docker镜像仓库
·
docker镜像仓库
一、公有仓库（阿里云公有仓库）
1、登录https://cr.console.aliyun.com/cn-hangzhou/instances/repositories阿里云控制台首页。创建镜像仓库。命名空间名称为stwgalaxy，仓库名称为linux。我们的镜像就是要上传到stwgalaxy/linux中。
------先创建命名空间再创建仓库
2、在Dokcer host上登陆阿里云仓库，并上传镜像。这里需要注意阿里云仓库对镜像名的格式要求
[root@stw ~]# docker login --username=nick6297376104 crpi-ss4htk9tf10ppu54.cn-hangzhou.personal.cr.aliyuncs.com
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
[root@stw ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 41f689c20910 8 weeks ago 192MB
httpd latest 65005131d37e 2 months ago 117MB
busybox latest 0ed463b26dae 12 months ago 4.43MB
centos 7 eeb6ee3f44bd 4 years ago 204MB
[root@stw ~]# docker tag centos:7 crpi-ss4htk9tf10ppu54.cn-hangzhou.personal.cr.aliyuncs.com/stwgalaxy/linux:centos7
[root@stw ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 41f689c20910 8 weeks ago 192MB
httpd latest 65005131d37e 2 months ago 117MB
busybox latest 0ed463b26dae 12 months ago 4.43MB
crpi-ss4htk9tf10ppu54.cn-hangzhou.personal.cr.aliyuncs.com/stwgalaxy/linux centos7 eeb6ee3f44bd 4 years ago 204MB
centos 7 eeb6ee3f44bd 4 years ago 204MB
[root@stw ~]# docker push crpi-ss4htk9tf10ppu54.cn-hangzhou.personal.cr.aliyuncs.com/stwgalaxy/linux:centos7
The push refers to repository [crpi-ss4htk9tf10ppu54.cn-hangzhou.personal.cr.aliyuncs.com/stwgalaxy/linux]
174f56854903: Pushed
centos7: digest: sha256:dead07b4d8ed7e29e98de0f4504d87e8880d4347859d839686a31da35a3b532f size: 529
退出登录方法
[root@stw ~]# docker logout
Removing login credentials for https://index.docker.io/v1/
3、查看edu仓库的镜像版本，可以看到之前上传的镜像，如果要删除镜像，只能在web管理界面上操作。如图所示
二、本地私有仓库——registry仓库（使用较少，作为了解）
在Docker中，当我们执行docker pull的时候 ，它实际上是从registr y.hub.docker.com这个地址去查找，这就是Docker公司为我们提供的公共仓库。在工作中，我们不可能把企业项目镜像push到公有仓库进行管理。所以为了更好的管理镜像，Docker不仅提供了一个中央仓库，同时也允许我们搭建本地私有仓库，Docker官方提供了一个搭建私有仓库的镜像 registry。
1、下载registry镜像，运行容器并暴露5000端口，同时添加–restart always参数，可是使容器随着Docker host的启动而启动
[root@stw ~]# docker pull registry:2
2: Pulling from library/registry
44cf07d57ee4: Pull complete
bbbdd6c6894b: Pull complete
8e82f80af0de: Pull complete
3493bf46cdec: Pull complete
6d464ea18732: Pull complete
Digest: sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
Status: Downloaded newer image for registry:2
docker.io/library/registry:2
[root@stw ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 41f689c20910 8 weeks ago 192MB
httpd latest 65005131d37e 2 months ago 117MB
busybox latest 0ed463b26dae 12 months ago 4.43MB
registry 2 26b2eb03618e 2 years ago 25.4MB
centos 7 eeb6ee3f44bd 4 years ago 204MB
[root@stw ~]# docker run -itd -p 5000:5000 --restart always --name stwregistry registry:2
a06c0238887a5877aadfd4eb1a78c35a9810738a02ea1d30a3a0475c36a0b0cb
[root@stw ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
a06c0238887a registry:2 "/entrypoint.sh /etc…" 6 seconds ago Up 4 seconds 0.0.0.0:5000->5000/tcp, :::5000->5000/tcp stwregistry
