Docker私有仓库搭建

比眉伴天荒 2022-01-11 21:05 322阅读 0赞

由于公有仓库有时连接会出现超时,下载速度慢等情况

故搭建私有仓库镜像

server端可以login官方的Doker Hub，可以pull，push和私有仓库

但client只能操作自己搭建的仓库

server 192.168.127.142

client 192.168.127.128

关闭selinux

setenforce 0

防火墙443端口放行

firewall-cmd --add-port=443/tcp

通过yum安装依赖支持包

yum -y install pcre-devel zlib-devel openssl openssl-devel

pcre在编译nginx时需要

zlib库提供开发人员的压缩算法

vim /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
    ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
    192.168.127.142 gjy.com        添加本地ip和域名

修改主机名

hostnamectl set-hostname gjy.com

bash

系统为centos7.0所以命令不一样

接下来生成根密钥

由于首次配置直接进入目录生成配置文件

cd /etc/pki/CA/
    openssl genrsa -out private/cakey.pem2048

[![wKiom1neUs6BmMeDAAAu5FIhg0c463.png][]][wKiom1neUs6BmMeDAAAu5FIhg0c463.png]

生成根证书

openssl req -new -x509 -key private/cakey.pem -out cacert.pem

[![wKiom1neU5ixjFsCAACRi-VAyx0770.png][]][wKiom1neU5ixjFsCAACRi-VAyx0770.png]

可以选择不填写，但填写后要保持一致

为nginx web服务器生成ssl密钥

mkdir /etc/pki/CA/ssl
    cd /etc/pki/CA/ssl

openssl genrsa -out nginx.key 2048

[![wKiom1neVErS1GP5AAAkMckHjx4617.png][]][wKiom1neVErS1GP5AAAkMckHjx4617.png]

为nginx生成证书签署请求

openssl req -new -key nginx.key -out nginx.csr

[![wKiom1neVRiQo4thAACfSaHte2I613.png][]][wKiom1neVRiQo4thAACfSaHte2I613.png]

这里需要保持一致

私有CA根据请求签发证书

touch /etc/pki/CA/index.txt
    touch /etc/pki/CA/serial
    echo 00 > /etc/pki/CA/serial

[![wKiom1neVciB7iEOAAAKLL4B1fo143.png][]][wKiom1neVciB7iEOAAAKLL4B1fo143.png]

openssl ca -in nginx.csr -out nginx.crt

[![wKioL1nd50Kg4tHcAACbpLhvrzo255.png][]][wKioL1nd50Kg4tHcAACbpLhvrzo255.png]

[![wKioL1nd52eSuc-DAABr7Y-Aq94966.png][]][wKioL1nd52eSuc-DAABr7Y-Aq94966.png]

安装Nginx

groupadd www -g 58
    useradd -u 58 -g www www

wget http://nginx.org/download/nginx-1.11.2.tar.gz

[![wKiom1neVwSy3yUQAAB848Ad1SU299.png][]][wKiom1neVwSy3yUQAAB848Ad1SU299.png]  
直接下载nginx源码包，进行编译安装

./configure--user=www --group=www --prefix=/opt/nginx \
    --with-pcre\
    --with-http_stub_status_module\
    --with-http_ssl_module\
    --with-http_addition_module\
    --with-http_realip_module\
    --with-http_flv_module
    make && make install

成功后编辑配置文件

user  www;
    worker_processes  4;
    events {
    worker_connections  4096;
    }
    http {
    include  mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;
    upstream registry {
    server  192.168.127.142:5000;
        }
    server {
    listen       443 ssl;
    server_name  gjy.com;
    ssl_certificate  /etc/pki/CA/ssl/nginx.crt;
    ssl_certificate_key  /etc/pki/CA/ssl/nginx.key;
    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;
    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;
    location  /  {
    proxy_pass  http://registry;
    client_max_body_size    3000m;
    proxy_set_header  Host  $host; 
    proxy_set_header  X-Forward-For  $remote_addr;
    }
    }
    }

启动nginx

/opt/nginx/sbin/nginx

配置Docker

停止Docker，编辑/etc/sysconfig/docker加入

DOCKER_OPTS="--insecure-registry docker.benet.com --tlsverify --tlscacert /etc/pki/CA/cacert.pem"

[![wKioL1nd6X6BLztyAACci18-7PM348.png][]][wKioL1nd6X6BLztyAACci18-7PM348.png]

复制根证书

mkdir -p /etc/docker/certs.d/docker.benet.com
    cp /etc/pki/CA/cacert.pem /etc/docker/certs.d/docker.benet.com/ca-certificates.crt

启动Docker

systemctl start docker

直接导入registry运行

[![wKioL1nd7i2zhqt1AACEkCc8TD0172.png][]][wKioL1nd7i2zhqt1AACEkCc8TD0172.png]

创建目录作为私有仓库位置

mkdir -p /opt/data/registry

运行容器

docker run -d -p 5000:5000 -v /opt/data/registry:/tmp/registry -e GUNICORN_OPTS=["--preload"] docker.io/registry

[![wKiom1neXl7T\_4apAABJvAAuuFE082.png][wKiom1neXl7T_4apAABJvAAuuFE082.png]][wKiom1neXl7T_4apAABJvAAuuFE082.png]

通过curl验证

curl -i -k https：//gjy.com

[![wKioL1nd8AjC7pjZAAAxlnkAICo527.png][]][wKioL1nd8AjC7pjZAAAxlnkAICo527.png]

client配置

本地hosts文件需要添加服务器的解析

[![wKioL1nd8QyyGbXdAAAUGOCPA-w748.png][]][wKioL1nd8QyyGbXdAAAUGOCPA-w748.png]

把 docker registry 服务器端的根证书追加到 certificates.crt 文件

scp root@192.168.127.142:/etc/pki/CA/cacert.pem ./

[![wKioL1nd8snjE1MoAABIgSd4QIc955.png][]][wKioL1nd8snjE1MoAABIgSd4QIc955.png]

cacat ./cacert.pem>> /etc/pki/tls/certs/ca-certificates.crt

测试能否访问

curl -i -k https：//gjy.com

[![wKiom1neY5HQGSxOAAAxPF1GwXU370.png][]][wKiom1neY5HQGSxOAAAxPF1GwXU370.png]

查看仓库是否有镜像

curl 192.168.127.142：5000/v1/search

所有build，pull，push只能在私有仓库的server操作，降低风险

server，client都可以上传下载

可以更加快速方便的上传下载镜像，不受网络影响

转载于:https://blog.51cto.com/jianyu97/1971513

[wKiom1neUs6BmMeDAAAu5FIhg0c463.png]: https://s1.51cto.com/wyfs02/M00/08/3D/wKiom1neUs6BmMeDAAAu5FIhg0c463.png
[wKiom1neU5ixjFsCAACRi-VAyx0770.png]: /images/20220110/dfa025497d5042e38019514b21d14d29.png
[wKiom1neVErS1GP5AAAkMckHjx4617.png]: /images/20220110/657fa00141544c46b6c61c7b68868060.png
[wKiom1neVRiQo4thAACfSaHte2I613.png]: /images/20220110/2c6c0515ce5f43fcb67298e5ccdf5705.png
[wKiom1neVciB7iEOAAAKLL4B1fo143.png]: /images/20220110/d5b5982a62554b059ce8fb1a29d5ffd0.png
[wKioL1nd50Kg4tHcAACbpLhvrzo255.png]: /images/20220110/4505673fa13e4f468b862754856dc1be.png
[wKioL1nd52eSuc-DAABr7Y-Aq94966.png]: /images/20220110/06258271c4b74c429d381d1a7dda1aa7.png
[wKiom1neVwSy3yUQAAB848Ad1SU299.png]: /images/20220110/8cc9fb3a712449098ddb483dce9e4e7c.png
[wKioL1nd6X6BLztyAACci18-7PM348.png]: https://s1.51cto.com/wyfs02/M00/A6/F0/wKioL1nd6X6BLztyAACci18-7PM348.png
[wKioL1nd7i2zhqt1AACEkCc8TD0172.png]: /images/20220110/8aa7614eab10400f9696c9b1cfc277ba.png
[wKiom1neXl7T_4apAABJvAAuuFE082.png]: https://s1.51cto.com/wyfs02/M00/08/3E/wKiom1neXl7T_4apAABJvAAuuFE082.png
[wKioL1nd8AjC7pjZAAAxlnkAICo527.png]: /images/20220110/1bbaa48819e14df3a7bea97f0a60c3bd.png
[wKioL1nd8QyyGbXdAAAUGOCPA-w748.png]: /images/20220110/487057974e274538b92f80b75158cea7.png
[wKioL1nd8snjE1MoAABIgSd4QIc955.png]: /images/20220110/5538ae5a78834bb29c16e493cb301049.png
[wKiom1neY5HQGSxOAAAxPF1GwXU370.png]: /images/20220110/02517929c1194c48addefadbe952d885.png