使用Docker搭建私有仓库Harbor

Harbor

无论是使用Docker-distribution去自建仓库，还是通过官方镜像跑容器的方式去自建仓库，通过前面的演示我们可以发现其是非常的简陋的，还不如直接使用官方的Docker Hub去管理镜像来得方便，至少官方的Docker Hub能够通过web界面来管理镜像，还能在web界面执行搜索，还能基于Dockerfile利用Webhooks和Automated Builds实现自动构建镜像的功能，用户不需要在本地执行docker build，而是把所有build上下文的文件作为一个仓库推送到github上，让Docker Hub可以从github上去pull这些文件来完成自动构建。

但无论官方的Docker Hub有多强大，它毕竟是在国外，所以速度是最大的瓶颈，我们很多时候是不可能去考虑使用官方的仓库的，但是上面说的两种自建仓库方式又十分简陋，不便管理，所以后来就出现了一个被 CNCF 组织青睐的项目，其名为Harbor。

Harbor简介

Harbor是由VMWare在Docker Registry的基础之上进行了二次封装，加进去了很多额外程序，而且提供了一个非常漂亮的web界面。

  • Harbor是一个开源可信的云原生的仓库项目，用于存储、用户管理和查找镜像。
  • Harbor通过添加用户通常需要的功能，如安全、身份和管理，扩展了开源Docker分发版。
  • Harbor支持高级特性，如用户管理、访问控制、活动监视和实例之间的复制。

Harbor的功能

  • 多租户内容签名和验证

  • 安全性和漏洞分析

  • 审计日志记录

  • 身份集成和基于角色的访问控制

  • 实例之间的映像复制

  • 可扩展API和图形UI

  • 国际化(目前为中英文化)

Docker compose

Harbor在物理机上部署是非常难的，而为了简化Harbor的应用，Harbor官方直接把Harbor做成了在容器中运行的应用，而且这个容器在Harbor中依赖类似redis、mysql、pgsql等很多存储系统，所以它需要编排很多容器协同起来工作，因此VMWare Harbor在部署和使用时，需要借助于Docker的单机编排

Compose是一个用于定义和运行多容器Docker应用程序的工具。使用Compose，您可以使用YAML文件来配置应用程序的服务。然后，通过一个命令，您可以创建并启动配置中的所有服务。

Docker Compose官方文档

Harbor安装

Harbor官方文档
harbor-offline-installer-v2.3.5.tgz

//修改主机名
[root@localhost ~]# hostname harbor.example.com
[root@localhost ~]# bash


//关闭防火墙
[root@harbor ~]# systemctl disable --now firewalld.service 
[root@harbor ~]# sed -i s/SELINUX=enforing/SELINUX=disabled/g /etc/selinux/config 
[root@harbor ~]# setenforce 0
[root@harbor ~]# reboot


//安装docker-compose（centos8）
[root@localhost ~]#  curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   664  100   664    0     0   1449      0 --:--:-- --:--:-- --:--:--  1446
100 12.1M  100 12.1M    0     0   419k      0  0:00:29  0:00:29 --:--:-- 2869k

[root@localhost ~]# chmod +x /usr/local/bin/docker-compose
[root@localhost ~]# ll /usr/local/bin/
总用量 3824
-rwxr-xr-x. 1 root root 12737304 12月 15 22:40 docker-compose
[root@localhost ~]# which docker-compose
/usr/local/bin/docker-compose


//下载安装harbor并解压
[root@harbor ~]# wget -c https://github.com/goharbor/harbor/releases/download/v2.3.5/harbor-offline-installer-v2.3.5.tgz
[root@harbor ~]# ls
anaconda-ks.cfg  harbor-offline-installer-v2.3.5.tgz
[root@harbor ~]# tar xf harbor-offline-installer-v2.3.5.tgz -C /usr/local/
[root@harbor ~]# ls /usr/local/
bin  etc  games  harbor  include  lib  lib64  libexec  sbin  share  src


