一、私有庫配置
有時候使用Docker Hub這樣的公共倉庫可能不方便（有時候無法訪問），用戶可以創建一個本地倉庫供私人使用，這裏介紹如何配置使用本地倉庫。網絡上配置docker私有倉庫的方法不少，有藉助Docker Hub的，也有直接使用別人創建好的私有倉庫的，這裏簡單介紹使用官方提供的工具docker-registry來配置私有庫
服務器：centos7.x x86_64 IP：10.0.90.25 docker版本：Docker version 1.12.0, build 8eab29e
1、使用官方提供的工具來配置
docker-registry 是官方提供的工具，可以用於構建私有的鏡像倉庫。
首先查看原有的鏡像 #docker p_w_picpaths REPOSITORY TAG IMAGE ID CREATED SIZE web new dcca36f7ba99 7 days ago 269.2 MB testweb new 890b0964f807 7 days ago 194.6 MB centos centos6 a3c09d36ab4a 3 weeks ago 194.6 MB centos latest 970633036444 3 weeks ago 196.7 MB
2、然後獲取官方 registry 鏡像
#docker pull registry Using default tag: latest latest: Pulling from library/registry e110a4a17941: Pull complete 2ee5ed28ffa7: Pull complete d1562c23a8aa: Pull complete 06ba8e23299f: Pull complete 802d2a9c64e8: Pull complete Digest: sha256:1b68f0d54837c356e353efb04472bc0c9a60ae1c8178c9ce076b01d2930bcc5d Status: Downloaded newer p_w_picpath for registry:latest 查看是否pull成功 # docker p_w_picpaths REPOSITORY TAG IMAGE ID CREATED SIZE web new dcca36f7ba99 7 days ago 269.2 MB testweb new 890b0964f807 7 days ago 194.6 MB centos centos6 a3c09d36ab4a 3 weeks ago 194.6 MB centos latest 970633036444 3 weeks ago 196.7 MB registry latest c6c14b3960bd 3 weeks ago 33.28 MB #表示已經成功了
3、基於私有倉庫鏡像運行容器
#docker run -d -p 5000:5000 -v /opt/data/registry:/tmp/registry registry a08a501701eba97c8f56fbc9b63e6f356dec1283b6c07f0f931639b4514b3838 查看運行的容器 #docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 0d79735868cd centos "/bin/bash" Less than a second ago Exited (137) Less than a second ago centos7 43b66a52f166 centos:centos6 "/bin/bash" Less than a second ago Exited (137) Less than a second ago server1 a08a501701eb registry "/entrypoint.sh /etc/" 3 seconds ago Up 3 seconds 0.0.0.0:5000->5000/tcp high_bardeen #已經運行了
PS：這裏說明一下，默認情況下，倉庫會被創建在容器的/tmp/registry目錄下，但是可以通過-v參數來將鏡像文件存放在本地的指定路徑。
例如上面的例子是將上傳的鏡像放到/opt/data/registry 目錄
#docker run -d -p 5000:5000 -v /opt/data/registry:/tmp/registry registry
訪問私有倉庫：
#curl 127.0.0.1:5000/v1/search #不知道什麼原因，我測試的時候使用curl提示404
404 page not found
#curl 127.0.0.1:5000/v1/search #網上有一個例子，提示如下信息；
{"num_results": 0, "query": "", "results": []} //私有倉庫爲空，沒有提交新鏡像到倉庫中4、創建鏡像鏈接或爲基礎鏡像打個標籤
#docker tag registry 127.0.0.1:5000/ssh #這裏選擇爲registry鏡像打標籤 [root@docker ~]# docker p_w_picpaths REPOSITORY TAG IMAGE ID CREATED SIZE web new dcca36f7ba99 7 days ago 269.2 MB testweb new 890b0964f807 7 days ago 194.6 MB centos centos6 a3c09d36ab4a 3 weeks ago 194.6 MB centos latest 970633036444 3 weeks ago 196.7 MB 127.0.0.1:5000/ssh latest c6c14b3960bd 3 weeks ago 33.28 MB registry latest c6c14b3960bd 3 weeks ago 33.28 MB
5、提交鏡像到本地私有倉庫中
#docker push 127.0.0.1:5000/ssh The push refers to a repository [127.0.0.1:5000/ssh] 3bb5bc5ad373: Pushed 35039a507f7a: Pushed d00444e19d65: Pushed aa3a31ee27f3: Pushed 4fe15f8d0ae6: Pushed latest: digest: sha256:51d8869caea35f58dd6a2309423ec5382f19c4e649b5d2c0e3898493f42289d6 size: 1363 注意：沒報錯，應該push成功了！查看私有倉庫是否存在對應的鏡像，依然提示404 #curl 127.0.0.1:5000/v1/search 404 page not found
二、測試私有庫是否可用
說明：centos6.x x86_64 IP：10.0.90.26 docker 版本：Docker version 1.7.1, build 786b29d/1.7.1
1、在另外一臺centos6.x系統測試pull功能，如下：
