Docker-配置私有仓库

[root@lnmp0 ~]# docker pull registry Using default tag: latest latest: Pulling from library/registry 2408cc74d12b: Pull complete ea60b727a1ce: Pull complete c87369050336: Pull complete e69d20d3dd20: Pull complete fc30d7061437: Pull complete Digest: sha256:bedef0f1d248508fe0a16d2cacea1d2e68e899b2220e2258f1b604e1f327d475 Status: Downloaded newer image for registry:latest docker.io/library/registry:latest 

4.2运行registry容器

[root@lnmp0 ~]# docker run -d --name registry -p 5000:5000 registry 176a6d135ca800390cc61c3c114934259ae64d204f3de3e781e343a61db5a316 [root@lnmp0 ~]# docker ps CONTAINER ID   IMAGE      COMMAND                  CREATED          STATUS          PORTS                                       NAMES 176a6d135ca8   registry   "/entrypoint.sh /etc…"   12 seconds ago   Up 11 seconds   0.0.0.0:5000->5000/tcp, :::5000->5000/tcp   registry 

4.3将镜像上传到当地仓库

本地镜像在命名时需要添加仓库ip和端口

[root@lnmp0 ~]# docker tag nginx:latest localhost:5000/nginx:latest [root@lnmp0 ~]# docker push localhost:5000/nginx Using default tag: latest The push refers to repository [localhost:5000/nginx] 33e3df466e11: Pushed 747b7a567071: Pushed 57d3fc88cb3f: Pushed 53ae81198b64: Pushed 58354abe5f0e: Pushed ad6562704f37: Pushed latest: digest: sha256:25dedae0aceb6b4fe5837a0acbacc6580453717f126a095aa05a3c6fcea14dd4 size: 1570 [root@lnmp0 ~]# curl localhost:5000/v2/_catalog {"repositories":["nginx"]} 

5 .为Docker仓库加密功能加密证书

[root@lnmp0 ~]# mkdir certs              ##存放证书的目录
[root@lnmp0 ~]# openssl11 req -newkey rsa:4096 -nodes -sha256 -keyout certs/westos.org.key -addext "subjectAltName = DNS:reg.westos.org" -x509 -days 365 -out certs/westos.org.crt                     ##生成证书
Generating a RSA private key
..++++
........................++++
writing new private key to 'certs/westos.org.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shaanxi
Locality Name (eg, city) [Default City]:Xi'an
Organization Name (eg, company) [Default Company Ltd]:westos
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:reg.westos.org
Email Address []:root@westos.org

##这里的Common Name (eg, your name or your server's hostname) []:reg.westos.org，域名一定要和"subjectAltName = DNS:reg.westos.org"的域名一样，否则无法解析

6 . 重建registry容器

6.1 先删除容器和容器创建的卷

[root@lnmp0 docker]# docker ps
CONTAINER ID   IMAGE      COMMAND                  CREATED          STATUS          PORTS                                       NAMES
176a6d135ca8   registry   "/entrypoint.sh /etc…"   28 minutes ago   Up 28 minutes   0.0.0.0:5000->5000/tcp, :::5000->5000/tcp   registry
[root@lnmp0 docker]# docker rm -f 176a6d135ca8
176a6d135ca8
[root@lnmp0 docker]# docker volume prune
WARNING! This will remove all local volumes not used by at least one container.
Are you sure you want to continue? [y/N] y
Deleted Volumes:
766c4987441e379c4890e6e3acd000774e7a388581f50219faeecc068e791401
5216f00b72a6fdeefa98f484ba6c294385b09de715c26f22b3e87c2e931873f0
ad58e70a93475ca724b9316356dc79504502bc3e81b8a16c971399574c9bc056
7db19d4105051add9fd884b488a3b2078f39590668a17c6a42f85fa0d50daf83
c822caf78106b2db18b2b64748ddbe73ce22b52a21b374a5774805a2b5f519c1

6.2 添加解析，重新运行容器

[root@lnmp0 ~]# vim /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.155.100 lnmp0   reg.westos.org
[root@lnmp0 ~]# docker run -d   --restart=always   --name registry   -v /root/certs:/certs  -v /opt/registry:/var/lib/registry -v /root/auth:/auth -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd -e REGISTRY_HTTP_ADDR=0.0.0.0:443   -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt   -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key   -p 443:443 registry
0dce86653079cd51b40c29b78e74bd5a639007e6b4f668d59509f6cf70ccf20c
[root@lnmp0 ~]#  docker ps
CONTAINER ID   IMAGE      COMMAND                  CREATED          STATUS          PORTS                                             NAMES
0dce86653079   registry   "/entrypoint.sh /etc…"   20 seconds ago   Up 19 seconds   0.0.0.0:443->443/tcp, :::443->443/tcp, 5000/tcp   registry
[root@lnmp0 ~]# curl -k https://reg.westos.org/v2/_catalog -u admin:westos
{"repositories":["nginx"]}

6.2.1 重新运行容器的参数详解

docker run -d                                            #后台运行
--restart=always                                         #跟随docker启动
--name registry                                          #容器名称
-v /root/certs:/certs                                    #目录映射关系——宿主机目录:容器内目录
-v /opt/registry:/var/lib/registry                       #目录映射
-e REGISTRY_HTTP_ADDR=0.0.0.0:443                        #允许端口
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt   #证书名称及域名
-e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key           #证书名称及域名
-p 443:443                                               #端口映射——宿主机端口:容器端口
registry                                                 #镜像名称

6.3 拷贝证书到docker主机

[root@lnmp0 certs]# mkdir -p /etc/docker/certs.d/reg.westos.org     ##建立的目录名字和域名“reg.westos.org”保持一致，docker会自动识别

[root@lnmp0 certs]# cp westos.org.crt /etc/docker/certs.d/reg.westos.org/ca.crt   ##拷贝到这个固定目录后，docker会自动识别

6.4 测试上传镜像