//编写yaml文件
[root@harbor ~]# cd /usr/local/harbor/
[root@harbor harbor]# ls
common.sh  harbor.v2.3.5.tar.gz  harbor.yml.tmpl  install.sh  LICENSE  prepare
[root@harbor harbor]# cp harbor.yml.tmpl harbor.yml


//添加解析地址
[root@harbor ~]# cat /etc/hosts 
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.129.205 harbor.example.com

//修改配置文件
[root@harbor ~]# cat /usr/local/harbor/harbor.yml
hostname: harbor.example.com     #主机名修改为域名（也可以是ip）

#注释掉以下没注释的
# https related config
# https:
  # https port for harbor, default is 443     #因为未做https，所以将https全部注释
  # port: 443
  # The path of cert and key files for nginx
  # certificate: /your/certificate/path
  # private_key: /your/private/key/path

harbor_admin_password: harbor123               #web界面登录密码

//执行脚本
[root@harbor harbor]# ./install.sh 
[Step 5]: starting Harbor ...
Creating network "harbor_harbor" with the default driver
Creating harbor-log ... done
Creating redis         ... done
Creating harbor-portal ... done
Creating registry      ... done
Creating harbor-db     ... done
Creating registryctl   ... done
Creating harbor-core   ... done
Creating nginx             ... done
Creating harbor-jobservice ... done
✔ ----Harbor has been installed and started successfully.----		//安装成功


//查看镜像
[root@harbor harbor]# docker images
REPOSITORY                      TAG       IMAGE ID       CREATED      SIZE
goharbor/harbor-exporter        v2.3.5    1730c6f650e2   5 days ago   81.9MB
goharbor/chartmuseum-photon     v2.3.5    47004f032938   5 days ago   179MB
goharbor/redis-photon           v2.3.5    3d0cedc89a0d   5 days ago   156MB
goharbor/trivy-adapter-photon   v2.3.5    5c0212e98070   5 days ago   133MB
goharbor/notary-server-photon   v2.3.5    f20a76c65359   5 days ago   111MB
goharbor/notary-signer-photon   v2.3.5    b9fa38eef4d7   5 days ago   108MB
goharbor/harbor-registryctl     v2.3.5    7a52567a76ca   5 days ago   133MB
goharbor/registry-photon        v2.3.5    cf22d3e386b8   5 days ago   82.6MB
goharbor/nginx-photon           v2.3.5    5e3b6d9ce11a   5 days ago   45.7MB
goharbor/harbor-log             v2.3.5    a03e4bc963d6   5 days ago   160MB
goharbor/harbor-jobservice      v2.3.5    2ac32df5a2e0   5 days ago   211MB
goharbor/harbor-core            v2.3.5    23baee01156f   5 days ago   193MB
goharbor/harbor-portal          v2.3.5    bb545cdedf5a   5 days ago   58.9MB
goharbor/harbor-db              v2.3.5    9826c57a5749   5 days ago   221MB
goharbor/prepare                v2.3.5    a1ceaabe47b2   5 days ago   255MB

[root@harbor harbor]# docker ps
CONTAINER ID   IMAGE                                COMMAND                  CREATED          STATUS                             PORTS                                   NAMES
b4411ec6082c   goharbor/nginx-photon:v2.3.5         "nginx -g 'daemon of…"   13 seconds ago   Up 11 seconds (health: starting)   0.0.0.0:80->8080/tcp, :::80->8080/tcp   nginx
a4f0b16e201c   goharbor/harbor-jobservice:v2.3.5    "/harbor/entrypoint.…"   13 seconds ago   Up 11 seconds (health: starting)                                           harbor-jobservice
aba7b1c304eb   goharbor/harbor-core:v2.3.5          "/harbor/entrypoint.…"   13 seconds ago   Up 12 seconds (health: starting)                                           harbor-core
626609d9a68c   goharbor/registry-photon:v2.3.5      "/home/harbor/entryp…"   15 seconds ago   Up 13 seconds (health: starting)                                           registry
f2949670619c   goharbor/harbor-registryctl:v2.3.5   "/home/harbor/start.…"   15 seconds ago   Up 13 seconds (health: starting)                                           registryctl
cbbdda98e908   goharbor/harbor-db:v2.3.5            "/docker-entrypoint.…"   15 seconds ago   Up 13 seconds (health: starting)                                           harbor-db
a1c9f1572801   goharbor/redis-photon:v2.3.5         "redis-server /etc/r…"   15 seconds ago   Up 13 seconds (health: starting)                                           redis
2200dddc9b26   goharbor/harbor-portal:v2.3.5        "nginx -g 'daemon of…"   15 seconds ago   Up 13 seconds (health: starting)                                           harbor-portal
f15bd3dd9b5c   goharbor/harbor-log:v2.3.5           "/bin/sh -c /usr/loc…"   16 seconds ago   Up 14 seconds (health: starting)   127.0.0.1:1514->10514/tcp 

