【registry】CentOS7.x上 registry server的安装使用
一、实验背景
当执行 docker pull 的时候，你可能会比较好奇，docker 会去哪儿查找并下载镜像呢？
它实际上是从 registry.hub.docker.com 这个地址去查找，这就是Docker公司为我们提供的公共仓库，上面的镜像，大家都可以看到，也可以使用。所以，我们也可以带上仓库地址去拉取镜像，如：docker pull registry.hub.docker.com/library/alpine，不过要注意，这种方式下载的镜像的默认名称就会长一些。
如果要在公司中使用 Docker，我们基本不可能把商业项目上传到公共仓库中，那如果要多个机器共享，又能怎么办呢？正因为这种需要，所以私有仓库也就有用武之地了。 所谓私有仓库，也就是在本地（局域网）搭建的一个类似公共仓库的东西，搭建好之后，我们可以将镜像提交到私有仓库中。这样我们既能使用 Docker 来运行我们的项目镜像，也避免了商业项目暴露出去的风险。
# ping registry.hub.docker.com
# echo > /dev/tcp/3.224.62.138/80
# echo > /dev/tcp/3.224.62.138/443
# echo > /dev/tcp/registry.hub.docker.com/80
# echo > /dev/tcp/registry.hub.docker.com/443
# curl -I http://registry.hub.docker.com
# curl -I https://registry.hub.docker.com
# docker search alpine
# docker pull alpine
# docker pull registry.hub.docker.com/library/alpine
# docker images
二、实验环境
操作系统： CentOS7.5 Minimal
registryServer： 192.168.1.105
registryClient： 192.168.1.102
三、安装docker
在registryServer和registryClient服务器
下载docker二进制安装包
# yum -y install wget
# wget https://download.docker.com/linux/static/stable/x86_64/docker-18.06.0-ce.tgz
# tar -zxf docker-18.06.0-ce.tgz
# ll ./docker
# cp ./docker/docker* /usr/bin
创建docker服务的unit文件
# vim /etc/systemd/system/docker.service
##############################################################
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service
Wants=network-online.target
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd
ExecReload=/bin/kill -s HUP $MAINPID
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
# Uncomment TasksMax if your systemd version supports it.
# Only systemd 226 and above support this version.
#TasksMax=infinity
TimeoutStartSec=0
# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes
# kill only the docker process, not all processes in the cgroup
KillMode=process
# restart the docker process if it exits prematurely
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s
[Install]
WantedBy=multi-user.target
#######################################################
启动docker服务，设置开机自启
# systemctl daemon-reload
# systemctl start docker
# systemctl status docker
# systemctl enable docker
# docker info
# docker version
设置镜像加速
# curl -sSL https://get.daocloud.io/daotools/set_mirror.sh | sh -s http://f1361db2.m.daocloud.io
# systemctl restart docker
四、安装 registry server
拉取docker registry官方镜像
# docker pull registry
# docker run -it --rm registry cat /etc/shells
# docker run -it --rm registry cat /etc/issue
# docker run -it --rm registry sh -c "registry -h"
# docker run -it --rm registry sh -c "registry -v"
创建registry server相关目录
# mkdir -p /opt/registry/data
# mkdir -p /opt/registry/config
# mkdir -p /opt/registry/certs
# mnkir -p /opt/registry/auth
生产外挂配置文件
# docker run -it --rm registry sh -c 'cat /etc/docker/registry/config.yml' > /opt/registry/config/config.yml
# cat /opt/registry/config/config.yml
自建CA，生成自签名证书
##########################################################
# openssl req -x509 \
-nodes \
-newkey rsa:4096 \
-days 3650 \
-sha256 \
-subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=CA/OU=CA/CN=www.ca.com" \
-keyout /opt/registry/certs/ca.key \
-out /opt/registry/certs/ca.crt
# openssl req \
-nodes \
-newkey rsa:4096 \
-sha256 \
-subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=Test/OU=Test/CN=www.registry.com" \
-keyout /opt/registry/certs/registry.key \
-out /opt/registry/certs/registry.csr
echo "
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName=IP:192.168.1.105,DNS:www.registry.com
" > extfile.cnf
# openssl x509 -req \
-days 3650 \
-CAcreateserial \
-CA /opt/registry/certs/ca.crt \
-CAkey /opt/registry/certs/ca.key \
-extfile extfile.cnf \
-in /opt/registry/certs/registry.csr \
-out /opt/registry/certs/registry.crt
#####################################################################
# ls -l /opt/registry/certs
生成认证用账号密码文件