2、registry默认是不需要身份验证就能直接上传镜像，但是需要修改镜像名来指定仓库地址，镜像格式ip:port/xxx:tag，在通过docker push将该镜像推送到私有仓库
[root@stw ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 41f689c20910 8 weeks ago 192MB
httpd latest 65005131d37e 2 months ago 117MB
busybox latest 0ed463b26dae 12 months ago 4.43MB
registry 2 26b2eb03618e 2 years ago 25.4MB
centos 7 eeb6ee3f44bd 4 years ago 204MB
[root@stw ~]# docker tag centos:7 192.168.100.10:5000/centos:v1
[root@stw ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 41f689c20910 8 weeks ago 192MB
httpd latest 65005131d37e 2 months ago 117MB
busybox latest 0ed463b26dae 12 months ago 4.43MB
registry 2 26b2eb03618e 2 years ago 25.4MB
192.168.100.10:5000/centos v1 eeb6ee3f44bd 4 years ago 204MB
centos 7 eeb6ee3f44bd 4 years ago 204MB
3、设置docker的私有仓库地址
[root@stw ~]# vim /etc/docker/daemon.json
[root@stw ~]# cat /etc/docker/daemon.json
{
"registry-mirrors": [
"https://docker.m.daocloud.io",
"https://dockerproxy.com",
"https://docker.mirrors.ustc.edu.cn",
"https://docker.nju.edu.cn"
],"insecure-registries": ["192.168.100.10:5000"]
}
[root@stw ~]# systemctl daemon-reload
[root@stw ~]# systemctl restart docker
[root@stw ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
a06c0238887a registry:2 "/entrypoint.sh /etc…" 6 minutes ago Up 6 seconds 0.0.0.0:5000->5000/tcp, :::5000->5000/tcp stwregistry
[root@stw ~]# docker push 192.168.100.10:5000/centos:v1
The push refers to repository [192.168.100.10:5000/centos]
174f56854903: Pushed
v1: digest: sha256:dead07b4d8ed7e29e98de0f4504d87e8880d4347859d839686a31da35a3b532f size: 529
[root@stw ~]# curl http://192.168.100.10:5000/v2/_catalog //浏览器查看也是一样
{"repositories":["centos"]}
总结
1、Docker不仅提供了一个中央仓库，同时也允许我们搭建本地私有仓库，Docker官方提供了一个搭建私有仓库的镜像 registry
2、添加–restart always参数，可是使容器随着Docker host的启动而启动
3、registry默认是不需要身份验证就能直接上传镜像，但是需要修改镜像名来指定仓库地址
三、harbor仓库（私有仓库）
Harbor是一个用于存储和分发Docker镜像的企业级Registr y服务器，通过添加一些企业必须的功能特性，例如安全、标识和管理等，扩展了开源Docker Distribution。作为一个企业级私有Registr y服务器，Harbor提供了更好的性能和安全。另外，Harbor也提供了高级的安全特性，诸如用户管理，访问控制和活动审计等。
1、Harbor依赖的外部组件
Nginx（即proxy代理层）：Nginx前端代理，主要用于分发前端页面UI访问和镜像上传和下载流量
Registr y v2：镜像仓库，负责存储镜像文件
Database（Mysql或者Postgresql）：为core ser vices提供数据库服务，负责存储用户权限、审计日志、Docker image分组信息等数据
2、Harbor自有组件
Core services（Admin Server）：这是Harbor的核心功能，主要提供以下服务：
（1）UI：提供图形化界面，帮助用户管理registry上的镜像（image），并对用户进行授权。
（2）webhook：为了及时获取registry上image状态变化的情况，在Registry上配置webhook，把状态传递给UI模块
（3）Auth服务：负责根据用户权限给每个docker push/pull命令签发token。Docker客户端向Registry服务发起的请求，如果不包含token，会被重定向到这里，获得token后再重新向Registry进行请求。
（4）API：提供Harbor RESTful API。
Replication Job Service：提供多个Harbor实例之间的镜像同步功能。
Log collector：为了帮助监控Harbor运行，负责收集其他组件的log，供日后进行分析。
3、创建Harbor仓库
（1）下载https://github.com/goharbor/harbor/releases或者百度网盘下载：地址：https://pan.baidu.com/s/1YUbl_gHhiKpUfSwsIkWbZg，提取码：5669（略）
[root@stw ~]# rz -E //有压缩包直接上传
rz waiting to receive.
