2021年7月1日 (四) 13:32的版本

1 高级之Harbor
2 初入门
3 使用Docker Registry
- 3.1 docker 运行
4 配置SSL证书及nginx反向代理docker registry
- 4.1 SSL证书生成
  - 4.1.1 配置nginx反向代理docker registry
  - 4.1.2 registry usage
- 4.2 client
5 trouble
- 5.1 docker push unknown blob received unexpected HTTP status: 502 Bad Gateway
6 see also
- 6.1 other
7 changelog

高级之Harbor

安装Harbor1.4.0开源docker镜像仓库（含letsencrypt证书

https://blog.51cto.com/u_13043516/2365284

初入门

docker run -d -p 5000:5000 --restart=always --name registry -v /opt/registry:/var/lib/registry registry:2

93602b4311e2        k8s.gcr.io/pause:3.1   "/pause"

commit 将一个容器提交成镜像 和指定tag
root@k8s-node1:~# docker commit 93602b4311e2  192.168.88.59:5000/mypause:v1
335sha256:0937ae67cb675168c23ede1e15408d19d235112a892f1c095c33404f50c9bf9f

docker push 192.168.88.59:5000/mypause:v1

使用Docker Registry

docker 运行

如何 docker-compose

info   Registry server 192.168.88.52

mkdir  /data/registry
#指定目录比指定配置文件更加重要
 docker run -d \
  -p 5000:5000 \
  --restart=always \
  --name registry \
  -v /data/registry:/var/lib/registry \
  registry:2



docker  images 
REPOSITORY              TAG                 IMAGE ID            CREATED             SIZE
php                     7.1-fpm-alpine      cbfebc795f0b        4 weeks ago         70.1MB

docker tag php:7.1-fpm-alpine  192.168.88.52:5000/php

[root@localhost ~]# docker push 192.168.88.52:5000/php
The push refers to repository [192.168.88.52:5000/php]
Get https://192.168.88.52:5000/v2/: http: server gave HTTP response to HTTPS client

vi  /etc/docker/daemon.json
{ "insecure-registries":["192.168.88.52:5000"] }

systemctl restart docker

#再次push成功
docker push 192.168.88.52:5000/php

配置SSL证书及nginx反向代理docker registry

SSL证书生成



搭建私有CA，初始化CA环境，在/etc/pki/CA/下建立证书索引数据库文件index.txt和序列号文件serial，并为证书序列号文件提供初始值。
# touch /etc/pki/CA/{index.txt,serial}
# echo 01 > /etc/pki/CA/serial


生成密钥并保存到/etc/pki/CA/private/cakey.pem
# (umask 077;openssl genrsa -out  /etc/pki/CA/private/cakey.pem 2048)

生成根证书
# openssl req -new -x509 -key  /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3650


需要填写的信息：

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing  
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:hub
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:hub.com
Email Address []:[email protected]


使系统信任根证书
cat /etc/pki/CA/cacert.pem >> /etc/pki/tls/certs/ca-bundle.crt

安装nginx
yum install  openssl模块已有


签发证书
创建ssl目录用来存放密钥文件和证书申请文件

mkdir /app/nginx/conf/ssl

创建密钥文件和证书申请文件
(umask 077;openssl genrsa -out /app/nginx/conf/ssl/docker.key 2048)
openssl req -new -key /app/nginx/conf/ssl/docker.key -out /app/nginx/conf/ssl/docker.csr


填写的申请信息前四项要和私有CA的信息一致

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:hub
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:hub.com
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: #直接回车
An optional company name []:


签署，证书
openssl ca -in /app/nginx/conf/ssl/docker.csr -out /app/nginx/conf/ssl/docker.crt -days 3650

output 省
Certificate is to be certified until Jun 30 02:55:22 2029 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

配置nginx反向代理docker registry

添加认证
yum -y install httpd-tools

#docker-registry.htpasswd 文件看nginx 的配置文件便可知
htpasswd  -c /etc/nginx/conf.d/docker-registry.htpasswd test
New password: 
Re-type new password: 
Adding password for user test


[root@localhost conf.d]# cat  docker-registry.conf

upstream docker-registry {
        server 127.0.0.1:5000;
    }
server {
    listen 80;
    server_name hub.com;
    return  301 https://$server_name$request_uri; 
} 
    server {
        listen       443;
        server_name  hub.com;
        #charset koi8-r;
 
        #access_log  logs/host.access.log  main;
        ssl                   on;
        ssl_certificate       /app/nginx/conf/ssl/docker.crt;
        ssl_certificate_key   /app/nginx/conf/ssl/docker.key;

        chunked_transfer_encoding on;

            proxy_set_header        X-Forwarded-Proto "https";
                    client_max_body_size 1G;
                    proxy_connect_timeout 3000;
                    proxy_send_timeout 3000;
                    proxy_read_timeout 3000;
                    proxy_buffering    off;
                    tcp_nodelay        on;


