docker 構建 https 私有倉庫 Registry

1.安裝docker

# docker install docker

2.拉取倉庫鏡像

# docker pull registry

3.生成認證certificate

# mkdir ~/certs
# openssl req -newkey rsa:4096 -nodes -sha256 -keyout /root/certs/domain.key  -x509 -days 365 -out /root/certs/domain.crt

4.複製認證到docker

# mkdir /etc/docker/certs.d/mydockerhub.com:5000
# cp /root/certs/domain.crt  /etc/docker/certs.d/mydockerhub.com\:5000/ca.crt

5.複製認證到本機

# cat /root/certs/domain.crt >> /etc/pki/tls/certs/ca-bundle.crt 

7.啓動倉庫鏡像

# docker run -d -p 5000:5000 --privileged=true -v /root/docker/registry:/var/lib/registry -v /root/certs/:/root/certs  -e REGISTRY_HTTP_TLS_CERTIFICATE=/root/cer
ts/domain.crt -e REGISTRY_HTTP_TLS_KEY=/root/certs/domain.key registry

8.建立一個鏡像

docker run -it --name=nginx centos /bin/bash
yum install epel-release.noarch -y
yum install nginx -y
docker commit 7ab4d6b6a438 dingyingsi/nginx  //7ab4d6b6a438爲容器id
docker tag dingyingsi/nginx mydockerhub.com:5000/nginx:latest //給當前鏡像打標籤

9.修改當前主機名：

vi /etc/hosts
192.168.184.166 mydockerhub.com

10.推送鏡像到https私有倉庫

docker push mydockerhub.com:5000/nginx

11.刪除本地鏡像並從新從https私有倉庫拉取鏡像

docker rmi mydockerhub.com:5000/nginx
docker pull mydockerhub.com:5000/nginx

 12.添加http basic authentication

docker run --entrypoint htpasswd  registry:2 -Bbn testuser testpassword > /root/auth/htpasswd

13.中止倉庫

docker stop  2a4c76559e18
docker start 2a4c76559e18

14.啓動http basic authentication倉庫

docker run -d \
--name registry \
-p 5000:5000 \
--restart=always \
--privileged=true \
-v /root/docker/registry:/var/lib/registry \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-v /root/auth:/root/auth \
-e "REGISTRY_AUTH_HTPASSWD_PATH=/root/auth/htpasswd" \
-v /root/certs/:/root/certs \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/root/certs/domain.crt \
-e REGISTRY_HTTP_TLS_KEY=/root/certs/domain.key \
registry

 

15.登陸倉庫

docker login mydockerhub.com:5000
username:testuser
password:testpassword

16.其餘服務器用這個私有倉庫，直接複製docker的倉庫服務器下的/etc/docker/cert.d/下的mydockerhub.com:5000/ca.cert目錄和文件，到本身的/etc/docker/cert.d/目錄下便可。

參考文檔：https://docs.docker.com/registry/deploying/#running-a-domain-registry