[root@stw ~]# ls
anaconda-ks.cfg Music
Desktop Pictures
Documents Public
Downloads Templates
harbor-offline-installer-v1.10.10(最新版2022-02-21).tgz Videos
initial-setup-ks.cfg
（2）将下载好的压缩包上传到主机中，并解压
[root@stw ~]# tar -zxvf harbor-offline-installer-v1.10.10\(最新版2022-02-21\).tgz
harbor/harbor.v1.10.10.tar.gz
harbor/prepare
harbor/LICENSE
harbor/install.sh
harbor/common.sh
harbor/harbor.yml
[root@stw ~]# ls
anaconda-ks.cfg
Desktop
Documents
Downloads
harbor
harbor-offline-installer-v1.10.10(最新版2022-02-21).tgz
initial-setup-ks.cfg
Music
Pictures
Public
Templates
Videos
（3）修改harbor.yml文件中的hostname，监听本主机IP，把https等内容注释掉，我们不用ssl功能，同时还能通过该文件定义harbor的登陆密码，默认密码为Harbor12345
[root@stw harbor]# vim harbor.yml
（4）先安装docker-compose，harbor是被docker-compose控制的，然后再运行 ./install.sh开始安装harbor，安装完毕后，可以通过docker-compose start/stop开启/关闭harbor
[root@stw harbor]# cd /etc/yum.repos.d/
[root@stw yum.repos.d]# ls
CentOS-Base.repo docker-ce.repo epel.repo epel-testing.repo
[root@stw yum.repos.d]# yum -y install docker-compose
[root@stw yum.repos.d]# cd
[root@stw ~]# cd harbor/
[root@stw harbor]# ls
common.sh harbor.v1.10.10.tar.gz harbor.yml install.sh LICENSE prepare
[root@stw harbor]# ./install.sh
[Step 0]: checking if docker is installed ...
Note: docker version: 26.1.4
[Step 1]: checking docker-compose is installed ...
Note: docker-compose version: 1.18.0
......
......
✔ ----Harbor has been installed and started successfully.----
[root@stw harbor]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
60096cb63696 goharbor/nginx-photon:v1.10.10 "nginx -g 'daemon of…" 31 seconds ago Up 30 seconds (healthy) 0.0.0.0:80->8080/tcp, :::80->8080/tcp nginx
163f587902b3 goharbor/harbor-jobservice:v1.10.10 "/harbor/harbor_jobs…" 31 seconds ago Up 31 seconds (healthy) harbor-jobservice
6ab0dde2c838 goharbor/harbor-core:v1.10.10 "/harbor/harbor_core" 32 seconds ago Up 31 seconds (healthy) harbor-core
e55aaab9967a goharbor/harbor-registryctl:v1.10.10 "/home/harbor/start.…" 33 seconds ago Up 32 seconds (healthy) registryctl
7cbdbbed2935 goharbor/redis-photon:v1.10.10 "redis-server /etc/r…" 33 seconds ago Up 32 seconds (healthy) 6379/tcp redis
2d6f4a11fd5e goharbor/harbor-portal:v1.10.10 "nginx -g 'daemon of…" 33 seconds ago Up 32 seconds (healthy) 8080/tcp harbor-portal
4e555e2c4190 goharbor/harbor-db:v1.10.10 "/docker-entrypoint.…" 33 seconds ago Up 32 seconds (healthy) 5432/tcp harbor-db
284fc194c7ff goharbor/registry-photon:v1.10.10 "/home/harbor/entryp…" 33 seconds ago Up 32 seconds (healthy) 5000/tcp registry
a7805fa2f464 goharbor/harbor-log:v1.10.10 "/bin/sh -c /usr/loc…" 34 seconds ago Up 33 seconds (healthy) 127.0.0.1:1514->10514/tcp harbor-log
a06c0238887a registry:2 "/entrypoint.sh /etc…" About an hour ago Up 54 minutes 0.0.0.0:5000->5000/tcp, :::5000->5000/tcp stwregistry
（5）安装完毕后，访问http://ip/harbor，即可显示harbor图形化管理界面，账号密码为admin/Harbor12345点击新建项目
如图所示，创建仓库，仓库名为yyqx，点击确认
（6） Docker默认是按https请求的，由于搭的私有库是http的，所以需要修改Docker配置，添加信任仓库。然后再修改镜像名，上传镜像
[root@stw harbor]# vim /etc/docker/daemon.json
[root@stw harbor]# cat /etc/docker/daemon.json
{
"registry-mirrors": [
"https://docker.m.daocloud.io",
"https://dockerproxy.com",
"https://docker.mirrors.ustc.edu.cn",
"https://docker.nju.edu.cn"
],"insecure-registries": ["192.168.100.10"]
}
[root@stw harbor]# systemctl daemon-reload
[root@stw harbor]# systemctl restart docker
[root@stw harbor]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
