docker--repository--精简版
一、私有仓库https支持
1.安装依赖软件包
[root@repository ~]# yum -y install pcre devel zlib-devel openssl openssl-devel
[root@docker ~]# hostname
docker.benet.com
[root@docker ~]#
2.配置SSL
(1) 编辑/etc/hosts,把docker.benet.com的ip地址添加进来
主机名、ip地址：
[root@docker ~]# ifconfig eno16777736
eno16777736: flags=4163 mtu 1500
inet 192.168.142.163 netmask 255.255.255.0 broadcast 192.168.142.255
inet6 fe80::20c:29ff:fe3c:1c0 prefixlen 64 scopeid 0x20
ether 00:0c:29:3c:01:c0 txqueuelen 1000 (Ethernet)
RX packets 806309 bytes 1116337317 (1.0 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 211572 bytes 17728543 (16.9 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
/etc/hosts文件内容：
[root@docker ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.142.163 docker.benet.com
(2) 生成根密钥
[root@docker CA]# openssl genrsa -out private/cakey.pem 2048
Generating RSA private key, 2048 bit long modulus
..................................+++
...+++
e is 65537 (0x10001)
[root@docker CA]# ls
certs crl newcerts private
[root@docker CA]# cd private/
[root@docker private]# ls
cakey.pem
(3) 生成根证书
[root@docker CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:perma
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:docker.benet.com
Email Address []:
[root@docker CA]#
[root@docker CA]# ls
cacert.pem certs crl newcerts private
(4) 为nginx web服务器生成ssl密钥
[root@docker pki]# cd /etc/ssl
[root@docker ssl]# openssl genrsa -out nginx.key 2048
Generating RSA private key, 2048 bit long modulus
.................................+++
..................................................................................................+++
e is 65537 (0x10001)
[root@docker ssl]# ls
certs nginx.key
(5) 为nginx生成证书签署请求
[root@docker ssl]# openssl req -new -key nginx.key -out nginx.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:perma
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:docker.benet.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@docker ssl]#
(6) 私有CA根据请求来签发证书
[root@docker ssl]# touch /etc/pki/CA/index.txt
[root@docker ssl]# touch /etc/pki/CA/serial
[root@docker ssl]# echo 00 > /etc/pki/CA/serial
[root@docker ssl]# openssl ca -in nginx.csr -out nginx.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Jul 27 14:02:34 2016 GMT
Not After : Jul 27 14:02:34 2017 GMT
Subject:
countryName = CN
stateOrProvinceName = beijing
organizationName = perma
commonName = docker.benet.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
1F:0B:12:9F:A7:E9:C2:23:ED:61:A8:94:28:82:2D:34:13:AE:F4:06
X509v3 Authority Key Identifier:
keyid:DE:3B:A6:10:A0:B7:C9:C7:3A:C4:83:2F:11:1C:89:2D:15:5C:CC:BC
Certificate is to be certified until Jul 27 14:02:34 2017 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
3.安装,配置,运行nginx
(1) 添加组和用户
[root@docker ssl]# groupadd www -g 58
[root@docker ssl]# useradd -u 58 -g www www
(2) 下载nginx源文件:
[root@docker ssl]# wget http://nginx.org/download/nginx-1.11.2.tar.gz
(3) 编译,安装nginx:
[root@docker ssl]# tar zxf nginx-1.11.2.tar.gz -C ~
[root@docker ssl]# cd
[root@docker ~]# ls
anaconda-ks.cfg Desktop Downloads nginx-1.11.2 sshd_dockerfile Videos
centos6-test.tar Dockerfile hello-world.tar Pictures Templates
centos-6-x86_64.tar.gz Documents Music Public util-linux-2.24.tar.gz
[root@docker ~]# cd nginx-1.11.2/
[root@docker nginx-1.11.2]# ls
auto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src
[root@docker nginx-1.11.2]# ./configure --user=www --group=www --prefix=/opt/nginx \
> --with-pcre \
> --with-http_stub_status_module \
> --with-http_ssl_module \
> --with-http_addition_module \
> --with-http_realip_module \
> --with-http_flv_module
(4) 编辑/opt/nginx/conf/nginx.conf文件
[root@docker ~]# cat /opt/nginx/conf/nginx.conf | grep -v "#" | grep -v "^$"
user www;
worker_processes 4;
events {
worker_connections 4096;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
upstream registry {
server 192.168.142.163:5000;
}
server {
listen 443 ssl;
server_name localhost;
ssl_certificate /etc/ssl/nginx.crt;
ssl_certificate_key /etc/ssl/nginx.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://registry;
client_max_body_size 3000m;
proxy_set_header Host $host;
proxy_set_header X-Forwad-For $remote_addr;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
}
(5) 验证配置
[root@docker ssl]# /opt/nginx/sbin/nginx -t
nginx: the configuration file /opt/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /opt/nginx/conf/nginx.conf test is successful
(6) 启动nginx:
[root@docker ~]# /opt/nginx/sbin/nginx
(7) 验证nginx是否启动:
[root@docker ~]# ps -ef | grep -i "nginx"
root 79230 1 0 22:44 ? 00:00:00 nginx: master process /opt/nginx/sbin/nginx
www 79231 79230 0 22:44 ? 00:00:00 nginx: worker process
www 79232 79230 0 22:44 ? 00:00:00 nginx: worker process
www 79233 79230 0 22:44 ? 00:00:00 nginx: worker process
www 79234 79230 0 22:44 ? 00:00:00 nginx: worker process
