基于百度云 BOS 搭建私有 Docker Registry

基于百度云 BOS 搭建私有 Docker Registry

Docker Registry 做为 Docker 的核心组件之一负责了镜像的存储以及分发。用户只须要使用 Docker 的客户端就能够直接和 Registry 进行交互，下载和上传镜像。

百度对象存储 BOS (Baidu Object Storage) 提供稳定、安全、高效以及高扩展存储服务。

Baidu BOS storage driver 基于官方 Docker Registry 源码，结合百度云 Go 语言SDK：https://github.com/guoyao/baidubce-sdk-go.git，经过实现 storagedriver.StorageDriver 接口，提供了一个针对百度云 BOS 的 Storage Driver。

准备工做

• 安装 Docker Engine，如何安装请参考 Docker官方文档

• 下载 Registry 镜像（或者经过源码仓库https://github.com/guoyao/distribution.git 本身 build 一个镜像）

  docker pull guoyao/registry:0.6.0

  由于是从Docker官方Registry下载镜像，速度会比较慢，能够配置国内的镜像加速

• 注册百度云帐号，开通 BOS 服务，在百度云 BOS 控制台新建一个 Bucket，假设 Bucket 名称为 registry-test

• 获取百度云 AK / SK

部署私有 Docker Registry

• 为 Registry 相关的配置新建一个单独的目录

  mkdir registry && cd registry

• 在当前目录下新建咱们的帐户密码（最简单的帐户验证方式）

  mkdir auth
  htpasswd -Bbn admin 123456 > auth/htpasswd

• 启动 Registry

  docker run -d \
             -v `pwd`/auth:/auth:ro \
             -e REGISTRY_AUTH=htpasswd \
             -e REGISTRY_AUTH_HTPASSWD_REALM=basic-realm \
             -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
             -e REGISTRY_STORAGE=bos \
             -e REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK \
             -e REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK \
             -e REGISTRY_STORAGE_BOS_REGION=bj \
             -e REGISTRY_STORAGE_BOS_BUCKET=registry-test \
             -p 5000:5000 \
             --restart=always \
             guoyao/registry:0.6.0

  详细的 BOS STORAGE 的配置文档在这里： https://github.com/guoyao/distribution/blob/release/0.6/docs/storage-drivers/bos.md

• 操做镜像

  Login

  docker login localhost:5000

  根据命令行提示输入以前设置的用户名：admin，密码：123456；登陆成功会提示：Login Succeeded

  Push

  首先经过 Dockerfile 生成一个镜像，或者修改一个已有镜像的 tag，好比：localhost:5000/busybox

  docker push localhost:5000/busybox

  推送成功后就能够在百度云 BOS 控制台查看到这个镜像了

  Pull

  docker pull localhost:5000/busybox

上述方式只能经过 localhost 来 push 和 pull 镜像，若是想经过公网 域名 或 IP，须要配置 --insecure-registry xxx.xxx.xxx.xxx 到 Docker Deamon 的启动参数中，并重启 Docker Deamon，不然会报错：

Error response from daemon: Get https://xxx.xxx.xxx.xxx:5000/v1/users/: http: server gave HTTP response to HTTPS client

经过域名访问 & 配置https证书

若是不但愿配置 --insecure-registry 参数，你须要购买一个独立的域名（假设为 myregistrydomain.com），而且申请该域名的 https 证书，将证书 xxx.crt 和 xxx.key 文件放在当前 certs 子目录下，而后在启动 Registry 时，配置证书：

docker run -d \
           -v `pwd`/auth:/auth:ro \
           -e REGISTRY_AUTH=htpasswd \
           -e REGISTRY_AUTH_HTPASSWD_REALM=basic-realm \
           -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
           -v `pwd`/certs:/certs:ro \
           -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/xxx.crt \
           -e REGISTRY_HTTP_TLS_KEY=/certs/xxx.key \
           -e REGISTRY_STORAGE=bos \
           -e REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK \
           -e REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK \
           -e REGISTRY_STORAGE_BOS_REGION=bj \
           -e REGISTRY_STORAGE_BOS_BUCKET=registry-test \
           -p 443:5000 \
           --restart=always \
           guoyao/registry:0.6.0

既然已经使用 https 证书了，咱们把对外暴露的端口换成 443 端口，而后就能够直接经过域名来操做镜像了：

docker login myregistrydomain.com
docker push myregistrydomain.com/busybox
docker pull myregistrydomain.com/busybox

更多关于部署 Registry 的内容，能够参考官方文档：https://docs.docker.com/registry/deploying/

配置 Nginx 代理访问

由于要启动多个容器，这里咱们使用 docker-compose 来作容器编排，首先安装 docker-compose（须要使用 root 用户来安装），安装方式以下：

curl -L https://github.com/docker/compose/releases/download/1.10.1/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose

chmod +x /usr/local/bin/docker-compose

• 建立 nginx 主配置文件

cat > auth/nginx.conf << 'EOF'
events {
    worker_connections  1024;
}

http {

  upstream docker-registry {
    server registry:5000;
  }

  ## Set a variable to help us decide if we need to add the
  ## 'Docker-Distribution-Api-Version' header.
  ## The registry always sets this header.
  ## In the case of nginx performing auth, the header will be unset
  ## since nginx is auth-ing before proxying.
  map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
    '' 'registry/2.0';
  }

  server {
    listen 443 ssl;
    server_name myregistrydomain.com;

    # SSL
    ssl_certificate /certs/xxx.crt;
    ssl_certificate_key /certs/xxx.key;

    # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    # disable any limits to avoid HTTP 413 for large image uploads
    client_max_body_size 0;

    # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
    chunked_transfer_encoding on;

    location /v2/ {
      # Do not allow connections from docker 1.5 and earlier
      # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
      if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
        return 404;
      }

      # To add basic authentication to v2 use auth_basic setting.
      auth_basic "Registry realm";
      auth_basic_user_file /etc/nginx/conf.d/htpasswd;

      ## If $docker_distribution_api_version is empty, the header will not be added.
      ## See the map directive above where this variable is defined.
      add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;

      proxy_pass                          http://docker-registry;
      proxy_set_header  Host              $http_host;   # required for docker client's sake
      proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
      proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header  X-Forwarded-Proto $scheme;
      proxy_read_timeout                  900;
    }
  }
}
EOF

• 建立 docker-compose.yml 文件

nginx:
  image: nginx:1.9
  ports:
    - 443:443
  links:
    - registry:registry
  volumes:
    - ./auth:/etc/nginx/conf.d:ro
    - ./auth/nginx.conf:/etc/nginx/nginx.conf:ro
    - ./certs:/certs:ro

registry:
  image: guoyao/registry:0.6.0
  environment:
    - REGISTRY_STORAGE=bos
    - REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK
    - REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK
    - REGISTRY_STORAGE_BOS_REGION=bj
    - REGISTRY_STORAGE_BOS_BUCKET=registry-test

• 启动容器

docker-compose up -d

更多关于配置 Nginx 代理访问 Registry 的内容，能够参考官方文档：https://docs.docker.com/registry/recipes/nginx/