最新文章:
- Google Map api国内正常使用该如何配置(2021最新)
- wordpress国内网速慢加速及防DDOS攻击快速CF切换教程
- 2.18-3.31,共战疫情,阿里云免费送.网址域名
- Ubuntu安装时出现“failed to load ldlinux.c32”
- iconv函数报错 Detected an illegal character in input string
首页 运维技术
Docker创建仓库
发布时间:2017年10月27日 评论数:抢沙发 阅读数:4571
文章索引
一、docker仓库
Docker的仓库是DockerHub,类似于github,github有一个开源的软件叫gitlab。Docker也有一个开源软件docker registry。我们先查看镜像,找到registry
[root@linux-node1 ~]# docker search docker INDEX NAME DESCRIPTION STARS OFFICIAL AUTOMATED docker.io docker.io/jenkins Official Jenkins Docker image 3010 [OK] docker.io docker.io/alpine A minimal Docker image based on Alpine Lin... 2409 [OK] docker.io docker.io/registry The Docker Registry 2.0 implementation for... 1587 [OK] ...
我们可以通过docker pull 来下载一个
[root@linux-node1 ~]# docker pull registry
查看镜像
[root@linux-node1 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE youngcheung/nginx v3 b1fddf8a648d About an hour ago 401.2 MB youngcheung/nginx v2 7ad2cb731e7e 5 hours ago 381.9 MB youngcheung/nginx v1 76bed70bc348 5 hours ago 381.9 MB docker.io/registry latest 751f286bc25e 5 days ago 33.19 MB docker.io/nginx latest e4e6d42c70b3 2 weeks ago 107.5 MB docker.io/centos latest 36540f359ca3 2 weeks ago 192.5 MB
我们需要运行容器,注意默认端口5000是否被占用
启动容器
[root@linux-node1 ~]# docker run -d -p 5000:5000 registry 1e871b39b0756f48d05d56293e743670051817beddd910477de903888419f421
提示:docker比较老的版本运行起来就可以运行,1.7之后都不可以
我们现在来打个标签
[root@linux-node1 ~]# docker tag youngcheung/nginx:v3 192.168.56.10:5000/zhsir/mynginx:latest
然后,push 此时我们发现push不上去,因为Docker从1.3.X之后默认docker registry使用的是https,所以当用docker pull命令下载远程镜像时,如果远程docker registry是非https的时候就会报上面的错误。
[root@linux-node1 ~]# docker push 192.168.56.10:5000/zhsir/mynginx:latest The push refers to a repository [192.168.56.10:5000/zhsir/mynginx] Get https://192.168.56.10:5000/v1/_ping: http: server gave HTTP response to HTTPS client
提示:解决方法有2种,一种是去沃通或腾讯申请免费ssl,或者我们本地修改配置文件
方法一:安装nginx,制作https
[root@linux-node1 ~]# yum install nginx -y [root@linux-node1 ~]# vim /etc/nginx/nginx.conf … include /etc/nginx/conf.d/*.conf; …
因为在配置文件中已经指定了目录,只有放在/etc/nginx/conf.d/*下面才会识别到
配置如下:
[root@linux-node1 conf.d]# cat docker.conf upstream docker-registry { server 127.0.0.1:5000; } server { listen 443; server_name registry.zhsir.com ssl on; ssl_certificate /etc/ssl/nginx.crt; ssl_certificate_key /etc/ssl/nginx.key; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; client_max_body_size 0; chunked_transfer_encoding on; location / { auth_basic "Docker"; auth_basic_user_file /etc/nginx/conf.d/docker-registry.htpasswd; proxy_pass http://docker-registry; } location /_ping { auth_basic off; proxy_pass http://docker-registry; } location /v1/_ping { auth_basic off; proxy_pass http://docker-registry; } }
我们需要生成一个证书,大家可以申请一个沃通或者腾讯的免费ssl,如果有沃通的免费ssl就不需要设置,我们先设置一个根密钥,生产上直接使用沃通的免费ssl配置就可以了
