我们在本地开发时，如果内网能部署一台Docker服务器，无疑会极大的方便镜像的分享发布，有些私有镜像就是可以直接放到内网服务器上，省去了不必要的网络下载。

本课程需要配两个虚拟机，一台作为私有仓库部署，一台作为工作机。

//Docker仓库部署-虚拟机
docker-machine create -d virtualBox registry
//Docker工作机
docker-machine create -d virtualBox default

Setup1 安装并配置Registry

mkdir ~/docker-registry && cd $_
mkdir data

mate docker-compose.yml

registry:
 image: registry
 ports:
  - 127.0.0.1:5000:5000
 environment:
  REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
 volumes:
  - ./data:/data

执行

docker-compose up

Setp2配置Nginx容器

mkdir ~/docker-registry/Nginx

mate docker-compose.yml

Nginx:
 image: "Nginx"
 ports:
  - 443:443
 links:
  - registry:registry
 volumes:
  - ./Nginx/:/etc/Nginx/conf.d:ro
registry:

image: registry

ports:

5000:5000

environment:

REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data

volumes:
./data:/data

mate ~/docker-registry/Nginx/registry.conf

upstream docker-registry {
server registry:5000;
}


server {

listen 443;

server_name registry.51yixiao.com;
SSL
ssl on;
ssl_certificate /etc/Nginx/conf.d/domain.crt;
ssl_certificate_key /etc/Nginx/conf.d/domain.key;
disable any limits to avoid HTTP 413 for large image uploads
client_max_body_size 0;
required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
chunked_transfer_encoding on;
location /v2/ {
Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping,catch "Go *" user agents
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
  return <a href="/tag/404/" target="_blank" class="keywords">404</a>;
}

# To add basic authentication
# auth_basic "registry.localhost";
# auth_basic_user_file /etc/<a href="/tag/Nginx/" target="_blank" class="keywords">Nginx</a>/conf.d/registry.password;
# add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always;

proxy_pass                          http://docker-registry;
proxy_set_header  Host              $http_host;   # <a href="/tag/required/" target="_blank" class="keywords">required</a> for docker client's sake
proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
proxy_set_header  X-Forwarded-Proto $scheme;
proxy_read_timeout                  900;
}

}

执行

docker-compose up
//测试
curl http://www.registry.com:443
curl http://www.registry.com:5000

Setup3 设置HTTP验证

cd ~/docker-registry/Nginx

htpasswd -c registry.password USERNAME //USERNAME替换自己想添加的用户名，比如:markthink,如果要继续添加其他用户 //htpasswd registry.password USERNAME

mate ~/docker-registry/Nginx/registry.conf

 #To add basic authentication
 auth_basic "registry.localhost";
 auth_basic_user_file /etc/Nginx/conf.d/registry.password;
 add_header 'Docker-Distribution-Api-Version' 'registry' always;

执行

cd ~/docker-registry
docker-compose up

curl :443/


401 Authorization Required
401 Authorization Required
nginx/1.9.11

//使用HTTP验证访问-用上面配置的用户名和密码
curl :123456a@www.registry.com:443/

Setup6配置域名

mate /etc/hosts
//宿主机添加
192.168.99.100 registry.51yixiao.com

Setup7测试

docker-machine start default //重新分配IP docker-machine regenerate-certs default docker-machine ssh default sudo -i vi /etc/hosts 192.168.99.100 registry.51yixiao.com

docker login https://registry.51yixiao.com //输入前面配置的用户和密码登陆成功

Setup8从工作机推送镜像至服务器

eval $(docker-machine env default) docker images //为本地镜像打标签 docker pull busyBox docker tag busyBox registry.51yixiao.com/busyBox //登陆服务器 docker login https://registry.51yixiao.com //向服务器推送镜像 docker push registry.51yixiao.com/busyBox curl https://markthink:123456a@registry.51yixiao.com/v2/ //网页直接访问 https://markthink:123456a@registry.51yixiao.com/v2/ //退出服务器 docker logout https://registry.51yixiao.com

//查看镜像仓库已有的镜像 https://markthink:123456a@registry.51yixiao.com/v2/_catalog

Setup9从镜像服务器下载镜像至工作机

docker-machine start default
docker-machine regenerate-certs default
docker-machine ssh default
sudo -i
vi /etc/hosts
//添加IP地址
192.168.99.100 registry.51yixiao.com
//登陆服务器
docker login https://registry.51yixiao.com
//下载镜像
docker pull registry.51yixiao.com/busyBox
//镜像改名
docker tag registry.51yixiao.com/busyBox busyBox

制作自己的证书

由于Dokcer目前不允许使用自签名的SSL证书，这一步比平时更加复杂，我们必须建立自己的系统，对我们自己的证书签名授权。

1.生成根密钥

cd ~/docker-registry/Nginx
//生成新的根密钥
openssl genrsa -out devdockerCA.key 2048

2.生成根证书-Common Name填写证书签发者的域名比如:www.trjcn.com

openssl req -x509 -new -nodes -key devdockerCA.key -days 10000 -out devdockerCA.crt

3.为Nginx 生成ssl密钥

//生成Nginx域名的SSL证书
openssl genrsa -out domain.key 2048

我们的CA中心与要申请证书的服务器是同一个，否则应该是在另一台需要用到证书的服务器上生成

4.为Nginx 生成证书签署请求

//生成ssl_certificate_key证书 
openssl req -new -key domain.key -out dev-docker-registry.com.csr

需要注意的是Common Name必须输入我们要授予证书的服务器IP或域名

5.私有CA根据请求来签发证书

//签署证书申请 openssl x509 -req -in dev-docker-registry.com.csr -CA devdockerCA.crt -CAkey devdockerCA.key -CAcreateserial -out domain.crt -days 10000 `` 此过程用到了前两步生成的根密钥和根证书至此SSL证书制作完成，但是我们生成的证书没有已经的证书颁发机构验证，因此需要在Docker Registry中注册。

下面是基于centsos的部署过程

scp ./devdockerCA.crt registry:/home/docker/
docker-machine ssh registry
sudo -i
mkdir /usr/local/share/ca-certificates/docker-dev-cert
mv /home/docker/devdockerCA.crt /usr/local/share/ca-certificates/docker-dev-cert/
//update-ca-certificates

重启Docker daemon守护进程

docker-machine restart registry
//service docker restart

配置一个私有的Docker仓库

Setup1 安装并配置Registry

Setp2配置Nginx容器

SSL

ssl on;

ssl_certificate /etc/Nginx/conf.d/domain.crt;

ssl_certificate_key /etc/Nginx/conf.d/domain.key;

disable any limits to avoid HTTP 413 for large image uploads

required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)

Do not allow connections from docker 1.5 and earlier

Setup3 设置HTTP验证

401 Authorization Required

Setup4设置SSL验证

Setup5申请免费证书

Setup6配置域名

Setup7测试

Setup8从工作机推送镜像至服务器

Setup9从镜像服务器下载镜像至工作机

制作自己的证书

猜你在找的Docker相关文章