基于百度云 BOS 搭建私有 Docker Registry
基于百度云 BOS 搭建私有 Docker Registry
Docker Registry 作为 Docker 的核心组件之一负责了镜像的存储以及分发。用户只需要使用 Docker 的客户端就可以直接和 Registry 进行交互,下载和上传镜像。
百度对象存储 BOS (Baidu Object Storage) 提供稳定、安全、高效以及高扩展存储服务。
Baidu BOS storage driver 基于官方 Docker Registry 源码,结合百度云 Go 语言SDK:https://github.com/guoyao/baidubce-sdk-go.git,通过实现 storagedriver.StorageDriver 接口,提供了一个针对百度云 BOS 的 Storage Driver。
准备工作
-
安装 Docker Engine,如何安装请参考 Docker官方文档
-
下载 Registry 镜像(或者通过源码仓库https://github.com/guoyao/distribution.git 自己 build 一个镜像)
docker pull guoyao/registry:0.6.0
因为是从Docker官方Registry下载镜像,速度会比较慢,可以配置国内的镜像加速
-
注册百度云账号,开通 BOS 服务,在百度云 BOS 控制台新建一个 Bucket,假设 Bucket 名称为 registry-test
部署私有 Docker Registry
-
为 Registry 相关的配置新建一个单独的目录
mkdir registry && cd registry
-
在当前目录下新建我们的账户密码(最简单的账户验证方式)
mkdir auth htpasswd -Bbn admin 123456 > auth/htpasswd
-
启动 Registry
docker run -d \ -v `pwd`/auth:/auth:ro \ -e REGISTRY_AUTH=htpasswd \ -e REGISTRY_AUTH_HTPASSWD_REALM=basic-realm \ -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \ -e REGISTRY_STORAGE=bos \ -e REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK \ -e REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK \ -e REGISTRY_STORAGE_BOS_REGION=bj \ -e REGISTRY_STORAGE_BOS_BUCKET=registry-test \ -p 5000:5000 \ --restart=always \ guoyao/registry:0.6.0
详细的 BOS STORAGE 的配置文档在这里: https://github.com/guoyao/distribution/blob/release/0.6/docs/storage-drivers/bos.md
-
操作镜像
Login
docker login localhost:5000
根据命令行提示输入之前设置的用户名:admin,密码:123456;登录成功会提示:Login Succeeded
Push
首先通过 Dockerfile 生成一个镜像,或者修改一个已有镜像的 tag,比如:localhost:5000/busybox
docker push localhost:5000/busybox
推送成功后就可以在百度云 BOS 控制台查看到这个镜像了
Pull
docker pull localhost:5000/busybox
上述方式只能通过 localhost 来 push 和 pull 镜像,如果想通过公网 域名 或 IP,需要配置 --insecure-registry xxx.xxx.xxx.xxx 到 Docker Deamon 的启动参数中,并重启 Docker Deamon,否则会报错:
Error response from daemon: Get https://xxx.xxx.xxx.xxx:5000/v1/users/: http: server gave HTTP response to HTTPS client
通过域名访问 & 配置https证书
如果不希望配置 --insecure-registry 参数,你需要购买一个独立的域名(假设为 myregistrydomain.com),并且申请该域名的 https 证书,将证书 xxx.crt 和 xxx.key 文件放在当前 certs 子目录下,然后在启动 Registry 时,配置证书:
docker run -d \ -v `pwd`/auth:/auth:ro \ -e REGISTRY_AUTH=htpasswd \ -e REGISTRY_AUTH_HTPASSWD_REALM=basic-realm \ -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \ -v `pwd`/certs:/certs:ro \ -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/xxx.crt \ -e REGISTRY_HTTP_TLS_KEY=/certs/xxx.key \ -e REGISTRY_STORAGE=bos \ -e REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK \ -e REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK \ -e REGISTRY_STORAGE_BOS_REGION=bj \ -e REGISTRY_STORAGE_BOS_BUCKET=registry-test \ -p 443:5000 \ --restart=always \ guoyao/registry:0.6.0
既然已经使用 https 证书了,我们把对外暴露的端口换成 443 端口,然后就可以直接通过域名来操作镜像了:
docker login myregistrydomain.com docker push myregistrydomain.com/busybox docker pull myregistrydomain.com/busybox
更多关于部署 Registry 的内容,可以参考官方文档:https://docs.docker.com/registry/deploying/
配置 Nginx 代理访问
因为要启动多个容器,这里我们使用 docker-compose 来做容器编排,首先安装 docker-compose(需要使用 root 用户来安装),安装方式如下:
curl -L https://github.com/docker/compose/releases/download/1.10.1/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose chmod +x /usr/local/bin/docker-compose
- 创建 nginx 主配置文件
cat > auth/nginx.conf << 'EOF' events { worker_connections 1024; } http { upstream docker-registry { server registry:5000; } ## Set a variable to help us decide if we need to add the ## 'Docker-Distribution-Api-Version' header. ## The registry always sets this header. ## In the case of nginx performing auth, the header will be unset ## since nginx is auth-ing before proxying. map $upstream_http_docker_distribution_api_version $docker_distribution_api_version { '' 'registry/2.0'; } server { listen 443 ssl; server_name myregistrydomain.com; # SSL ssl_certificate /certs/xxx.crt; ssl_certificate_key /certs/xxx.key; # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html ssl_protocols TLSv1.1 TLSv1.2; ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; # disable any limits to avoid HTTP 413 for large image uploads client_max_body_size 0; # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486) chunked_transfer_encoding on; location /v2/ { # Do not allow connections from docker 1.5 and earlier # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) { return 404; } # To add basic authentication to v2 use auth_basic setting. auth_basic "Registry realm"; auth_basic_user_file /etc/nginx/conf.d/htpasswd; ## If $docker_distribution_api_version is empty, the header will not be added. ## See the map directive above where this variable is defined. add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always; proxy_pass http://docker-registry; proxy_set_header Host $http_host; # required for docker client's sake proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 900; } } } EOF
- 创建 docker-compose.yml 文件
nginx: image: nginx:1.9 ports: - 443:443 links: - registry:registry volumes: - ./auth:/etc/nginx/conf.d:ro - ./auth/nginx.conf:/etc/nginx/nginx.conf:ro - ./certs:/certs:ro registry: image: guoyao/registry:0.6.0 environment: - REGISTRY_STORAGE=bos - REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK - REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK - REGISTRY_STORAGE_BOS_REGION=bj - REGISTRY_STORAGE_BOS_BUCKET=registry-test
- 启动容器
docker-compose up -d
更多关于配置 Nginx 代理访问 Registry 的内容,可以参考官方文档:https://docs.docker.com/registry/recipes/nginx/
- 基于Docker搭建Registry私有镜像仓库
- Docker私有仓库Registry的搭建验证
- Docker私有仓库Registry的搭建验证
- docker 搭建私有仓库registry (多用户)
- docker registry V2私有仓库搭建
- Docker Registry Server 搭建,配置免费HTTPS证书,及拥有权限认证的私有仓库
- 使用docker Registry快速搭建私有镜像仓库
- Docker私有仓库Registry 搭建
- Docker搭建基于Token认证的的Registry服务
- 利用registry搭建局域网docker私有仓库
- docker搭建私有registry
- Docker私有仓库Registry及Auth-server认证搭建
- 在 ubuntu 搭建需要签名认证的私有 docker registry 仓库
- 在CentOS 6上搭建私有的Docker Registry
- Docker--------Harbor registry私有仓库搭建 [ Http ]
- 在RHEL 7上如何搭建本地私有的docker registry
- 基于Docker的以太坊私有环境搭建
- Docker私有仓库Registry搭建(localhost 可行但跨主机有问题)
- 详解Docker私有仓库Registry的搭建验证
- docker私有仓库搭建 使用Portus管理docker registry 私有仓库