#docker pull 10.0.90.25:5000/ssh Error response from daemon: invalid registry endpoint https://10.0.90.25:5000/v0/: unable to ping registry endpoint https://10.0.90.25:5000/v0/ v2 ping attempt failed with error: Get https://10.0.90.25:5000/v2/: tls: oversized record received with length 20527 v1 ping attempt failed with error: Get https://10.0.90.25:5000/v1/_ping: tls: oversized record received with length 20527. If this private registry supports only HTTP or HTTPS with an unknown CA certificate, please add `--insecure-registry 10.0.90.25:5000` to the daemon's arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; simply place the CA certificate at /etc/docker/certs.d/10.0.90.25:5000/ca.crt 報錯了，根據提示需要創建證書或者添加--insecure-registry 10.0.90.25:5000作爲docker啓動參數，先測試更換啓動參數，看是否可以解決問題，先kill掉docker進程，再添加參數啓動，如下 #/usr/bin/docker -d --insecure-registry 10.0.90.25:5000 & # ps aux | grep docker root 1980 0.1 1.5 583928 16184 pts/0 Sl 17:16 0:02 /usr/bin/docker -d --insecure-registry 10.0.90.25:5000 已經啓動了，繼續pull私有倉庫的鏡像到本地 #docker pull 10.0.90.25:5000/ssh INFO[0006] POST /v1.19/p_w_picpaths/create?fromImage=10.0.90.25%3A5000%2Fssh%3Alatest latest: Pulling from 10.0.90.25:5000/ssh 9b7301678506: Pull complete d912f6ed534e: Pull complete 664daba008e5: Pull complete 33e9a84661e7: Pull complete 5366f93a80af: Pull complete 8d1f9ff6843f: Pull complete 79a50c6b6f41: Pull complete 94c689ffd50b: Pull complete ad8da6d14f6d: Pull complete Digest: sha256:a80c28adf17579da93b681893f663bf7625e0012c53c304294f1c328a0d27d9b Status: Downloaded newer p_w_picpath for 10.0.90.25:5000/ssh:latest 查看 #docker p_w_picpaths INFO[2107] GET /v1.19/p_w_picpaths/json REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE centos centos6 429d551fa7ee Less than a second ago 194.6 MB centos latest b62568c09fa0 Less than a second ago 196.7 MB 10.0.90.25:5000/ssh latest ad8da6d14f6d Less than a second ago 33.28 MB 可以看到pull成功了。
2、測試push一個centos鏡像並在centos6.x測試pull
先在centos7.x操作，上傳一個centos6鏡像到私有庫中：
#docker p_w_picpaths REPOSITORY TAG IMAGE ID CREATED SIZE web new dcca36f7ba99 7 days ago 269.2 MB testweb new 890b0964f807 7 days ago 194.6 MB centos centos6 a3c09d36ab4a 3 weeks ago 194.6 MB centos latest 970633036444 3 weeks ago 196.7 MB 127.0.0.1:5000/ssh latest c6c14b3960bd 3 weeks ago 33.28 MB registry latest c6c14b3960bd 3 weeks ago 33.28 MB [root@docker ~]# docker tag centos:centos6 127.0.0.1:5000/centos6 #標記centos6鏡像爲127.0.0.1:5000/centos6 [root@docker ~]# docker p_w_picpaths REPOSITORY TAG IMAGE ID CREATED SIZE web new dcca36f7ba99 7 days ago 269.2 MB testweb new 890b0964f807 7 days ago 194.6 MB 127.0.0.1:5000/centos6 latest a3c09d36ab4a 3 weeks ago 194.6 MB centos centos6 a3c09d36ab4a 3 weeks ago 194.6 MB centos latest 970633036444 3 weeks ago 196.7 MB 127.0.0.1:5000/ssh latest c6c14b3960bd 3 weeks ago 33.28 MB registry latest c6c14b3960bd 3 weeks ago 33.28 MB 上傳到私有庫 [root@docker ~]# docker push 127.0.0.1:5000/centos6 #會看到push的進度 The push refers to a repository [127.0.0.1:5000/centos6] 6b5c6954e3d5: Pushing [==========================> ] 102.6 MB/194.6 MB push完成之後，顯示如下信息 [root@docker ~]# docker push 127.0.0.1:5000/centos6 The push refers to a repository [127.0.0.1:5000/centos6] 6b5c6954e3d5: Pushed latest: digest: sha256:f7378a219c2a1d189e2e6a9bedc1b05ed3bb60de32ad24a9ad8e8ef8152c52c4 size: 529
