容器云平台No.5~企业级私有镜像仓库Harbor V2.02

镜像仓库

仓库，顾名思义，就是存放东西的地方，Docker仓库,理所当然，就是存放docker镜像的地方了。

Docker仓库分公有仓库和私有仓库。共有仓库有hub.docker.com、gcr.io、k8s.gcr.io等，一般常用开源应用程序的官方镜像都存放于共有仓库，但是鉴于这些仓库都在国外，下载速度比较慢。尤其k8s相关的镜像，得魔法上网。

私有仓库一般是公司内部自行搭建，用于存放内部构建的docker镜像，部署服务时从私有仓库下载，分发速度快。

Docker 官方提供了一个搭建私有仓库的镜像 registry ，只需把镜像下载下来，运行容器并暴露5000端口，就可以使用了。这里不做详细介绍。

harbor

一个用于存储docker镜像的企业级Registry服务。相比较于原生的Regisrty来说，它具有很多的优势。

提供分层传输机制，优化网络传输
提供WEB界面，优化用户体验
支持水平扩展集群
良好的安全机制
Harbor提供了基于角色的访问控制机制，并通过项目来对镜像进行组织和访问权限的控制

harbor架构图

安装harbor

PS：因为镜像仓库属于基础服务，建议使用单独的服务器部署。

1、下载离线安装包

# wget https://github.com/goharbor/harbor/releases/download/v2.0.2/harbor-offline-installer-v2.0.2.tgz

2、解压并根据需求自行修改harbor.yml配置文件，这里直接是用默认

# tar -zxf harbor-offline-installer-v2.0.2.tgz

# cd harbor/

# mv  harbor.yml.tmpl harbor.yml

3、执行安装命令

这里使用默认安装，感兴趣的可以安装更多Notary, Clair, or Chart Repository Service等服务。使用./install.sh --with-notary --with-clair --with-chartmuseum

./install.sh

Note: docker version: 19.03.12

[Step 1]: checking docker-compose is installed ...

Note: docker-compose version: 1.26.2

[Step 2]: loading Harbor images ...

Loaded image: goharbor/prepare:v2.0.2

Loaded image: goharbor/harbor-jobservice:v2.0.2

Loaded image: goharbor/harbor-registryctl:v2.0.2

Loaded image: goharbor/registry-photon:v2.0.2

Loaded image: goharbor/harbor-core:v2.0.2

Loaded image: goharbor/notary-signer-photon:v2.0.2

Loaded image: goharbor/clair-photon:v2.0.2

Loaded image: goharbor/trivy-adapter-photon:v2.0.2

Loaded image: goharbor/harbor-log:v2.0.2

Loaded image: goharbor/nginx-photon:v2.0.2

Loaded image: goharbor/clair-adapter-photon:v2.0.2

Loaded image: goharbor/chartmuseum-photon:v2.0.2

Loaded image: goharbor/harbor-portal:v2.0.2

Loaded image: goharbor/harbor-db:v2.0.2

Loaded image: goharbor/redis-photon:v2.0.2

Loaded image: goharbor/notary-server-photon:v2.0.2

[Step 3]: preparing environment ...

[Step 4]: preparing harbor configs ...

prepare base dir is set to /opt/harbor

WARNING:root:WARNING: HTTP protocol is insecure. Harbor will deprecate http protocol in the future. Please make sure to upgrade to https

Generated configuration file: /config/log/logrotate.conf

Generated configuration file: /config/log/rsyslog_docker.conf

Generated configuration file: /config/nginx/nginx.conf

Generated configuration file: /config/core/env

Generated configuration file: /config/core/app.conf

Generated configuration file: /config/registry/config.yml

Generated configuration file: /config/registryctl/env

Generated configuration file: /config/registryctl/config.yml

Generated configuration file: /config/db/env

Generated configuration file: /config/jobservice/env

Generated configuration file: /config/jobservice/config.yml

Generated and saved secret to file: /data/secret/keys/secretkey

Successfully called func: create_root_cert

Generated configuration file: /compose_location/docker-compose.yml

Clean up the input dir

[Step 5]: starting Harbor ...

Creating network "harbor_harbor" with the default driver

Creating harbor-log ... done

Creating harbor-portal ... done

Creating registry      ... done

Creating registryctl   ... done

Creating redis         ... done

Creating harbor-db     ... done

Creating harbor-core   ... done

Creating harbor-jobservice ... done

Creating nginx             ... done

 ----Harbor has been installed and started successfully.----

查看下运行了哪些服务？

docker ps

CONTAINER ID        IMAGE                                COMMAND                  CREATED             STATUS                   PORTS                       NAMES

8d746c430f3e        goharbor/harbor-jobservice:v2.0.2    "/harbor/entrypoint."   4 minutes ago       Up 4 minutes (healthy)                               harbor-jobservice

388f24831ec9        goharbor/nginx-photon:v2.0.2         "nginx -g 'daemon of"   4 minutes ago       Up 4 minutes (healthy)   0.0.0.0:80->8080/tcp        nginx

