registry 私有认证仓库搭建示例

lukyjre

hub.test.io : 192.168.11.10
node1: 192.168.11.20
node2: 192.168.11.30

时间同步(分别执行)：

1 2 3 4

[iyunv@hub ]# yum install -y ntpdate && ntpdate cn.pool.ntp.org [iyunv@node1 ]# yum install -y ntpdate && ntpdate cn.pool.ntp.org [iyunv@hub ]# crontab -l */5 * * * * ntpdate cn.pool.ntp.org

1.仓库服务端设置 hub.test.io：

1 2 3 4 5

[iyunv@hub ]# docker pull registry [iyunv@hub ]# cat /etc/hosts   //内网没有DNS情况下修改hosts,修改主机名 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6 192.168.11.10 hub.test.io

1 2	[iyunv@hub ~]# hostname    hub.test.io

说明：如果私有仓库用的不是域名而是IP，请加上此设置：

1	# sed -i '/^\[ v3_ca \]$/a subjectAltName = IP:192.168.10.10' /etc/ssl/openssl.cnf

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63

[iyunv@hub ]# mkdir /opt/registry && cd /opt/registry [iyunv@hub registry]# mkdir auth certs [iyunv@hub registry]# docker run --entrypoint htpasswd registry:latest -Bbn username password > auth/htpasswd  //自行更换用户名密码 [iyunv@hub registry]# cat auth/htpasswd   // 下面一行为空，切记不要修改生成后的文件 admin:$2y$05$LSRMXpIbnvnj8ErzbRvKq.F04Qf3oajP7dFWQIjJBrFAoDXKM1I16 [iyunv@hub registry]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/ca.key -x509 -days 365 -out certs/ca.crt Generating a 4096 bit RSA private key ........ ........ ....++writing new private key to 'certs/ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]: State or Province Name (full name) []: Locality Name (eg, city) [Default City]: Organization Name (eg, company) [Default Company Ltd]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) []:hub.test.io    //对应你的仓库域名 Email Address []: [iyunv@hub registry]# mkdir -p /etc/docker/certs.d/hub.test.io && cp auth/ca.crt /etc/docker/certs.d/hub.test.io [iyunv@hub registry]# ls /etc/docker/certs.d/hub.test.io/ ca.crt [iyunv@hub registry]# systemctl daemon-reload && systemctl restart docker [iyunv@hub registry]# cat start.sh #!/bin/bash docker run -d \ -p 443:5000 \ --name registry \ --restart=always \ -v /var/lib/registry:/var/lib/registry \ -v `pwd`/config.yml:/etc/docker/registry/config.yml \ -v `pwd`/auth:/auth \ -e REGISTRY_AUTH=htpasswd \ -e REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm" \ -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \ -v `pwd`/certs:/certs \ -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt \ -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key \ registry:latest [iyunv@hub registry]# tree   //最终的目录结构 . ├── auth │   └── htpasswd ├── certs │   ├── ca.crt │   └── ca.key └── start.sh [iyunv@hub registry]# docker login hub.test.io Username: admin Password: Login Succeeded [iyunv@hub registry]# docker tag pause-amd64:3.0 hub.test.io/pause-amd64:3.0 [iyunv@hub registry]# docker push hub.test.io/pause-amd64:3.0 The push refers to a repository [hub.test.io/pause-amd64] 5f70bf18a086: Pushed 41ff149e94f2: Pushed 3.0: digest: sha256:ec6581792f828ab138bc7ed65205dbd4d7df966249179b7afbb9f6cac729771b size: 939

客户端：

1 2 3 4 5 6 7 8 9

[iyunv@node1 ]# mkdir /etc/docker/certs.d/hub.test.io [iyunv@node1 ]# scp hub.test.io:/etc/docker/certs.d/hub.test.io/ca.crt /etc/docker/certs.d/hub.test.io [iyunv@node1 ]# docker login hub.test.io [iyunv@node1 ]# docker pull hub.test.io/pause-amd64:3.0 3.0: Pulling from pause-amd64 a3ed95caeb02: Pull complete f11233434377: Pull complete Digest: sha256:ec6581792f828ab138bc7ed65205dbd4d7df966249179b7afbb9f6cac729771b Status: Downloaded newer image for hub.test.io/pause-amd64:3.0