[root@harbor harbor]# ss -antl
State     Recv-Q    Send-Q         Local Address:Port         Peer Address:Port    Process    
LISTEN    0         128                127.0.0.1:1514              0.0.0.0:*                  
LISTEN    0         128                  0.0.0.0:80                0.0.0.0:*                  
LISTEN    0         128                  0.0.0.0:22                0.0.0.0:*                  
LISTEN    0         128                     [::]:80                   [::]:*                  
LISTEN    0         128                     [::]:22                   [::]:*

使用IP登录管理Harbor

账户：admin
密码：harbor23
在这里插入图片描述
在这里插入图片描述

登录

[root@dharbor ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.129.205 harbor.example.com

[root@harbor harbor]# vim /etc/docker/daemon.json
[root@harbor harbor]# cat /etc/docker/daemon.json
{
        "insecure-registries": ["harbor.example.com"]
}


//重启服务
[root@harbor harbor]# systemctl restart docker	//重启服务以后需要再跑一遍脚本，80端口才会启动


//登录
[root@harbor harbor]# docker login harbor.example.com
Authenticating with existing credentials...
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

推送前创建一个项目

在这里插入图片描述
在这里插入图片描述

重新打包镜像并推送

[root@harbor harbor]# docker images
REPOSITORY                      TAG       IMAGE ID       CREATED       SIZE
alpine                          latest    c059bfaa849c   2 weeks ago   5.59MB

[root@harbor harbor]# docker tag alpine:latest harbor.example.com/alpine-test/alpine:v0.1
[root@harbor harbor]# docker images
REPOSITORY                      TAG       IMAGE ID       CREATED       SIZE
alpine                                     latest    c059bfaa849c   2 weeks ago   5.59MB
harbor.example.com/alpine-test/alpine   v0.1      c059bfaa849c   2 weeks ago   5.59MB

[root@harbor harbor]# docker push harbor.example.com/alpine-test/alpine:v0.1 
The push refers to repository [harbor.example.com/alpine-test/alpine]
8d3ac3489996: Pushed 
v0.1: digest: sha256:e7d88de73db3d3fd9b2d63aa7f447a10fd0220b7cbf39803c803f2af9ba256b3 size: 528

效果

在这里插入图片描述
在这里插入图片描述
删除镜像后尝试拉取

[root@harbor harbor]# docker images
REPOSITORY                                 TAG       IMAGE ID       CREATED       SIZE
alpine                                     latest    c059bfaa849c   2 weeks ago   5.59MB
harbor.example.com/alpine-test/alpine      v0.1      c059bfaa849c   2 weeks ago   5.59MB

[root@harbor harbor]# docker rmi -f c059bfaa849c
[root@harbor harbor]# docker images
REPOSITORY                      TAG       IMAGE ID       CREATED      SIZE

[root@harbor harbor]# docker pull harbor.example.com/alpine-test/alpine:v0.1
v0.1: Pulling from alpine-test/alpine
59bf1c3509f3: Pull complete 
Digest: sha256:e7d88de73db3d3fd9b2d63aa7f447a10fd0220b7cbf39803c803f2af9ba256b3
Status: Downloaded newer image for harbor.example.com/alpine-test/alpine:v0.1
harbor.example.com/alpine-test/alpine:v0.1

