Docker应用四:搭建docker镜像仓库(包括自生成https证书、登陆认证)

利用docker官网提供的registry镜像创建私有仓库

一、首先从docker官网拉取registry镜像:

docker pull registry

二、然后运行该镜像:

docker run --name MyRegistry -d -v /data/DockerRegistry:/var/lib/registry -p 5000:5000 registry

其中，-v /data/DockerRegistry:/var/lib/registry表示将镜像库映射到宿主机的/data目录

验证仓库运行:

http://ip:5000/v2/

其中，v2表示registry的tag，该url会返回一个空'{}'。

三、推送本地镜像到仓库:

先说下docker仓库中镜像的命名格式:registry.mydaemon.com/redis/redis-master:latest，共由三部分组成。

registry.mydaemon.com:表示仓库服务器地址

redis:表示镜像仓库的分类

redis-master:表示镜像名称

:latest:表示版本

1、首先对本地镜像打tag，告知镜像仓库的地址:

docker tag redis-master 192.168.0.100:5000/redis/redis-master:1.0

2、推送镜像到仓库:

docker push 192.168.0.100:5000/redis/redis-master:1.0

注意，push的时候可能会遇到一下提示:

The push refers to a repository [192.168.0.100:5000/redis/redis-master]
Get https://192.168.0.100:5000/v1/_ping: http: server gave HTTP response to HTTPS client

这是因为客户端push的时候采用https协议，而registry未使用https导致的。

解决方法如下:

在/etc/docker/目录下创建daemon.json文件，并写入如下内容:

{ "insecure-registries":["192.168.0.110:5000"] }

然后重启docker:

service docker restart

接着再执行push就可以了:

[root@ahaii docker]# docker push 192.168.0.100:5000/redis/redis-master:1.0
The push refers to a repository [192.168.0.100:5000/redis/redis-master]
e5bc8ffdee47: Pushed
babc1e95c4f0: Pushed
ebc4b691c405: Pushed
6363afe92ed2: Pushed
78e49376f417: Pushed
b8aa150f5f16: Pushed
b51149973e6a: Pushed
1.0: digest: sha256:7c60ce71ba4026b2b35e78c86dfgddf7ae171bf1d2903a567b964ad9a07f26f9 size: 1786

通过页面可以看到镜像已经存在:

以上的搭建，是最简单模式，没有安全认证的设置。

下面用官方的registry v2搭建私有仓库，自生成签字证书(用于https)，并设置登陆认证

1、获取registry:

docker pull registry:2

2、在registry仓库目录下创建cert目录，并利用openssl自生成签名:

#mkdir certs
#openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key -x509 -days 99999 -out certs/domain.crt

出现如下信息:

Generating a 4096 bit RSA private key
..........................++
............................................................................................++
writing new private key to 'certs/domain.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:docker
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:docker.damoin.com
Email Address []:[e-mail]

主要输入registry服务器的域名，其他的可以不用填写。

3、创建登陆帐号密码:

#mkdir auth
#docker run --entrypoint htpasswd registry:2 -Bbn ahaii ahaii123 > auth/htpasswd

这里创建的帐号/密码为:ahaii/ahaii123

4、运行带有TLS认证的registry容器:

[root@ahaii DockerRegistry]# docker run -d -p 5000:5000 --restart=always --name registry \
> -v `pwd`/auth:/auth \
> -v /data/local/DockerRegistry:/var/lib/registry \
> -e "REGISTRY_AUTH=htpasswd" \
> -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
> -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
> -v `pwd`/certs:/certs \
> -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
> -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
> registry:2

5、运行成功后，可以通过页面登陆查看:

地址栏里输入:https://docker.damoin.com:5000/v2/后，会要求登陆。输入ahaii/ahaii123后登陆成功:

注意:是https。

6、将本地镜像推送到仓库:

registry客户端登陆:

docker login docker.damoin.com:5000

会要求输入帐号密码，输入之后提示:

Error response from daemon: Get https://docker.damoin.com:5000/v1/users/: x509: certificate signed by unknown authority

客户端不信任registry自生成的证书，解决->让registry客户端信任registry自生成的证书:

将registry服务器上生成的certs/domain.crt 拷贝到registry客户端的/etc/docker/certs.d/docker.damoin.com:5000/目录下，并命名为ca.crt（certs.d/docker.damoin.com:5000目录默认没有，自己创建） 

[root@ahaii DockerRegistry]# ls /etc/docker/certs.d/docker.damoin.com:5000/
ca.crt

然后继续登陆仓库，提示登陆成功:

[root@ahaii certs]# docker login docker.damoin.com:5000
Username: ahaii
Password:
Login Succeeded 

好，现在继续push镜像到仓库:

[root@ahaii DockerRegistry]# docker push docker.damoin.com:5000/redis/redis-master:1.0
The push refers to a repository [docker.damoin.com:5000/redis/redis-master]
e5bc8ffdee47: Pushed
babc1e95c4f0: Pushed
ebc4b691c405: Pushed
6363afe92ed2: Pushed
78e49376f417: Pushed
b8aa150f5f16: Pushed
b51149973e6a: Pushed
1.0: digest: sha256:7c60ce71ba4026b2b35df7c86118ddf7ae171bf1d2903a567b964ad9a07f26f9 size: 1786

OK，push成功，通过浏览器查看如下: