說明
之前我們搭建了k8s,那麼就會有另一個問題,我們的那些鏡像文件不想放在公有云裏,私有云鏡像多快多安全啊。我找到的是Harbor這個鏡像的倉庫,由於內網環境不需要配置ssl就選用了1.8的版本,再往上的話就需要配置ssl了!使用http的過程踩了一些坑,在這裏記錄一下。
準備
Harbor版本1.8.0 下載地址https://github.com/goharbor/harbor/releases(由於某些原因,國內不太好下載),離線安裝包我放七牛雲了->harbor-offline-installer-v1.8.0.tgz
postgres版本11.8 安裝教程可以看我以前的博客->Postgres11在CentOS7下的安裝與使用
redis&docker&docker-compose的安裝就不說了
快速開始
下載好Harbor的離線安裝包後,解壓
tar -zxf harbor-offline-installer-v1.8.0.tgz
cd harbor
讓docker支持http,添加--insecure-registry參數
vim /usr/lib/systemd/system/docker.service
# 找到ExecStart添加--insecure-registry=<你服務器ip>
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --exec-opt native.cgroupdriver=systemd --insecure-registry=<你服務器ip>
重啓docker
systemctl daemon-reload
systemctl restart docker
編輯解壓文件裏的harbor.yml
vim harbor.yml
內容如下,需要修改hostname,把database注掉,啓用外部數據庫external_database(僅支持postgres)記得先創建庫哦,啓用外部redisexternal_redis
# Configuration file of Harbor
# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: <服務器ip>
# http related config
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 80
# https related config
# https:
# # https port for harbor, default is 443
# port: 443
# # The path of cert and key files for nginx
# certificate: /your/certificate/path
# private_key: /your/private/key/path
# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433
# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: Harbor12345
# Harbor DB configuration
# database:
# The password for the root user of Harbor DB. Change this before any production use.
# password: root123
# The default data volume
data_volume: /data
# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
# # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
# # of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate.
# ca_bundle:
# # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
# # for more info about this configuration please refer https://docs.docker.com/registry/configuration/
# filesystem:
# maxthreads: 100
# # set disable to true when you want to disable registry redirect
# redirect:
# disabled: false
# Clair configuration
clair:
# The interval of clair updaters, the unit is hour, set to 0 to disable the updaters.
updaters_interval: 12
# Config http proxy for Clair, e.g. http://my.proxy.com:3128
# Clair doesn't need to connect to harbor internal components via http proxy.
http_proxy:
https_proxy:
no_proxy: 127.0.0.1,localhost,core,registry
jobservice:
# Maximum number of job workers in job service
max_job_workers: 10
chart:
# Change the value of absolute_url to enabled can enable absolute url in chart
absolute_url: disabled
# Log configurations
log:
# options are debug, info, warning, error, fatal
level: info
# Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
rotate_count: 50
# Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
# If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
# are all valid.
rotate_size: 200M
# The directory on your host that store log
location: /var/log/harbor
#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 1.8.0
# Uncomment external_database if using external database. Currently only support POSTGRES.
# Four databases are needed to be create first by users for Harbor core, Clair, Notary server
# and Notary signer. And the tables will be generated automatically when Harbor starting up.
# NOTE: external_database is unable to custom attributes individually, you must do them in block.
external_database:
harbor:
host: harbor_db_host
port: harbor_db_port
db_name: harbor_db_name
username: harbor_db_username
password: harbor_db_password
ssl_mode: disable
clair:
host: clair_db_host
port: clair_db_port
db_name: clair_db_name
username: clair_db_username
password: clair_db_password
ssl_mode: disable
notary_signer:
host: notary_signer_db_host
port: notary_signer_db_port
db_name: notary_signer_db_name
username: notary_signer_db_username
password: notary_signer_db_password
ssl_mode: disable
notary_server:
host: notary_server_db_host
port: notary_server_db_port
db_name: notary_server_db_name
username: notary_server_db_username
password: notary_server_db_password
ssl_mode: disable
# Uncomment external_redis if using external Redis server
external_redis:
host: <redis-ip>
port: 6379
password:
# db_index 0 is for core, it's unchangeable
registry_db_index: 1
jobservice_db_index: 2
chartmuseum_db_index: 3
# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
# ca_file: /path/to/ca
編輯保存後執行
sh install.sh
看到下面的信息說明你成功了,docker-compose ps也能看到運行情況,如果需要停止服務使用docker-compose stop,啓動使用docker-compose up -d,還需要移除創建的容器的話使用docker-compose down -v
[Step 3]: starting Harbor ...
Creating network "harbor_harbor" with the default driver
Creating harbor-log ... done
Creating registryctl ... done
Creating harbor-db ... done
Creating redis ... done
Creating registry ... done
Creating harbor-core ... done
Creating harbor-jobservice ... done
Creating harbor-portal ... done
Creating nginx ... done
✔ ----Harbor has been installed and started successfully.----
Now you should be able to visit the admin portal at http://<服務器ip>.
For more details, please visit https://github.com/goharbor/harbor .
如果出錯,沒成功啓動,請查看/var/log/harbor/目錄下的log日誌文件排錯,我遇到一個下面的錯誤,可能是因爲我反覆刪建的原因,把整個庫刪掉重新創建就好了
然後就可以使用瀏覽器登錄管理界面了訪問你服務器ip即可,創建一個新的用戶用於等會兒測試docker login
創建一個新的項目用於等會兒測試docker push
好的,服務端準備完畢,開始配置客戶端
測試login
我windows使用的是docker-toolbox,我們同樣需要設置--insecure-registry參數,不然你會看到下面的錯誤
$ docker login 服務器ip
Username: yunlingfly
Password:
Error response from daemon: Get https://服務器ip/v2/: dial tcp 服務器ip:443: connect: connection refused
欸,又得改docker-toolbox的參數了,上次改這個是因爲和內網網段衝突(•́へ•́╬)有興趣的可以查看內網環境下修改Docker Toolbox的訪問地址並暴露端口。網上查閱資料,發現有在profile文件配置鏡像地址的,猜測應該就是在這裏加,打開toolbox開始測試
docker-machine ssh default
vi /var/lib/boot2docker/profile
# 在--label provider=virtualbox下面再加上參數insecure-registry
--insecure-registry=<服務器ip>
保存文件,輸入exit退出ssh,重啓docker
docker-machine restart default
然後使用docker login登錄,欸,果然成功了,這參數還真是難找
docker login <服務器ip>
看到Login Succeeded說明你就成功了!
測試push
網頁打開項目,點擊"推送鏡像"可以看到例子
例如我們想推一個mysql鏡像到服務器上去可以這麼操作
# 打tag
docker tag yunlingfly/mysql:5.7.17 服務器ip/yunlingfly/mysql:5.7.17
# 推鏡像
docker push 服務器ip/yunlingfly/mysql:5.7.17
然後就可以在這個項目下面看到你推的鏡像啦(ಥ_ಥ)