[root@harbor harbor]# docker images
REPOSITORY                                 TAG       IMAGE ID       CREATED       SIZE
harbor.example.com/alpine-test/alpine   v0.1      c059bfaa849c   2 weeks ago   5.59MB

使用Harbor的注意事项：

  • 在客户端上传镜像时一定要记得执行docker login进行用户认证，否则无法直接push
  • 在客户端使用的时候如果不是用的https则必须要在客户端的/etc/docker/daemon.json配置文件中配置insecure-registries参数
  • 数据存放路径应在配置文件中配置到一个容量比较充足的共享存储中
  • Harbor是使用docker-compose命令来管理的，如果需要停止Harbor也应用docker-compose stop来停止，其他参数请–help

Harbor命令管理

可以使用命令 docker restart containerID逐个重启，也可以使用docker-compose进行重新启动：
（此命令需要在安装目录下执行）

[root@harbor harbor]# docker-compose stop
Stopping nginx             ... done
Stopping harbor-jobservice ... done
Stopping harbor-core       ... done
Stopping registry          ... done
Stopping registryctl       ... done
Stopping harbor-db         ... done
Stopping redis             ... done
Stopping harbor-portal     ... done
Stopping harbor-log        ... done
[root@harbor harbor]# docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

[root@harbor harbor]# docker-compose start
Starting harbor-log ... done
Starting harbor-db     ... done
Starting registryctl   ... done
Starting registry      ... done
Starting harbor-portal ... done
Starting redis         ... done
Starting harbor-core   ... done
Starting harbor-jobservice ... done
Starting nginx             ... done

[root@harbor harbor]# docker ps
CONTAINER ID   IMAGE                                COMMAND                  CREATED             STATUS                             PORTS                                   NAMES
b4411ec6082c   goharbor/nginx-photon:v2.3.5         "nginx -g 'daemon of…"   About an hour ago   Up 8 seconds (health: starting)    0.0.0.0:80->8080/tcp, :::80->8080/tcp   nginx
a4f0b16e201c   goharbor/harbor-jobservice:v2.3.5    "/harbor/entrypoint.…"   About an hour ago   Up 8 seconds (health: starting)                                            harbor-jobservice
aba7b1c304eb   goharbor/harbor-core:v2.3.5          "/harbor/entrypoint.…"   About an hour ago   Up 9 seconds (health: starting)                                            harbor-core
626609d9a68c   goharbor/registry-photon:v2.3.5      "/home/harbor/entryp…"   About an hour ago   Up 9 seconds (health: starting)                                            registry
f2949670619c   goharbor/harbor-registryctl:v2.3.5   "/home/harbor/start.…"   About an hour ago   Up 9 seconds (health: starting)                                            registryctl
cbbdda98e908   goharbor/harbor-db:v2.3.5            "/docker-entrypoint.…"   About an hour ago   Up 9 seconds (health: starting)                                            harbor-db
a1c9f1572801   goharbor/redis-photon:v2.3.5         "redis-server /etc/r…"   About an hour ago   Up 9 seconds (health: starting)                                            redis
2200dddc9b26   goharbor/harbor-portal:v2.3.5        "nginx -g 'daemon of…"   About an hour ago   Up 9 seconds (health: starting)                                            harbor-portal
f15bd3dd9b5c   goharbor/harbor-log:v2.3.5           "/bin/sh -c /usr/loc…"   About an hour ago   Up 10 seconds (health: starting)   127.0.0.1:1514->10514/tcp               harbor-log

Harbor的开机自启

[root@harbor ~]# cd /usr/local/harbor/
[root@harbor harbor]# vim harbor-start.sh 
[root@harbor harbor]# cat harbor-start.sh 
#!/bin/bash

cd /usr/local/harbor/ && docker-compose up -d &> /dev/null

[root@harbor harbor]# chmod +x harbor-start.sh


[root@harbor ~]# vim /etc/rc.d/rc.local
[root@harbor harbor]# cat /etc/rc.d/rc.local
#!/bin/bash
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.

