docker 建立私有仓库

时间 2019-11-16

原文原文链接

卸载旧版本

sudo yum remove docker \
                  docker-client \
                  docker-client-latest \
                  docker-common \
                  docker-latest \
                  docker-latest-logrotate \
                  docker-logrotate \
                  docker-engine

安装 Docker Engine-Community

使用 Docker 仓库进行安装

设置仓库

sudo yum install -y yum-utils \
  device-mapper-persistent-data \
  lvm2

设置稳定的仓库

sudo yum-config-manager \
    --add-repo \
    https://download.docker.com/linux/centos/docker-ce.repo

安装 Docker Engine-Community

sudo yum install docker-ce docker-ce-cli containerd.io

启动 Docker

sudo systemctl start docker

启动 hello-world 验证 docker 是否安装成功

sudo docker run hello-world

参考连接：
CentOS Debian 安装html

安装 docker-compose

查看 pip 是否有按照

pip -V

没有安装 pip，安装 pip

yum -y install epel-release
yum -y install python-pip

升级 pip

pip install --upgrade pip

安装 docker-compose

pip install docker-compose

参考连接：
CentOS7下安装Docker-Composepython

设置阿里云仓库地址

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://m3kj4rry.mirror.aliyuncs.com"]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

设置私有仓库

拉取 registry 镜像

docker pull registry

mkdir /usr/local/csp_registry

启动 registry

docker run -d -p 5000:5000 --name=csp_registry --restart=always --privileged=true  -v /usr/local/docker_registry:/var/lib/registry  registry

解释：
-p 5000:5000 端口
--name=csp_registry 运行的容器名称
--restart=always 自动重启
--privileged=true centos7中的安全模块selinux把权限禁止了，加上这行是给容器增长执行权限
-v /usr/local/docker_registry:/var/lib/registry 把主机的/usr/local/docker_registry 目录挂载到registry容器的/var/lib/registry目录下，假若有删除容器操做，咱们的镜像也不会被删除linux

给 docker 注册 https 协议，支持 https 访问

{
   "insecure-registries":["主机的IP地址或者域名:5000"],
   "registry-mirrors": ["https://registry.docker-cn.com"]
}

新建 tag

docker tag hello-world ip:port/hello-world

推送至本地仓库

docker push ip:port/hello-world

删除 tag 镜像

docker rmi ip:port/hello-world
docker rmi hello-world

拉取本地镜像

docker pull ip:port/hello-world

参考连接 centos7 docker 搭建本地私有仓库docker

设置仓库证书

建立自签证书

cd /usr/local
mkdir ssl
cd ssl
openssl genrsa -out ca.key 2048 
openssl req -new -key ca.key -out ca.csr
openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt

访问控制

cd /usr/local
mkdir auth
docker run \
  --entrypoint htpasswd \
  registry -Bbn testuser testpassword > auth/htpasswd

注：testuser testpassword 表明登陆的用户和密码shell

启动容器

docker run -d \
  --restart=always \
  --name registry \
  -v /usr/local/auth:/auth \
  -v /usr/local/ssl:/certs \
  -e REGISTRY_HTTP_ADDR=0.0.0.0:5000 \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/server.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/server.key \
  -e "REGISTRY_AUTH=htpasswd" \
  -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
  -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
  -p 5000:5000 \
  registry

登陆 docker

docker login ip:port

以 docker-compose 方式启动容器

# docker-compose.yml
version: '3.1'
services:
  registry:
    image: registry
    ports:
      - 5000:5000
    environment:
      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/server.crt
      REGISTRY_HTTP_TLS_KEY: /certs/server.key
      REGISTRY_AUTH: htpasswd
      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
      REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
    volumes:
      - /usr/local/docker_registry:/var/lib/registry
      - /usr/local/ssl:/certs
      - /usr/local/auth:/auth

参考连接json