測試在局域網機器上測試的,IP爲192.168.22.65,以下內容均可替換成自己的機器IP。
測試docker-ce版本:18.09.3-rc1
-
安裝docker環境,並拉取倉庫鏡像registry
①yum install docker-ce
②docker pull registry:latest
-
利用openssl庫生成認證證書
①mkdir -p ~/certs
②編輯/etc/pki/tls/openssl.cnf文件,在[v3_ca]下方添加:
subjectAltName = IP:192.168.22.65
③openssl req -newkey rsa:4096 -nodes -sha256 -keyout ~/certs/192.168.22.65.key -x509 -days 365 -out ~/certs/192.168.22.65.crt
④在生成證書過程中填寫Common name時,應輸入ip地址或域名
⑤若第②步和第④步沒有按照要求操作,則pull或push時可能會報錯如:x509: cannot validate certificate for because it doesn’t contain any IP SANs -
將crt證書複製到docker
①mkdir /etc/docker/certs.d/192.168.22.65:5000
②cp ~/certs/192.168.22.65.crt /etc/docker/certs.d/192.168.22.65:5000/ca.crt
-
將crt證書複製到本機系統證書管理文件中
①cat ~/certs/192.168.22.65.crt >> /etc/pki/tls/certs/ca-bundle.crt
②若沒有此步驟,可能在pull或push時會報錯如:Get https:///v2/: x509: certificate signed by unknown authority -
重啓docker
①systemctl daemon-reload && systemctl restart docker
-
添加http basic authentication
①docker run --entrypoint htpasswd registry:latest -Bbn username password > /opt/registry-var/auth/htpasswd
②命令行中username和password分別是登錄registry的用戶名和密碼 -
運行registry
①docker run -d -p 5000:5000 --restart=always --name registry -v /opt/registry-var/auth/:/auth/ -v /opt/registry-var/:/var/lib/registry/ -v ~/certs:/certs -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" -e "REGISTRY_HTTP_TLS_CERTIFICATE=/certs/192.168.22.65.crt" -e "REGISTRY_HTTP_TLS_KEY=/certs/192.168.22.65.key" registry:latest
-
查看已運行的registry容器
①docker container ls
-
登錄registry
①docker login 192.168.22.65:5000
-
pull或push鏡像
-
用idea連接時填寫https://192.168.22.65:5000,並填寫用戶名和密碼。