[root@linux-node1 nginx]# cd /etc/pki/CA/ [root@linux-node1 CA]# [root@linux-node1 CA]# [root@linux-node1 CA]# touch ./{serial,index.txt} [root@linux-node1 CA]# echo "00" >serial [root@linux-node1 CA]# openssl genrsa -out private/cakey.pem 2048 Generating RSA private key, 2048 bit long modulus ..........................+++ .............................................+++ e is 65537 (0x10001) [root@linux-node1 CA]# openssl req -new -x509 -key private/cakey.pem -days 3650 -out cacert.pem You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BeiJing Locality Name (eg, city) [Default City]:BeiJing Organization Name (eg, company) [Default Company Ltd]:www.zhsir.org Organizational Unit Name (eg, section) []:docker Common Name (eg, your name or your server's hostname) []:registry.zhsir.com Email Address []:zhangyang1@afocus.com.cn
我们现在需要生产一个nginx的证书(生产可以直接使用运营商颁发的证书,不需要生成)
[root@linux-node1 CA]# cd /etc/ssl/ [root@linux-node1 ssl]# openssl genrsa -out nginx.key 2048 Generating RSA private key, 2048 bit long modulus ...................+++ .............................................................................................+++ e is 65537 (0x10001) [root@linux-node1 ssl]# openssl req -new -key nginx.key -out nginx.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BeiJing Locality Name (eg, city) [Default City]:BeiJing Organization Name (eg, company) [Default Company Ltd]:www.zhsir.org Organizational Unit Name (eg, section) []:docker Common Name (eg, your name or your server's hostname) []:registry.zhsir.com Email Address []:zhangyang1@afocus.com.cn Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: #后面两个直接回车
签发证书
[root@linux-node1 ssl]# openssl ca -in nginx.csr -days 365 -out nginx.crt Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 0 (0x0) Validity Not Before: Jul 26 16:51:43 2017 GMT Not After : Jul 26 16:51:43 2018 GMT Subject: countryName = CN stateOrProvinceName = BeiJing organizationName = www.zhsir.org organizationalUnitName = docker commonName = registry.zhsir.com emailAddress = zhangyang1@afocus.com.cn X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: EA:D5:6D:BA:E6:6B:F0:67:8C:D2:69:5D:37:19:90:77:B8:EE:C4:92 X509v3 Authority Key Identifier: keyid:9A:20:C0:DC:34:82:2C:6F:8D:42:57:EB:E6:75:49:11:5C:0E:FC:E1 Certificate is to be certified until Jul 26 16:51:43 2018 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
因为我们设置的是自签证书,要让系统允许
[root@linux-node1 ssl]# cat /etc/pki/CA/cacert.pem >> /etc/pki/tls/certs/ca-bundle.crt
然后创建一个用来验证的账号密码
[root@linux-node1 ssl]# htpasswd -c /etc/nginx/conf.d/docker-registry.htpasswd zhangyang New password: Re-type new password: Adding password for user zhangyang
#这个路径要跟nginx配置文件中的路径对应上,然后启动nginx
[root@linux-node1 ~]# systemctl start nginx
查看是否存在443端口
[root@linux-node1 ssl]# netstat -lntup Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 65743/nginx: master tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 22953/sshd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2725/master tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 65743/nginx: master tcp6 0 0 :::5000 :::* LISTEN 62640/docker-proxy- tcp6 0 0 :::80 :::* LISTEN 65743/nginx: master tcp6 0 0 :::22 :::* LISTEN 22953/sshd tcp6 0 0 ::1:25 :::* LISTEN 2725/master
