配置一個私有的Docker倉庫
來自： http://dockone.io/article/1086
我們在本地開發時，如果內網能部署一臺Docker服務器，無疑會極大的方便鏡像的分享發布，有些私有鏡像就是可以直接放到內網服務器上，省去了不必要的網絡下載。
本課程需要配兩個虛擬機，一臺作為私有倉庫部署，一臺作為工作機。
```
//Docker倉庫部署-虛擬機
docker-machine create -d virtualbox registry
//Docker工作機
docker-machine create -d virtualbox default
```
Setup1 安裝并配置Registry
```
mkdir ~/docker-registry && cd $_
mkdir data
```
//mate指的是textmate -我在MAC上做了一個軟鏈接，方便使用
//類似也可以將chrome瀏覽器做軟鏈接 這樣就可以直接在命令行啟動chrome www.baidu.com
mate docker-compose.yml
registry: image: registry ports: - 127.0.0.1:5000:5000 environment: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data volumes: - ./data:/data
執行
docker-compose upSetp2配置Nginx容器
mkdir ~/docker-registry/nginxmate docker-compose.yml
```
nginx:
image: "nginx"
ports:
- 443:443
links:
- registry:registry
volumes:
- ./nginx/:/etc/nginx/conf.d:ro
registry:
image: registry
ports:
- 5000:5000
environment:
REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
volumes:
- ./data:/data
```
mate ~/docker-registry/nginx/registry.conf
```
upstream docker-registry {
server registry:5000;
}
server {
listen 443;
server_name registry.51yixiao.com;
# SSL
# ssl on;
# ssl_certificate /etc/nginx/conf.d/domain.crt;
# ssl_certificate_key /etc/nginx/conf.d/domain.key;
# disable any limits to avoid HTTP 413 for large image uploads
client_max_body_size 0;
# required to avoid HTTP 411: see Issue #1486 ( https://github.com/docker/docker/issues/148 6)
chunked_transfer_encoding on;
location /v2/ {
# Do not allow connections from docker 1.5 and earlier
" user agents
$" ) {return 404;
}
# To add basic authentication
# auth_basic "registry.localhost";
# auth_basic_user_file /etc/nginx/conf.d/registry.password;
# add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always;
proxy_pass http://docker-registry;
proxy_set_header Host $http_host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
}
```
執行
docker-compose up //測試 curl http://www.registry.com:443 curl http://www.registry.com:5000
Setup3 設置HTTP驗證
```
cd ~/docker-registry/nginx
htpasswd -c registry.password USERNAME
//USERNAME替換自己想添加的用戶名，比如:markthink,如果要繼續添加其他用戶
//htpasswd registry.password USERNAME
```
mate ~/docker-registry/nginx/registry.conf
```
#To add basic authentication
auth_basic "registry.localhost";
auth_basic_user_file /etc/nginx/conf.d/registry.password;
add_header 'Docker-Distribution-Api-Version' 'registry' always;
```
執行
cd ~/docker-registry docker-compose up
curl http://www.registry.com:443/
<html>
<head><title>401 Authorization Required</title></head>
<body bgcolor="white">
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.9.11</center>
</body>
</html>
//使用HTTP驗證訪問-用上面配置的用戶名和密碼
curl123456a@www.registry.com:443/" rel="nofollow" target="_blank">http://markthink: 123456a@www.regist ry.com:443/
Setup4設置SSL驗證
使用HTTP驗證并不安全，因為連接沒有加密傳輸，下面啟用SSL配置
mate ~/docker-registry/nginx/registry.conf
```
# SSL
ssl on;
ssl_certificate /etc/nginx/conf.d/domain.crt;
ssl_certificate_key /etc/nginx/conf.d/domain.key;
```
為我們的域名購買一個證書或申請一個 免費SSL證書
Setup5申請免費證書
沃通CA(WoSign CA) https://buy.wosign.com/free/#myorder https://buy.wosign.com/FreeSSL.html
用申請好的證書更新nginx配置文件
Setup6配置域名
mate /etc/hosts //宿主機添加 192.168.99.100 registry.51yixiao.com
Setup7測試
```
docker-machine start default
//重新分配IP
docker-machine regenerate-certs default
docker-machine ssh default
sudo -i
vi /etc/hosts
192.168.99.100 registry.51yixiao.com
docker login https://registry.51yixiao.com
//輸入前面配置的用戶和密碼 登陸成功
Setup8從工作機推送鏡像至服務器
eval $(docker-machine env default)
docker images
//為本地鏡像打標簽
docker pull busybox
docker tag busybox registry.51yixiao.com/busybox
//登陸服務器
docker login https://registry.51yixiao.com
//向服務器推送鏡像
docker push registry.51yixiao.com/busybox
curl https://markthink:123456a%40re ... m/v2/
//網頁直接訪問
https://markthink:123456a%40re ... m/v2/
//退出服務器
docker logout https://registry.51yixiao.com
//查看鏡像倉庫已有的鏡像
https://markthink:123456a%40re ... talog
Setup9從鏡像服務器下載鏡像至工作機
docker-machine start default
docker-machine regenerate-certs default
docker-machine ssh default
sudo -i
vi /etc/hosts
//添加IP地址
192.168.99.100 registry.51yixiao.com
//登陸服務器
docker login https://registry.51yixiao.com
//下載鏡像
docker pull registry.51yixiao.com/busybox
//鏡像改名
docker tag registry.51yixiao.com/busybox busybox
```
制作自己的證書(比較復雜不推薦)
由于Dokcer目前不允許使用自簽名的SSL證書，這一步比平時更加復雜，我們必須建立自己的系統，對我們自己的證書簽名授權。
1.生成根密鑰
cd ~/docker-registry/nginx //生成新的根密鑰 openssl genrsa -out devdockerCA.key 2048
2.生成根證書-Common Name填寫證書簽發者的域名 比如: www.trjcn.com
openssl req -x509 -new -nodes -key devdockerCA.key -days 10000 -out devdockerCA.crt3.為nginx生成ssl密鑰
//生成nginx域名的SSL證書 openssl genrsa -out domain.key 2048
我們的CA中心與要申請證書的服務器是同一個，否則應該是在另一臺需要用到證書的服務器上生成
4.為nginx生成證書簽署請求
//生成ssl_certificate_key證書 openssl req -new -key domain.key -out dev-docker-registry.com.csr
需要注意的是Common Name必須輸入我們要授予證書的服務器IP或域名
5.私有CA根據請求來簽發證書
```
//簽署證書申請
openssl x509 -req -in dev-docker-registry.com.csr -CA devdockerCA.crt -CAkey devdockerCA.key -CAcreateserial -out domain.crt -days 10000
``
此過程用到了前兩步生成的根密鑰和根證書
至此SSL證書制作完成，但是我們生成的證書沒有已經的證書頒發機構驗證，因此需要在Docker Registry中注冊。
下面是基于centsos的部署過程
scp ./devdockerCA.crt registry:/home/docker/ docker-machine ssh registry sudo -i mkdir /usr/local/share/ca-certificates/docker-dev-cert mv /home/docker/devdockerCA.crt /usr/local/share/ca-certificates/docker-dev-cert/ //update-ca-certificates
重啟Docker daemon守護進程
docker-machine restart registry //service docker restart