了解仓库(Registry)
Registry,集中存放镜像的地方。
每个服务器上可以有多个仓库，而每个仓库下面有多个镜像。从这方面来说，仓库可以被认为是一个具体的项目或目录。例如对于仓库地址dl.dockerpool.com/ubuntu来说, dl.dockerpool.com 是注册服务器地址,，ubuntu 是仓库名。官方的Docker hub(https://hub.docker.com/)是一个用于管理公共镜像的好地方，我们可以在上面找到我们想要的镜像，也可以把我们自己的镜像推送上去。但是，由于服务器在国外的原因，网速会非常的慢,我们在利用docker开发构建容器服务时，我们希望能够建立自己的私有registry,上传镜像值我们的私有registry中心，然后在其他物理机上部署的时候，可以快速的pull,然后实现大规模的分发以及部署，提高效率
通过加速器拉取镜像
# 通过registry镜像来简单搭建一套本地私有仓库环境
[root@foundation7 docker]# docker pull registry
Using default tag: latest
latest: Pulling from library/registry
4064ffdc82fe: Pull complete
c12c92d1c5a2: Pull complete
4fbc9b6835cc: Pull complete
765973b0f65f: Pull complete
3968771a7c3a: Pull complete
Digest: sha256:51bb55f23ef7e25ac9b8313b139a8dd45baa832943c8ad8f7da2ddad6355b3c8
Status: Downloaded newer image for registry:latest
实现本地免密仓库
建立本地仓库服务,设定仓库对外的端口是5000
[root@foundation7 docker]# docker run -d -p 5000:5000 -v /opt/registry:/var/lib/registry registry
dfcae16477bae752469247501ceff722a2bcc7b82fbad94a76f28d0c98729120
# 通过-V参数来将镜像文件存放在本地的指定路径上
[root@foundation7 registry]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
0b2bd10f32c3 registry "docker-registry" 4 minutes ago Up 46 minutes 0.0.0.0:5000->5000/tcp cocky_davinci
将nginx镜像上传到自己的镜像仓库中
docker tag : 标记本地镜像，将其归入某一仓库
docker push : 将本地的镜像上传到镜像仓库,要先登陆到镜像仓库
[root@foundation7 registry]# docker tag ubuntu localhost:5000/ubuntu
[root@foundation7 registry]# docker push localhost:5000/ubuntu
The push refers to a repository [localhost:5000/ubuntu]
5f70bf18a086: Image successfully pushed
11083b444c90: Image successfully pushed
9468150a390c: Image successfully pushed
56abdd66ba31: Image successfully pushed
Pushing tag for rev [07c86167cdc4] on {http://localhost:5000/v1/repositories/ubuntu/tags/latest}
[root@foundation7 registry]# docker images localhost:5000/ubuntu
REPOSITORY TAG IMAGE ID CREATED SIZE
localhost:5000/ubuntu latest 07c86167cdc4 2 years ago 188 MB
删除本地镜像从仓库中拉取
[root@foundation7 registry]# docker rmi -f localhost:5000/ubuntu
[root@foundation7 registry]# docker rmi -f ubuntu
[root@foundation7 registry]# docker pull localhost:5000/ubuntu
Using default tag: latest
Pulling repository localhost:5000/ubuntu
07c86167cdc4: Pulling image (latest) from localhost:5000/ubuntu, endpoint: http:07c86167cdc4: Pull complete
56abdd66ba31: Pull complete
6ff1ee6fc8a0: Pull complete
9dcfe19e9419: Pull complete
Status: Downloaded newer image for localhost:5000/ubuntu:latest 搭建本地仓库只是对本机可用,很明显不符合生产要求,于是乎就有了如下的加密仓库
配置加密仓库
获取自定义证书
[root@foundation7 ~]# mkdir /etc/docker/certs
[root@foundation7 ~]# cd /etc/docker/
# 进入指定目录的上一级，并进行证书及密钥的获取
[root@foundation7 docker]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key -x509 -days 365 -out certs/domain.crt
Generating a 4096 bit RSA private key
......................++
.....++
writing new private key to 'certs/domain.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shaanxi
Locality Name (eg, city) [Default City]:Xi`an
Organization Name (eg, company) [Default Company Ltd]:xupt
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:westos.org
Email Address []:root@localhost
# 获取成功
[root@foundation7 certs]# ls
domain.crt domain.key[root@foundation7 certs]# mkdir -p /etc/docker/certs.d/westos.org
[root@foundation7 certs]# cp domain.crt /etc/docker/certs.d/westos.org/ca.crt
# 启动一个registry容器
[root@foundation7 docker]# docker run -d \
--restart=always \
--name registry \
-v `pwd`/certs:/certs \
-e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
-p 443:443 \
registry:2
4bbf297f0ebc617c05501248dd65b576f365b26545d21d115272643d187bbd31
[root@foundation7 docker]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
8bb28011bfec registry:2 "/entrypoint.sh /e..." 2 minutes ago Up 2 minutes 0.0.0.0:443->443/tcp, 5000/tcp registry
# 进行本地镜像的上传
[root@foundation7 docker]# docker push westos.org/rhel7
The push refers to a repository [westos.org/rhel7]
18af9eb19b5f: Pushed
latest: digest: sha256:f1b19bc905965d1ff157c76b9ef6615c119aadad3cf4652bc881d3354ba3fdc4 size: 528
访问限制
删除上面的容器,保留之前的证书
Native basic auth
实现访问限制的最简单方法是通过基本身份验证（这非常类似于其他Web服务器的基本身份验证机制）。此示例使用htpasswd使用本机基本身份验证。
[root@foundation7 docker]# mkdir auth
[root@foundation7 docker]# docker run \
> --entrypoint htpasswd \
> registry:2 -Bbn kobe 123456 > auth/htpasswd[root@foundation7 docker]# docker run -d \
> -p 5000:5000 \
> --restart=always \
> --name registry \
> -v `pwd`/auth:/auth \
> -e "REGISTRY_AUTH=htpasswd" \
> -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
> -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
> -v `pwd`/certs:/certs \
> -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
> -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
> -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
> -p 443:443 \
> registry:2
90a95d93a10b2d2d929692a0a9507a752ede67da78b48e12aff06e7dd9893b6f
[root@foundation7 docker]# docker push westos.org/rhel7
The push refers to a repository [westos.org/rhel7]
18af9eb19b5f: Preparing
no basic auth credentials
# 未登陆上传失败登录仓库后，进行上传
[root@foundation7 docker]# docker login -u kobe -p 123456 westos.org
Login Succeeded
[root@foundation7 docker]# docker push westos.org/rhel7
The push refers to a repository [westos.org/rhel7]
18af9eb19b5f: Pushed
latest: digest: sha256:f1b19bc905965d1ff157c76b9ef6615c119aadad3cf4652bc881d3354ba3fdc4 size: 528