然後到centos6.x去pull這個centos6鏡像：
#docker pull 10.0.90.25:5000/centos6 #pull進度可以看到 INFO[2640] POST /v1.19/p_w_picpaths/create?fromImage=10.0.90.25%3A5000%2Fcentos6%3Alatest latest: Pulling from 10.0.90.25:5000/centos6 3690474eb5b4: Pull complete c12ea02d7eb2: Extracting [===================================> ] 48.46 MB/68.76 MB 334af8693ca8: Download complete 273a1eca2d3a: Download complete 成功之後，顯示如下： #docker pull 10.0.90.25:5000/centos6 INFO[2640] POST /v1.19/p_w_picpaths/create?fromImage=10.0.90.25%3A5000%2Fcentos6%3Alatest latest: Pulling from 10.0.90.25:5000/centos6 3690474eb5b4: Pull complete c12ea02d7eb2: Pull complete 334af8693ca8: Pull complete 273a1eca2d3a: Pull complete Digest: sha256:3e4b73f8e13d8527f06cfd34d6c2cfdd16cce76ee7215a29379ae82015b312c9 Status: Downloaded newer p_w_picpath for 10.0.90.25:5000/centos6:latest 查看新pull的centos6鏡像 # docker p_w_picpaths INFO[2650] GET /v1.19/p_w_picpaths/json REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE 10.0.90.25:5000/centos6 latest 273a1eca2d3a Less than a second ago 194.6 MB centos centos6 429d551fa7ee Less than a second ago 194.6 MB centos latest b62568c09fa0 Less than a second ago 196.7 MB 10.0.90.25:5000/ssh latest ad8da6d14f6d Less than a second ago 33.28 MB 如上信息，可以看到centos6已經在鏡像列表中了！ 使用該鏡像創建一個容器，進行測試 #docker run -d -it --privileged=false -p 80:80 --name webserver 10.0.90.25:5000/centos6 /bin/bash INFO[2804] POST /v1.19/containers/create?name=webserver 63e4642a253a592bcf0eb3a9dd12a6363eb7c018b00eced66b9d20c1f4ca0898 INFO[2804] POST /v1.19/containers/63e4642a253a592bcf0eb3a9dd12a6363eb7c018b00eced66b9d20c1f4ca0898/start [root@test ~]# docker ps -a INFO[2810] GET /v1.19/containers/json?all=1 CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 63e4642a253a 10.0.90.25:5000/centos6 "/bin/bash" 6 seconds ago Up 5 seconds 0.0.0.0:80->80/tcp webserver 進入該容器 # docker attach 63e4642a253a INFO[2838] GET /v1.19/containers/63e4642a253a/json INFO[2838] POST /v1.19/containers/63e4642a253a/resize?h=68&w=207 INFO[2838] POST /v1.19/containers/63e4642a253a/attach?stderr=1&stdin=1&stdout=1&stream=1 [root@63e4642a253a /]# 安裝httpd並啓動 [root@63e4642a253a /]# yum install httpd -y [root@63e4642a253a ~]# service httpd start Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.1 for ServerName [ OK ] [root@63e4642a253a ~]# netstat -tunlp #端口已經啓動 Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 :::80 :::* LISTEN 119/httpd
三、關於tls證書在centos6.x和centos7.x報錯的一些解決方法
PS：配置docker私有倉庫，在pull私有倉庫時會遇到tls相關的問題，報錯信息類似：
Error response from daemon: invalid registry endpoint https://10.0.90.25:5000/v0/: unable to ping registry endpoint https://10.0.90.25:5000/v0/ v2 ping attempt failed with error: Get https://10.0.90.25:5000/v2/: tls: oversized record received with length 20527 v1 ping attempt failed with error: Get https://10.0.90.25:5000/v1/_ping: tls: oversized record received with length 20527. If this private registry supports only HTTP or HTTPS with an unknown CA certificate, please add `--insecure-registry 10.0.90.25:5000` to the daemon's arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; simply place the CA certificate at /etc/docker/certs.d/10.0.90.25:5000/ca.crt