touch /var/lock/subsys/local
/usr/local/harbor/harbor-start.sh

[root@harbor ~]# chmod +x /etc/rc.d/rc.local


//测试
[root@harbor harbor]# docker-compose stop
Stopping nginx             ... done
Stopping harbor-jobservice ... done
Stopping harbor-core       ... done
Stopping registry          ... done
Stopping registryctl       ... done
Stopping harbor-db         ... done
Stopping redis             ... done
Stopping harbor-portal     ... done
Stopping harbor-log        ... done
[root@harbor harbor]# docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
[root@harbor harbor]# reboot

连接断开
连接成功
Last login: Thu Dec 16 18:06:36 2021 from 192.168.129.1
[root@harbor harbor]# docker ps
CONTAINER ID   IMAGE                                COMMAND                  CREATED             STATUS                             PORTS                                   NAMES
b4411ec6082c   goharbor/nginx-photon:v2.3.5         "nginx -g 'daemon of…"   About an hour ago   Up 8 seconds (health: starting)    0.0.0.0:80->8080/tcp, :::80->8080/tcp   nginx
a4f0b16e201c   goharbor/harbor-jobservice:v2.3.5    "/harbor/entrypoint.…"   About an hour ago   Up 8 seconds (health: starting)                                            harbor-jobservice
aba7b1c304eb   goharbor/harbor-core:v2.3.5          "/harbor/entrypoint.…"   About an hour ago   Up 9 seconds (health: starting)                                            harbor-core
626609d9a68c   goharbor/registry-photon:v2.3.5      "/home/harbor/entryp…"   About an hour ago   Up 9 seconds (health: starting)                                            registry
f2949670619c   goharbor/harbor-registryctl:v2.3.5   "/home/harbor/start.…"   About an hour ago   Up 9 seconds (health: starting)                                            registryctl
cbbdda98e908   goharbor/harbor-db:v2.3.5            "/docker-entrypoint.…"   About an hour ago   Up 9 seconds (health: starting)                                            harbor-db
a1c9f1572801   goharbor/redis-photon:v2.3.5         "redis-server /etc/r…"   About an hour ago   Up 9 seconds (health: starting)                                            redis
2200dddc9b26   goharbor/harbor-portal:v2.3.5        "nginx -g 'daemon of…"   About an hour ago   Up 9 seconds (health: starting)                                            harbor-portal
f15bd3dd9b5c   goharbor/harbor-log:v2.3.5           "/bin/sh -c /usr/loc…"   About an hour ago   Up 10 seconds (health: starting)   127.0.0.1:1514->10514/tcp               harbor-log
# docker # 容器 # 运维
Logo
向您推荐>>Eolink开发者社区

权威｜前沿｜技术｜干货｜国内首个API全生命周期开发者社区

更多推荐

ELK实现containerd的容器日志采集展示【基于logging的全栈监测】

企业级ELK Stack构建介绍

avatar 云原生

深入理解 Mocha 测试框架：从零实现一个 Mocha

前言什么是自动化测试自动化测试在很多团队中都是Devops环节中很难执行起来的一个环节，主要原因在于测试代码的编写工作很难抽象，99%的场景都需要和业务强绑定，而且写测试代码的编写工作量往往比编写实际业务代码的工作量更多。在一些很多业务场景中投入产出比很低，适合写自动化测试的应该是那些中长期业务以及一些诸如组件一样的基础库。自动化测试是个比较大的概念，其中分类也比较多，比如单元测试，端对端测试，集

avatar 云原生

(20200916 Solved)docker-compose up创建容器自动退出

问题描述如题，创建容器后自动退出了。并且docker start container无效解决方案原因是缺失了控制终端的配置，需要在docker-compose.yml中增加tty:true ，有时候这样也不行，需要再增加一个command:/bin/bash，命令不一定是这个，需要是一个不会退出的命令，然后用-d后台启动容器。Referencesdocker-compose启动容器后自动退出...

avatar 云原生