/usr/bin/docker rm -f registry

ExecStart=/usr/bin/docker run \

--name registry \

-v /opt/registry/data:/var/lib/registry \

-v /opt/registry/config/config.yml:/etc/docker/registry/config.yml \

-v /opt/registry/certs:/certs \

-e REGISTRY_HTTP_ADDR=0.0.0.0:443 \

-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \

-e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \

-v /opt/registry/auth:/auth \

-e "REGISTRY_AUTH=htpasswd" \

-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \

-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \

-p 443:443 \

registry

ExecStop=/usr/bin/docker stop registry

LimitNOFILE=65535

Restart=on-failure

StartLimitBurst=3

StartLimitInterval=60s

[Install]

WantedBy=multi-user.target

################################################

啟動服務，設定開機自啟

# systemctl daemon-reload

# systemctl start registry

# systemctl enable registry

# systemctl status registry

# docker ps -a

# docker exec -it registry sh -c "ps aux | grep registry"

# docker exec -it registry sh -c "netstat -anpltu"

五、registryClient用戶端測試

方式一：通過擷取registryServer的CA憑證

将服務端證書/opt/registry/certs/ca.crt 拷貝到了用戶端的 /etc/pki/ca-trust/source/anchors目錄下

在registryClient伺服器上

# scp [email protected]:/opt/registry/certs/ca.crt /etc/pki/ca-trust/source/anchors/

# update-ca-trust

# systemctl restart docker

# cat /etc/pki/ca-trust/source/anchors/ca.crt

# openssl x509 -noout -text -in /etc/pki/ca-trust/source/anchors/ca.crt

方式二：不通過CA憑證，設定用戶端docker信任倉庫

# systemctl status docker

# vim /etc/systemd/system/docker.service

#####################################################

ExecStart=/usr/bin/dockerd --insecure-rehistry 192.168.1.105:443

######################################################

# systemctl daemon-reload

# systemctl restart docker

六、登入建立的docker倉庫

在registryClient伺服器上

測試registryserver上443端口的連通性

# echo > /dev/tcp/192.168.1.105/443

# curl -v http://192.168.1.105:443

# docker login 192.168.1.105:443 -u test -p "[email protected]"

# cat /root/.docker/config.json

測試鏡像的pull/push

# docker pull busybox:latest

# docker tag busybox:latest 192.168.1.105:443/test/busybox:1.0.1-RC1

# docker push 192.168.1.105:443/test/busybox:1.0.1-RC1

七、參考

registry

https://hub.docker.com/_/registry

https://docs.docker.com/registry/deploying

用registry快速搭建私有鏡像倉庫

https://blog.51cto.com/ganbing/2080140

用docker registry 鏡像搭建私有測試倉庫

https://www.jianshu.com/p/7337aa3f227b

用nginx 反向代理docker 私有 registry

https://www.jianshu.com/p/143255035496

x509: cannot validate certificate for xx.xx.xx.xx because it doesn't contain any IP SANs

https://stackoverflow.com/questions/54622879/cannot-validate-certificate-for-ip-address-because-it-doesnt-contain-any-ip-s

x509: certificate signed by unknown authority

https://stackoverflow.com/questions/50768317/docker-pull-certificate-signed-by-unknown-authority

docker registry 私有倉庫安裝配置、查詢、删除

https://www.cnblogs.com/elvi/p/8384604.html

https://www.cnblogs.com/elvi/p/8384675.html

Docker私有倉庫搭建及鏡像删除

http://www.louisvv.com/archives/1130.html

docker registry 鏡像删除

https://blog.51cto.com/132408/1946401

docker私有倉庫删除image

https://blog.51cto.com/302876016/1966816

https://blog.csdn.net/l6807718/article/details/52886546

Docker Registry之删除鏡像、垃圾回收

https://blog.csdn.net/u010884123/article/details/56838644

What is the difference between an image and a repository?

https://stackoverflow.com/questions/31115098/what-is-the-difference-between-an-image-and-a-repository

What is the Differences between Docker registry and repository?

https://stackoverflow.com/questions/34004076/difference-between-docker-registry-and-repository

How To Set Up a Private Docker Registry on Ubuntu 18.04？

https://www.digitalocean.com/community/tutorials/how-to-set-up-a-private-docker-registry-on-ubuntu-18-04

【registry】CentOS7.x上 registry server的安裝使用一、實驗背景二、實驗環境三、安裝docker四、安裝 registry server五、registryClient用戶端測試六、登入建立的docker倉庫七、參考

一、實驗背景

二、實驗環境

三、安裝docker

四、安裝 registry server

五、registryClient用戶端測試

六、登入建立的docker倉庫

七、參考

繼續閱讀

docker實戰--部署一個spring boot微服務

如何利用Docker來部署一個go web應用程式

Docker docker部署以及運作你的第一個容器

Docker-compose 進行Doris自動化編排部署

錯誤:the input device is not a TTY

docker run mysql 報錯：ERROR 2002 (HY000)

RedHat8線上安裝docker

使用kubeadm+calico部署kubernetes v1.25.3

雲虛拟主機進入容器時代

Docker安裝和部署WeCenter3.3.5開源問答平台

docker容器網絡配置docker容器網絡配置

因overlay2檔案夾占用過大而引起的docker資料遷移之戰（上）前言正文

Docker - Dockerfile之ADD、COPY、WORKDIR、USER、EXPOSE指令詳解

(SpringBoot)日志種類：log、monitor、access、out、gc、backup

CentOS 7,docker安裝

【Docker】端口映射問題操作步驟