docker registry v2 nginx 安全访问控制

环境准备：
docker 版本：1.9.1
registry版本：2.2.1

本文之前也有发过一篇自建仓库nginx认证，但是对新出的registry v2版本不适用，特重更一篇。
一、创建相关目录及文件

(1)目录结构
auth
│ ├── domain.crt
│ ├── domain.key
│ ├── nginx.conf
│ └── nginx.htpasswd
├── data

123	mkdir -p authmkdir -p dataopenssl req -newkey rsa:4096 -nodes -sha256 -keyout auth/domain.key -x509 -days 365 -out auth/domain.crt

例如：

123456789

Country Name (2 letter code) [AU]:Chinastring is too long, it needs to be less than 2 bytes longCountry Name (2 letter code) [AU]:CHState or Province Name (full name) [Some-State]:BeiJingLocality Name (eg, city) []:BeiJing Organization Name (eg, company) [Internet Widgits Pty Ltd]:BeiJingOrganizational Unit Name (eg, section) []:BeiJing Common Name (e.g. server FQDN or YOUR name) []:registry.test.comEmail Address []:BeiJing@beijing.com

(2)生成对应nginx配置文件

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051

cat <<EOF > auth/nginx.confupstream docker-registry { server registry:5000;} server { listen 443 ssl; server_name default_server; # SSL ssl on; ssl_certificate /etc/nginx/conf.d/domain.crt; ssl_certificate_key /etc/nginx/conf.d/domain.key; # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html ssl_protocols TLSv1.1 TLSv1.2; ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; # disable any limits to avoid HTTP 413 for large image uploads client_max_body_size 0; # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486) chunked_transfer_encoding on; location /v2/ { # Do not allow connections from docker 1.5 and earlier # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents if (\$http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*\$" ) { return 404; } # To add basic authentication to v2 use auth_basic setting. auth_basic "Registry realm"; auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd; ## If $docker_distribution_api_version is empty, the header will not be added. ## See the map directive above where this variable is defined. add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always; proxy_pass http://docker-registry; proxy_set_header Host \$http_host; # required for docker client's sake proxy_set_header X-Real-IP \$remote_addr; # pass on real client's IP proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto \$scheme; proxy_read_timeout 900; }}EOF

(3)创建登录用户文件

1	htpasswd -cb auth/nginx.htpasswd admin admin

(4)使用docker-compose启动

12345678910111213141516171819

cat <<EOF > docker-compose.ymlnginx: image: "nginx:latest" ports: - 443:443 restart: always links: - registry:registry volumes: - `pwd`/auth/:/etc/nginx/conf.d registry: image: registry:2.2.1 ports: - 127.0.0.1:5000:5000 restart: always volumes: - `pwd`/data:/var/lib/registryEOF

启动命令：

12345

docker-compose up -d(5)验证curl -i -k -v https://admin:admin@registry.test.com/v2/登录： docker login registry.test.com查看上传的镜像信息： curl -i -k -v https://admin:admin@registry.test.com/v2/_catalog

本文出自 “TNT、运维之路” 博客，请务必保留此出处/article/4415526.html