根據提示信息可以大致瞭解到是和證書有關係，解決方式也給到了，要麼添加額外參數直接信任，要麼直接通過其他反方（比如openssl）生成證書，這裏介紹添加參數來解決這個報錯。
1、在centos6.x系統
第一種方式：
在centos6.x系統上安裝的docker-io是會在/etc/init.d/下生成啓動腳本文件docker的，修改這個文件，如下：
#vi /etc/init.d/docker #找到如下行； prog="docker" exec="/usr/bin/$prog" 將其修改爲如下 prog="docker" exec="/usr/bin/$prog --insecure-registry 10.0.90.25:5000" #相當於在-d參數後面添加--insecure-registry參數 保存退出，重新啓動docker，如下： # service docker restart Stopping docker: [ OK ] /etc/init.d/docker: line 43: [: too many arguments #會提示這個，忽略 Starting docker: [ OK ] [root@test ~]# ps aux | grep docker root 3240 2.2 1.1 222248 12184 pts/0 Sl 22:19 0:00 /usr/bin/docker --insecure-registry 10.0.90.25:5000 -d root 3295 0.0 0.0 103244 860 pts/0 R+ 22:19 0:00 grep docker 然後再使用pull的時候，就不會報錯了！
第二種方式：
在centos6.x系統上安裝的docker，會在/etc/sysconfig/目錄下生成docker文件，在其中修改other_args參數就可以（原本是空的other_args=），如下：
#vi /etc/sysconfig/docker #將other_args修改爲這樣： other_args="--insecure-registry 10.0.90.25:5000" 然後重啓docker #service docker restart Stopping docker: [ OK ] Starting docker: [ OK ] 查看進程 # ps aux | grep docker root 3588 0.5 2.0 387316 20532 pts/0 Sl 22:29 0:02 /usr/bin/docker -d --insecure-registry 10.0.90.25:5000 root 3932 0.0 0.0 103244 864 pts/0 S+ 22:36 0:00 grep docker
PS：自己創建的私有庫，如果只供自己使用的話，使用這2種方式是可行的，如果是要讓公網的其他人也使用，就需要tls（配置證書）認證了！
2、在centos7.x系統
如果沒有配置證書信任，執行pull私有庫的時候，也會出現和centos6.x系統上一樣的錯誤。雖然不像centos6.x系統可以修改/etc/sysconfig/docker來添加docker啓動參數，但是也是有文件可以修改的
#cat /usr/lib/systemd/system/docker.service [Unit] Description=Docker Application Container Engine Documentation=https://docs.docker.com After=network.target [Service] Type=notify # the default is not to use systemd for cgroups because the delegate issues still # exists and systemd currently does not support the cgroup feature set required # for containers run by docker ExecStart=/usr/bin/dockerd ExecReload=/bin/kill -s HUP $MAINPID # Having non-zero Limit*s causes performance problems due to accounting overhead # in the kernel. We recommend using cgroups to do container-local accounting. LimitNOFILE=infinity LimitNPROC=infinity LimitCORE=infinity # Uncomment TasksMax if your systemd version supports it. # Only systemd 226 and above support this version. #TasksMax=infinity TimeoutStartSec=0 # set delegate yes so that systemd does not reset the cgroups of docker containers Delegate=yes # kill only the docker process, not all processes in the cgroup KillMode=process [Install] WantedBy=multi-user.target 修改文件中的ExecStart=/usr/bin/dockerd，修改爲： ExecStart=/usr/bin/dockerd --insecure-registry x.x.x.x:5000 然後重啓docker，查看進程 # ps aux | grep docker root 15431 6.8 0.6 514268 25448 ? Ssl 16:42 0:00 /usr/bin/dockerd --insecure-registry x.x.x.x:5000 #這裏的x.x.x.x是私有庫的ip地址 root 15438 0.8 0.1 144220 5916 ? Ssl 16:42 0:00 docker-containerd -l unix:///var/run/docker/libcontainerd/docker-containerd.sock --shim docker-containerd-shim --metrics-interval=0 --start-timeout 2m --state-dir /var/run/docker/libcontainerd/containerd --runtime docker-runc root 15543 0.0 0.0 112652 976 pts/0 S+ 16:42 0:00 grep --color=auto docker
這樣再次在centos7.x上pull私有庫的時候，就不會報tls（證書）相關的錯誤了。
參考鏈接：http://467754239.blog.51cto.com/4878013/1638770
初學docker，不足之處，請多多指出！