60096cb63696 goharbor/nginx-photon:v1.10.10 "nginx -g 'daemon of…" 4 hours ago Restarting (1) 24 seconds ago nginx
163f587902b3 goharbor/harbor-jobservice:v1.10.10 "/harbor/harbor_jobs…" 4 hours ago Exited (128) 2 minutes ago harbor-jobservice
6ab0dde2c838 goharbor/harbor-core:v1.10.10 "/harbor/harbor_core" 4 hours ago Exited (128) 2 minutes ago harbor-core
e55aaab9967a goharbor/harbor-registryctl:v1.10.10 "/home/harbor/start.…" 4 hours ago Exited (128) 2 minutes ago registryctl
7cbdbbed2935 goharbor/redis-photon:v1.10.10 "redis-server /etc/r…" 4 hours ago Exited (128) 2 minutes ago 6379/tcp redis
2d6f4a11fd5e goharbor/harbor-portal:v1.10.10 "nginx -g 'daemon of…" 4 hours ago Up 2 minutes (healthy) 8080/tcp harbor-portal
4e555e2c4190 goharbor/harbor-db:v1.10.10 "/docker-entrypoint.…" 4 hours ago Exited (128) 2 minutes ago 5432/tcp harbor-db
284fc194c7ff goharbor/registry-photon:v1.10.10 "/home/harbor/entryp…" 4 hours ago Exited (128) 2 minutes ago 5000/tcp registry
a7805fa2f464 goharbor/harbor-log:v1.10.10 "/bin/sh -c /usr/loc…" 4 hours ago Up 2 minutes (healthy) 127.0.0.1:1514->10514/tcp harbor-log
a06c0238887a registry:2 "/entrypoint.sh /etc…" 5 hours ago Up 2 minutes 0.0.0.0:5000->5000/tcp, :::5000->5000/tcp stwregistry
[root@stw harbor]# docker start 60096cb63696 163f587902b3 6ab0dde2c838 e55aaab9967a 7cbdbbed2935 4e555e2c4190 284fc194c7ff
60096cb63696
163f587902b3
6ab0dde2c838
e55aaab9967a
7cbdbbed2935
4e555e2c4190
284fc194c7ff
[root@stw harbor]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
60096cb63696 goharbor/nginx-photon:v1.10.10 "nginx -g 'daemon of…" 4 hours ago Restarting (1) 11 seconds ago nginx
163f587902b3 goharbor/harbor-jobservice:v1.10.10 "/harbor/harbor_jobs…" 4 hours ago Up 11 seconds (health: starting) harbor-jobservice
6ab0dde2c838 goharbor/harbor-core:v1.10.10 "/harbor/harbor_core" 4 hours ago Up 7 seconds (health: starting) harbor-core
e55aaab9967a goharbor/harbor-registryctl:v1.10.10 "/home/harbor/start.…" 4 hours ago Up 9 seconds (health: starting) registryctl
7cbdbbed2935 goharbor/redis-photon:v1.10.10 "redis-server /etc/r…" 4 hours ago Up 9 seconds (health: starting) 6379/tcp redis
2d6f4a11fd5e goharbor/harbor-portal:v1.10.10 "nginx -g 'daemon of…" 4 hours ago Up 8 minutes (healthy) 8080/tcp harbor-portal
4e555e2c4190 goharbor/harbor-db:v1.10.10 "/docker-entrypoint.…" 4 hours ago Up 8 seconds (health: starting) 5432/tcp harbor-db
284fc194c7ff goharbor/registry-photon:v1.10.10 "/home/harbor/entryp…" 4 hours ago Up 7 seconds (health: starting) 5000/tcp registry
a7805fa2f464 goharbor/harbor-log:v1.10.10 "/bin/sh -c /usr/loc…" 4 hours ago Up 8 minutes (healthy) 127.0.0.1:1514->10514/tcp harbor-log
a06c0238887a registry:2 "/entrypoint.sh /etc…" 5 hours ago Up 8 minutes 0.0.0.0:5000->5000/tcp, :::5000->5000/tcp stwregistry
[root@stw ~]# docker tag centos:7 192.168.100.10/yyqx/centos:v1
[root@stw ~]# docker login http://192.168.100.10 -u admin -p Harbor12345
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
[root@stw ~]# docker push 192.168.100.10/yyqx/centos:v1
The push refers to repository [192.168.100.10/yyqx/centos]
174f56854903: Pushed
v1: digest: sha256:dead07b4d8ed7e29e98de0f4504d87e8880d4347859d839686a31da35a3b532f size: 529
（7）最后在harbor的管理界面中，可以看到galayun仓库中，就有之前上传的镜像，如果想要删除镜像，只能通过web管理界面删除。如图所示
腾讯云面向开发者汇聚海量精品云计算使用和开发经验，营造开放的云计算技术生态圈。
更多推荐
29
0- 0
已为社区贡献2条内容
所有评论(0)