基於百度雲 BOS 搭建私有 Docker Registry

時間 2019-11-07

標籤基於百度 bos 搭建私有 docker registry 欄目 Docker 简体版

原文原文鏈接

基於百度雲 BOS 搭建私有 Docker Registry

Docker Registry 做爲 Docker 的核心組件之一負責了鏡像的存儲以及分發。用戶只須要使用 Docker 的客戶端就能夠直接和 Registry 進行交互，下載和上傳鏡像。html

百度對象存儲 BOS (Baidu Object Storage) 提供穩定、安全、高效以及高擴展存儲服務。nginx

Baidu BOS storage driver 基於官方 Docker Registry 源碼，結合百度雲 Go 語言SDK：https://github.com/guoyao/baidubce-sdk-go.git，經過實現 storagedriver.StorageDriver 接口，提供了一個針對百度雲 BOS 的 Storage Driver。git

準備工做

安裝 Docker Engine，如何安裝請參考 Docker官方文檔github
下載 Registry 鏡像（或者經過源碼倉庫https://github.com/guoyao/distribution.git 本身 build 一個鏡像）docker
```
docker pull guoyao/registry:0.6.0
```
由於是從Docker官方Registry下載鏡像，速度會比較慢，能夠配置國內的鏡像加速api
註冊百度雲帳號，開通 BOS 服務，在百度雲 BOS 控制檯新建一個 Bucket，假設 Bucket 名稱爲 registry-test安全
獲取百度雲 AK / SKsession

部署私有 Docker Registry

爲 Registry 相關的配置新建一個單獨的目錄dom
```
mkdir registry && cd registry
```
在當前目錄下新建咱們的帳戶密碼（最簡單的帳戶驗證方式）curl
```
mkdir auth
htpasswd -Bbn admin 123456 > auth/htpasswd
```

啓動 Registry

docker run -d \
           -v `pwd`/auth:/auth:ro \
           -e REGISTRY_AUTH=htpasswd \
           -e REGISTRY_AUTH_HTPASSWD_REALM=basic-realm \
           -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
           -e REGISTRY_STORAGE=bos \
           -e REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK \
           -e REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK \
           -e REGISTRY_STORAGE_BOS_REGION=bj \
           -e REGISTRY_STORAGE_BOS_BUCKET=registry-test \
           -p 5000:5000 \
           --restart=always \
           guoyao/registry:0.6.0

詳細的 BOS STORAGE 的配置文檔在這裏： https://github.com/guoyao/distribution/blob/release/0.6/docs/storage-drivers/bos.md

操做鏡像

Login
```
docker login localhost:5000
```
根據命令行提示輸入以前設置的用戶名：admin，密碼：123456；登陸成功會提示：Login Succeeded

Push

首先經過 Dockerfile 生成一個鏡像，或者修改一個已有鏡像的 tag，好比：localhost:5000/busybox
```
docker push localhost:5000/busybox
```
推送成功後就能夠在百度雲 BOS 控制檯查看到這個鏡像了

Pull
```
docker pull localhost:5000/busybox
```

上述方式只能經過 localhost 來 push 和 pull 鏡像，若是想經過公網域名或 IP，須要配置 --insecure-registry xxx.xxx.xxx.xxx 到 Docker Deamon 的啓動參數中，並重啓 Docker Deamon，不然會報錯：

Error response from daemon: Get https://xxx.xxx.xxx.xxx:5000/v1/users/: http: server gave HTTP response to HTTPS client

經過域名訪問 & 配置https證書

若是不但願配置 --insecure-registry 參數，你須要購買一個獨立的域名（假設爲 myregistrydomain.com），而且申請該域名的 https 證書，將證書 xxx.crt 和 xxx.key 文件放在當前 certs 子目錄下，而後在啓動 Registry 時，配置證書：

docker run -d \
           -v `pwd`/auth:/auth:ro \
           -e REGISTRY_AUTH=htpasswd \
           -e REGISTRY_AUTH_HTPASSWD_REALM=basic-realm \
           -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
           -v `pwd`/certs:/certs:ro \
           -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/xxx.crt \
           -e REGISTRY_HTTP_TLS_KEY=/certs/xxx.key \
           -e REGISTRY_STORAGE=bos \
           -e REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK \
           -e REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK \
           -e REGISTRY_STORAGE_BOS_REGION=bj \
           -e REGISTRY_STORAGE_BOS_BUCKET=registry-test \
           -p 443:5000 \
           --restart=always \
           guoyao/registry:0.6.0

既然已經使用 https 證書了，咱們把對外暴露的端口換成 443 端口，而後就能夠直接經過域名來操做鏡像了：

docker login myregistrydomain.com
docker push myregistrydomain.com/busybox
docker pull myregistrydomain.com/busybox

更多關於部署 Registry 的內容，能夠參考官方文檔：https://docs.docker.com/registry/deploying/

配置 Nginx 代理訪問

由於要啓動多個容器，這裏咱們使用 docker-compose 來作容器編排，首先安裝 docker-compose（須要使用 root 用戶來安裝），安裝方式以下：

curl -L https://github.com/docker/compose/releases/download/1.10.1/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose

chmod +x /usr/local/bin/docker-compose

建立 nginx 主配置文件

cat > auth/nginx.conf << 'EOF'
events {
    worker_connections  1024;
}

http {

  upstream docker-registry {
    server registry:5000;
  }

  ## Set a variable to help us decide if we need to add the
  ## 'Docker-Distribution-Api-Version' header.
  ## The registry always sets this header.
  ## In the case of nginx performing auth, the header will be unset
  ## since nginx is auth-ing before proxying.
  map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
    '' 'registry/2.0';
  }

  server {
    listen 443 ssl;
    server_name myregistrydomain.com;

    # SSL
    ssl_certificate /certs/xxx.crt;
    ssl_certificate_key /certs/xxx.key;

    # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    # disable any limits to avoid HTTP 413 for large image uploads
    client_max_body_size 0;

    # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
    chunked_transfer_encoding on;

    location /v2/ {
      # Do not allow connections from docker 1.5 and earlier
      # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
      if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
        return 404;
      }

      # To add basic authentication to v2 use auth_basic setting.
      auth_basic "Registry realm";
      auth_basic_user_file /etc/nginx/conf.d/htpasswd;

      ## If $docker_distribution_api_version is empty, the header will not be added.
      ## See the map directive above where this variable is defined.
      add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;

      proxy_pass                          http://docker-registry;
      proxy_set_header  Host              $http_host;   # required for docker client's sake
      proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
      proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header  X-Forwarded-Proto $scheme;
      proxy_read_timeout                  900;
    }
  }
}
EOF

建立 docker-compose.yml 文件

nginx:
  image: nginx:1.9
  ports:
    - 443:443
  links:
    - registry:registry
  volumes:
    - ./auth:/etc/nginx/conf.d:ro
    - ./auth/nginx.conf:/etc/nginx/nginx.conf:ro
    - ./certs:/certs:ro

registry:
  image: guoyao/registry:0.6.0
  environment:
    - REGISTRY_STORAGE=bos
    - REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK
    - REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK
    - REGISTRY_STORAGE_BOS_REGION=bj
    - REGISTRY_STORAGE_BOS_BUCKET=registry-test