我们还需要做一个绑定,设置host解析
[root@linux-node1 ssl]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 192.168.56.10 registry.zhsir.com
修改配置文件
[root@linux-node1 ~]# vim /etc/sysconfig/docker # Modify these options if you want to change the way the docker daemon runs OPTIONS='--selinux-enabled --insecure-registry 192.168.56.10:5000'
测试上传
[root@linux-node1 ~]# docker push 192.168.56.10:5000/zhsir/mynginx:latest The push refers to a repository [192.168.56.10:5000/zhsir/mynginx] 159e0c784414: Pushed fb2d6779346f: Pushed c4eab997fdda: Pushed e34375cdf1bb: Pushed 99b28d9413e4: Pushed latest: digest: sha256:71aaac410c29857d60357092b8f6604f3ebcd83b10fbd3e80e67fb2e3ee81f69 size: 1367
总结:
1、修改/etc/sysconfig/docker 配置文件,设置域名
2、构建镜像
[root@linux-node1 ~]# docker tag youngcheung/nginx:v3 192.168.56.10:5000/zhsir/mynginx:latest
3、上传到仓库中
[root@linux-node1 ~]# docker push 192.168.56.10:5000/zhsir/mynginx:latest
提交上去后,我们在其他服务器测试pull
首先我们修改配置文件,因为不是https,所以要修改/etc/sysconfig/docker配置文件,跟服务端修改的一样
设置hosts解析
然后我们使用docker pull即可
[root@linux-node2 ~]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE [root@linux-node2 ~]# docker pull 192.168.56.10:5000/zhsir/mynginx:latest Trying to pull repository 192.168.56.10:5000/zhsir/mynginx ... sha256:71aaac410c29857d60357092b8f6604f3ebcd83b10fbd3e80e67fb2e3ee81f69: Pulling from 192.168.56.10:5000/zhsir/mynginx e6e5bfbc38e5: Pull complete dcab844a57ba: Pull complete 806e3a8ff223: Pull complete 24a6c8df8920: Pull complete 7798d4f8222c: Pull complete Digest: sha256:71aaac410c29857d60357092b8f6604f3ebcd83b10fbd3e80e67fb2e3ee81f69 Status: Downloaded newer image for 192.168.56.10:5000/zhsir/mynginx:latest
查看镜像
[root@linux-node2 ]# docker images REPOSITORY TAG IMAGE ID CREATED SIZE 192.168.56.10:5000/zhsir/mynginx latest ff5ec8a1dd8e Less than a second ago 401.2 MB
创建并启动容器
[root@linux-node2 ]# docker run -d -it --name nginx1 -d -p 81:80 192.168.56.10:5000/zhsir/mynginx 67b5ef9fba585c5b0b3f1ee2481ecd48a9068d73a54c841ad713d338860fca54 [root@linux-node2 ~]# sh ns.sh nginx1 [root@67b5ef9fba58 ~]#
案例:按照我们上面的方法,制作一个nginx镜像并上传到docker仓库中,并运行容器启动nginx服务
[root@linux-node2 ~]# docker run -d --name nginx -p 87:80 192.168.56.10:5000/zhsir/mynginx 2b540821056a442306c071107c3c1d04aea7cca45cf2ab4f333d47e18fef5a6d [root@linux-node2 ~]# curl -I 192.168.56.11:87 HTTP/1.1 200 OK Server: nginx/1.10.2 Date: Tue, 13 Jun 2017 11:20:04 GMT Content-Type: text/html Content-Length: 10 Last-Modified: Wed, 26 Jul 2017 14:17:39 GMT Connection: keep-alive ETag: "5978a483-a" Accept-Ranges: bytes
二、docker仓库含义
我们制作好镜像后,默认存放在本地,只可以我们本机使用,其他服务器无法使用,这时候就需要我们一个docker仓库,其他服务器使用的时候只需要进行pull下来即可
Docker默认提供了一个仓库叫docker registry
Docker registry需要使用https进行验证
Docker registry私有仓库搭建基本几步流程(采用nginx+认证的方式)
1. 申请免费的ssl证书 https://buy.wosiqn.com/free 2. 设置nginx ssl证书 3. 设置验证 4. proxy_pass 5000 5. docker run -d -p 5000:5000 –name registry registry:2
本文地址:http://www.90qj.com/437.html 本文已经被百度收录,点击查看详情
版权声明:若无注明,本文皆为“挨踢 Blog”原创,转载请保留文章出处。