# docker run --entrypoint htpasswd registry -Bbn test [email protected] > /opt/registry/auth/htpasswd
# cat /opt/registry/auth/htpasswd
创建服务的service文件
# vim /etc/systemd/system/registry.service
################################################
[Unit]
Description=Registry Server
After=network-online.target docker.service
Requires=docker.service
[Service]
ExecStartPre=-/usr/bin/docker rm -f registry
ExecStart=/usr/bin/docker run \
--name registry \
-v /opt/registry/data:/var/lib/registry \
-v /opt/registry/config/config.yml:/etc/docker/registry/config.yml \
-v /opt/registry/certs:/certs \
-e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \
-v /opt/registry/auth:/auth \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
-p 443:443 \
registry
ExecStop=/usr/bin/docker stop registry
LimitNOFILE=65535
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s
[Install]
WantedBy=multi-user.target
################################################
启动服务，设置开机自启
# systemctl daemon-reload
# systemctl start registry
# systemctl enable registry
# systemctl status registry
# docker ps -a
# docker exec -it registry sh -c "ps aux | grep registry"
# docker exec -it registry sh -c "netstat -anpltu"
五、registryClient客户端测试
方式一：通过获取registryServer的CA证书
将服务端证书/opt/registry/certs/ca.crt 拷贝到了客户端的 /etc/pki/ca-trust/source/anchors目录下
在registryClient服务器上
# scp [email protected]:/opt/registry/certs/ca.crt /etc/pki/ca-trust/source/anchors/
# update-ca-trust
# systemctl restart docker
# cat /etc/pki/ca-trust/source/anchors/ca.crt
# openssl x509 -noout -text -in /etc/pki/ca-trust/source/anchors/ca.crt
方式二：不通过CA证书，设置客户端docker信任仓库
# systemctl status docker
# vim /etc/systemd/system/docker.service
#####################################################
ExecStart=/usr/bin/dockerd --insecure-rehistry 192.168.1.105:443
######################################################
# systemctl daemon-reload
# systemctl restart docker
六、登录创建的docker仓库
在registryClient服务器上
测试registryserver上443端口的连通性
# echo > /dev/tcp/192.168.1.105/443
# curl -v http://192.168.1.105:443
# docker login 192.168.1.105:443 -u test -p "[email protected]"
# cat /root/.docker/config.json
测试镜像的pull/push
# docker pull busybox:latest
# docker tag busybox:latest 192.168.1.105:443/test/busybox:1.0.1-RC1
# docker push 192.168.1.105:443/test/busybox:1.0.1-RC1
七、参考
registry
https://hub.docker.com/_/registry
https://docs.docker.com/registry/deploying
用registry快速搭建私有镜像仓库
https://blog.51cto.com/ganbing/2080140
用docker registry 镜像搭建私有测试仓库
https://www.jianshu.com/p/7337aa3f227b
用nginx 反向代理docker 私有 registry
https://www.jianshu.com/p/143255035496
x509: cannot validate certificate for xx.xx.xx.xx because it doesn't contain any IP SANs
https://*.com/questions/54622879/cannot-validate-certificate-for-ip-address-because-it-doesnt-contain-any-ip-s
x509: certificate signed by unknown authority
https://*.com/questions/50768317/docker-pull-certificate-signed-by-unknown-authority
docker registry 私有仓库 安装配置、查询、删除
https://www.cnblogs.com/elvi/p/8384604.html
https://www.cnblogs.com/elvi/p/8384675.html
Docker私有仓库搭建及镜像删除
http://www.louisvv.com/archives/1130.html
docker registry 镜像删除
https://blog.51cto.com/132408/1946401
docker私有仓库删除image
https://blog.51cto.com/302876016/1966816
https://blog.csdn.net/l6807718/article/details/52886546
Docker Registry之删除镜像、垃圾回收
https://blog.csdn.net/u010884123/article/details/56838644
What is the difference between an image and a repository?
https://*.com/questions/31115098/what-is-the-difference-between-an-image-and-a-repository
What is the Differences between Docker registry and repository?
https://*.com/questions/34004076/difference-between-docker-registry-and-repository
How To Set Up a Private Docker Registry on Ubuntu 18.04？
https://www.digitalocean.com/community/tutorials/how-to-set-up-a-private-docker-registry-on-ubuntu-18-04