        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always;
 
        location / {
           auth_basic   "Docker registry";
               auth_basic_user_file /etc/nginx/conf.d/docker-registry.htpasswd;
               proxy_pass  http://docker-registry;
        }
        location /_ping{
               auth_basic off;
               proxy_pass  http://docker-registry;
               }
        location /v2/_ping{
               auth_basic off;
               proxy_pass  http://docker-registry;
        }
}


systemctl  restart nginx

registry usage

如果没有DNS解析内网域名，修改hosts文件
cat >>/etc/hosts <<EOF
192.168.88.52 hub.com
EOF

systemctl daemon-reload 
systemctl restart docker

登录
[root@localhost conf.d]#  docker login hub.com
Username: test
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

把一个容器提交为images 
[root@localhost conf.d]# docker  ps 
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
6d5f17124090        registry:2          "/entrypoint.sh /etc…"   2 hours ago         Up 20 minutes       0.0.0.0:5000->5000/tcp   registry
[root@localhost conf.d]# docker commit 6d5f17124090 hub.com/registry:v2
sha256:d7af5d03593d7f60903dc9da2b9a4d1d0a1a70878e0a7a09423372261cb4fccb
[root@localhost conf.d]# docker push hub.com/registry:v2
The push refers to repository [hub.com/registry]

上传镜像

 docker tag  nginx hub.com/nginx
 docker push  hub.com/nginx

查看
curl -u test:test https://hub.com/v2/_catalog
{"repositories":["httpd","nginx","php"]}

client

局域网内其他机器认证（192.168.88.60 ubuntu

其它机器
cat >>/etc/hosts <<EOF
192.168.88.52 hub.com
EOF

把CA的密钥发送到客户机，并添加到ca-bundle.crt

on 60 
mkdir -p /etc/pki/tls/certs/

on 52 
 scp -p /etc/pki/tls/certs/ca-bundle.crt  [email protected]:/etc/pki/tls/certs/ca-bundle.crt
 scp -p /etc/pki/CA/cacert.pem [email protected]:/etc/pki/CA/cacert.pem

#on 60
 cat /etc/pki/CA/cacert.pem >> /etc/pki/tls/certs/ca-bundle.crt
重启docker
systemctl  restart  docker

trouble

问题

[root@localhost conf.d]# docker login hub.com
Username: test
Password: 
Error response from daemon: login attempt to https://hub.com/v2/ failed with status: 404 Not Found

host 搞错 要前面是ip 后面是域名


一开始注释了ssl证书
Username: test
Password: 
Error response from daemon: Get https://hub.com/v2/: http: server gave HTTP response to HTTPS client

ssl err 


#on ubuntu 
root@k8s-node2:~# docker login  hub.com
Username: test
Password: 
Error response from daemon: Get https://hub.com/v2/: x509: certificate signed by unknown authority

 cat /etc/docker/daemon.json
{
  "insecure-registries" : ["hub.com"]
}

systemctl  restart docker

docker push unknown blob received unexpected HTTP status: 502 Bad Gateway

docker  push hub.com/httpd:2.4.16
最后老是
unknown blob

nginx 配置文件问题？

received unexpected HTTP status: 502 Bad Gateway

解决办法 在nginx.conf add 
 proxy_set_header        X-Forwarded-Proto "https";
                    client_max_body_size 1G;
                    proxy_connect_timeout 3000;
                    proxy_send_timeout 3000;
                    proxy_read_timeout 3000;
                    proxy_buffering    off;
                    tcp_nodelay        on;




proxy_set_header Host $host;
        proxy_set_header X-Real-IP       $remote_addr;
        proxy_set_header X-Forwarded-For  $proxy_add_x_forwarded_for;

changelog

2019年 07月 03日星期三 16:23:35 CST 添加ssl

@@ 第1行： / 第1行： @@
 =高级之Harbor=
 [https://www.cnblogs.com/bytefish/p/8452190.html 安装Harbor1.4.0开源docker镜像仓库（含letsencrypt证书]
+https://blog.51cto.com/u_13043516/2365284
 =初入门=
 <pre>

“部署私有Docker私有镜像仓库 harbor Registry-Docker”的版本间的差异

2021年7月1日 (四) 13:32的版本

目录

高级之Harbor

初入门

使用Docker Registry

docker 运行

配置SSL证书及nginx反向代理docker registry

SSL证书生成

配置nginx反向代理docker registry

registry usage

client

trouble

docker push unknown blob received unexpected HTTP status: 502 Bad Gateway

see also

other

changelog

导航菜单

个人工具

名字空间

变种

视图

更多

搜索

导航

我的导航

工具