15bc12fd3826        goharbor/harbor-core:v2.0.2          "/harbor/entrypoint."   4 minutes ago       Up 4 minutes (healthy)                               harbor-core

bb48e39130e5        goharbor/harbor-db:v2.0.2            "/docker-entrypoint."   4 minutes ago       Up 4 minutes (healthy)   5432/tcp                    harbor-db

1bcd0ffcae82        goharbor/harbor-registryctl:v2.0.2   "/home/harbor/start."   4 minutes ago       Up 4 minutes (healthy)                               registryctl

8ef9f3d3a668        goharbor/redis-photon:v2.0.2         "redis-server /etc/r"   4 minutes ago       Up 4 minutes (healthy)   6379/tcp                    redis

e05d4d845f3f        goharbor/harbor-portal:v2.0.2        "nginx -g 'daemon of"   4 minutes ago       Up 4 minutes (healthy)   8080/tcp                    harbor-portal

c5fcd2369931        goharbor/registry-photon:v2.0.2      "/home/harbor/entryp"   4 minutes ago       Up 4 minutes (healthy)   5000/tcp                    registry

61e69b171b33        goharbor/harbor-log:v2.0.2           "/bin/sh -c /usr/loc"   4 minutes ago       Up 4 minutes (healthy)   127.0.0.1:1514->10514/tcp   harbor-log

从输出信息可以看出，安装不服务组件还是挺多的，可以参考架构图。

至此，harbor安装好了，现在来测试下往这个仓库上传镜像、从这个私有仓库下载镜像

上传镜像

首先登陆私有仓库

docker login 10.26.27.106

Username: admin

Password:

Error response from daemon: Get https://10.26.27.106/v2/: dial tcp 10.26.27.106:443: connect: connection refused

发现，登陆失败，因为这里仓库没有配置https，docker默认只允许登陆https的服务，http认为是不安全的。

现在我们来修改docker的配置，允许docker登陆不安全的仓库

vim /etc/docker/daemon.json,添加"insecure-registries":["10.26.27.106"]

{

  "registry-mirrors": ["https://ci7pm4nx.mirror.aliyuncs.com","https://registry.docker-cn.com","http://hub-mirror.c.163.com"],

  "insecure-registries":["10.26.27.106"]

}

再次登陆

# systemctl restart docker

# docker login http://10.26.27.106

Username: admin

Password:

WARNING! Your password will be stored unencrypted in /root/.docker/config.json.

Configure a credential helper to remove this warning. See

https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

现在看到，已经登陆成功了，让我们从公有仓库下载一个镜像，然后传到私有仓库中

docker pull busybox

Using default tag: latest

latest: Pulling from library/busybox

df8698476c65: Pull complete

Digest: sha256:d366a4665ab44f0648d7a00ae3fae139d55e32f9712c67accd604bb55df9d05a

Status: Downloaded newer image for busybox:latest

docker.io/library/busybox:latest

使用tag个给刚才下载的busybox镜像打标签，改为10.26.27.106/library/busybox:latest

# docker tag busybox:latest 10.26.27.106/library/busybox:latest

# docker push 10.26.27.106/library/busybox:latest

The push refers to repository [10.26.27.106/library/busybox]

be8b8b42328a: Pushed

latest: digest: sha256:2ca5e69e244d2da7368f7088ea3ad0653c3ce7aaccd0b8823d11b0d5de956002 size: 527

可以看到，已经上传成功。

下载镜像

首先我们删除所以的busybox镜像

docker images|grep busybox

10.26.27.106/libary/busybox                         latest              6858809bf669        4 days ago          1.23MB

10.26.27.106/library/busybox                        latest              6858809bf669        4 days ago          1.23MB

busybox                                             latest              6858809bf669        4 days ago          1.23MB

docker rmi busybox 10.26.27.106/library/busybox     10.26.27.106/libary/busybox

Untagged: busybox:latest

Untagged: busybox@sha256:d366a4665ab44f0648d7a00ae3fae139d55e32f9712c67accd604bb55df9d05a

Untagged: 10.26.27.106/library/busybox:latest

Untagged: 10.26.27.106/library/busybox@sha256:2ca5e69e244d2da7368f7088ea3ad0653c3ce7aaccd0b8823d11b0d5de956002

Untagged: 10.26.27.106/libary/busybox:latest

Deleted: sha256:6858809bf669cc5da7cb6af83d0fae838284d12e1be0182f92f6bd96559873e3

Deleted: sha256:be8b8b42328a15af9dd6af4cba85821aad30adde28d249d1ea03c74690530d1c

下载镜像

docker pull 10.26.27.106/library/busybox

Using default tag: latest

latest: Pulling from library/busybox

df8698476c65: Pull complete

Digest: sha256:2ca5e69e244d2da7368f7088ea3ad0653c3ce7aaccd0b8823d11b0d5de956002

Status: Downloaded newer image for 10.26.27.106/library/busybox:latest

10.26.27.106/library/busybox:latest

可以看到，下载成功，收工￥#@￥#@￥@