root 79257 75870 0 22:45 pts/2 00:00:00 grep --color=auto -i nginx
[root@docker ~]# netstat -anpt | grep nginx
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 79230/nginx: master
二、配置,运行Docker
1.停止docker
[root@docker ~]# systemctl stop docker
2.编辑/etc/sysconfig/docker文件,加上如下一行
[root@docker ~]# vim /etc/sysconfig/docker
[root@docker ~]# cat /etc/sysconfig/docker
DOCKER_OPTS="--insecure-registry docker.benet.com --tlsverify --tlscacert /etc/pki/CA/cacert.pem"
3.把根证书复制到/etc/docker/certs.d/docker.benet.com/目录下
[root@docker ~]# mkdir -p /etc/docker/certs.d/docker.benet.com
[root@docker ~]# cp /etc/pki/CA/cacert.pem /etc/docker/certs.d/docker.benet.com/ca-certificates.crt
4.启动docker
[root@docker ~]# systemctl start docker
三、运行私有仓库容器
1.通过获取官方 registry 镜像来运行
[root@docker ~]# docker search registry
[root@docker ~]# docker pull registry
[root@docker ~]# docker images
2.将目录/opt/data/registry作为私有仓库的位置
[root@docker ~]# mkdir -pv /opt/data/registry
mkdir: created directory ‘/opt/data’
mkdir: created directory ‘/opt/data/registry’
3.运行私有仓库容器
[root@docker ~]# docker run -d -p 5000:5000 -v /opt/data/registry:/tmp/registry registry
7e1f53f23341e81d1ffc3243d987eb1eedf060d51c834e7b25c8b3819ade3f57
[root@docker ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
7e1f53f23341 registry "docker-registry" 5 seconds ago Up 3 seconds 0.0.0.0:5000->5000/tcp nauseous_visvesvaraya
四、验证registry
1.用浏览器输入: https://docker.benet.com
或者:curl -i -k https://docker.benet.com
[root@docker ~]# curl -i -k https://docker.benet.com
HTTP/1.1 200 OK
Server: nginx/1.11.2
Date: Thu, 28 Jul 2016 07:04:59 GMT
Content-Type: application/json
Content-Length: 28
Connection: keep-alive
Expires: -1
Pragma: no-cache
Cache-Control: no-cache
"\"docker-registry server\""[root@docker ~]#
五、Docker客户端配置
1.编辑/etc/hosts,把docker.benet.com的ip地址添加进来
[root@client-2 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.142.163 docker.benet.com
2.把docker registry服务器端的根证书追加到ca-certificates.crt文件里
[root@docker ~]# scp /etc/pki/CA/cacert.pem [email protected]:/root
The authenticity of host '192.168.142.160 (192.168.142.160)' can't be established.
ECDSA key fingerprint is b6:5b:14:f0:9a:81:49:08:10:e8:8b:44:24:e1:8d:a0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.142.160' (ECDSA) to the list of known hosts.
[email protected]'s password:
cacert.pem 100% 1289 1.3KB/s 00:00
[root@client-2 ~]# ls | grep cacert
cacert.pem
[root@client-2 ~]# cat cacert.pem >> /etc/pki/tls/certs/ca-certificates.crt
3.验证docker.benet.com下的registry: 用浏览器输入: https://docker.benet.com
或者:curl -i -k https://docker.benet.com
[root@client-2 ~]# curl -i -k https://docker.benet.com
HTTP/1.1 200 OK
Server: nginx/1.11.2
Date: Thu, 28 Jul 2016 07:58:21 GMT
Content-Type: application/json
Content-Length: 28
Connection: keep-alive
Expires: -1
Pragma: no-cache
Cache-Control: no-cache
"\"docker-registry server\""[root@client-2 ~]#
4.使用私有registry步骤
[root@client-2 ~]# docker login https://docker.benet.com
Username: testuser
Password:
Email: [email protected]
WARNING: login credentials saved in /root/.docker/config.json
Account created. Please see the documentation of the registry https://docker.benet.com/v1/ for instructions how to activate it.
从docker hub上拉取一个镜像测试，为基础镜像打个标签
docker tag centos:centos6 docker.benet.com/centos:centos6
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
docker.io/centos centos6 cf2c3ece5e41 3 weeks ago 194.6 MB
[root@client ~]# docker tag docker.io/centos:centos6 docker.benet.com/centos:centos6
[root@client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
docker.benet.com/centos centos6 cf2c3ece5e41 3 weeks ago 194.6 MB
docker.io/centos centos6 cf2c3ece5e41 3 weeks ago 194.6 MB
发布：上传到本地私有仓库
[root@client ~]# docker push docker.benet.com/centos:centos6
The push refers to a repository [docker.benet.com/centos]
2714f4a6cdee: Image successfully pushed
Pushing tag for rev [cf2c3ece5e41] on {https://docker.benet.com/v1/repositories/centos/tags/centos6}
[root@client ~]#
查看私有仓库是否有对应的镜像
[root@client ~]# curl 192.168.142.163:5000/v1/search
{"num_results": 1, "query": "", "results": [{"description": "", "name": "library/centos"}]}[root@client ~]#
查看镜像的存储目录和文件（在镜像服务器）
[root@docker Packages]# rpm -ivh tree-1.6.0-10.el7.x86_64.rpm
Preparing... ################################# [100%]
Updating / installing...
1:tree-1.6.0-10.el7 ################################# [100%]
[root@docker Packages]# cd
[root@docker ~]# tree /opt/data/registry/repositories/
/opt/data/registry/repositories/
└── library
└── centos
├── _index_images
├── tag_centos6
└── tagcentos6_json
2 directories, 3 files
[root@docker ~]#
从私有仓库pull下来image,查看image
查看私有仓库是否有对应的镜像
[root@client ~]# curl -k https://docker.benet.com/v1/search
{"num_results": 1, "query": "", "results": [{"description": "", "name": "library/centos"}]}
或浏览器访问仓库
