1、harbor介绍
Docker容器应用的开发和运行离不开可靠的镜像管理，虽然docker官方提供了公共的镜像仓库（Docker Hub），但是从安全和效率等方面考虑，部署我们私有环境内的Registry也是非常必要的。Harbor是由VMware公司开源的企业级的Docker Registry管理项目，它包括权限管理（RBAC）、LDAP、日志审核、界面管理、自我注册、镜像复制和中文支持等功能。
2、安装配置
- 机器环境
主机：172.17.207.44
- 环境配置：
docker: 19.03.12
docker-compose: 1.26.2
Harbor: v1.8.0
注意：Harbor的所有服务组件都是在Docker中部署，所以官方安装使用Docker-compose快速部署，所以我们需要安装Docker、Docker-compose。由于Harbor是基于Docker Registry V2版本，所以就要求Docker版本不小于1.10.0，Docker-compose版本不小于1.6.0。
3、docker安装
3.1、安装一些必要的系统工具
yum install -y yum-utils device-mapper-persistent-data lvm2
3.2、添加docker镜像源
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
3.3、安装docker-ce
yum -y install docker-ce
3.4、启动docker服务
systemctl start docker
补充：
- 重启docker服务
sudo systemctl restart docker
- 关闭docker
sudo systemctl stop docker
4、docker-compose安装
curl -L https://github.com/docker/compose/releases/download/1.26.2/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
docker-compose version
5、Harbor私有仓库安装
5.1、下载Harbor安装文件
从 github harbor 官网 release 页面下载指定版本的安装包。
- 在线安装包
wget https://github.com/goharbor/harbor/releases/download/v2.0.2/harbor-online-installer-v2.0.2.tgz
tar xvf harbor-online-installer-v2.0.2.tgz
- 离线安装包
wget https://github.com/goharbor/harbor/releases/download/v2.0.2/harbor-offline-installer-v2.0.2.tgz
tar xvf harbor-offline-installer-v2.0.2.tgz
如果服务器的网络带宽不行的话，建议使用离线安装，提前下载完上传到服务器
5.2、配置Harbor
进入harbor目录，复制harbor.yml.tmpl为harbor.yml：
cp harbor.yml.tmpl harbor.yml
打开harbor.yml进行配置
# Configuration file of Harbor
# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
# hostname设置访问地址，可以使用ip、域名，不可以设置为127.0.0.1或localhost
hostname: xx.xx.xx.xx
# http related config
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 80
# https related config
# 这里如果https不启用，记得要注释掉啊
#https:
# # https port for harbor, default is 443
# port: 443
# # The path of cert and key files for nginx
# certificate: /root/harbor/data/yaduo.pem
# private_key: /root/harbor/data/yaduo.key
# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433
# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: Harbor12345
# Harbor DB configuration
database:
# The password for the root user of Harbor DB. Change this before any production use.
password: only1234
# The default data volume
data_volume: /data
# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
# # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
# # of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate.
# ca_bundle:
# # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
# # for more info about this configuration please refer https://docs.docker.com/registry/configuration/
# filesystem:
# maxthreads: 100
# # set disable to true when you want to disable registry redirect
# redirect:
# disabled: false
# Clair configuration
clair:
# The interval of clair updaters, the unit is hour, set to 0 to disable the updaters.
updaters_interval: 12
# Config http proxy for Clair, e.g. http://my.proxy.com:3128
# Clair doesn't need to connect to harbor internal components via http proxy.
http_proxy:
https_proxy:
no_proxy: 127.0.0.1,localhost,core,registry
jobservice:
# Maximum number of job workers in job service
max_job_workers: 10
chart:
# Change the value of absolute_url to enabled can enable absolute url in chart
absolute_url: disabled
# Log configurations
log:
# options are debug, info, warning, error, fatal
level: info
# Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
rotate_count: 50
# Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
# If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
# are all valid.
rotate_size: 200M
# The directory on your host that store log
location: /var/log/harbor
#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 2.0.0
# Uncomment external_database if using external database. Currently only support POSTGRES.
# Four databases are needed to be create first by users for Harbor core, Clair, Notary server
# and Notary signer. And the tables will be generated automatically when Harbor starting up.
# NOTE: external_database is unable to custom attributes individually, you must do them in block.
# external_database:
# harbor:
# host: harbor_db_host
# port: harbor_db_port
# db_name: harbor_db_name
# username: harbor_db_username
# password: harbor_db_password
# ssl_mode: disable
# clair:
# host: clair_db_host
# port: clair_db_port
# db_name: clair_db_name
# username: clair_db_username
# password: clair_db_password
# ssl_mode: disable
# notary_signer:
# host: notary_signer_db_host
# port: notary_signer_db_port
# db_name: notary_signer_db_name
# username: notary_signer_db_username
# password: notary_signer_db_password
# ssl_mode: disable
# notary_server:
# host: notary_server_db_host
# port: notary_server_db_port
# db_name: notary_server_db_name
# username: notary_server_db_username
# password: notary_server_db_password
# ssl_mode: disable
# Uncomment external_redis if using external Redis server
# external_redis:
# host: redis
# port: 6379
# password:
# # db_index 0 is for core, it's unchangeable
# registry_db_index: 1
# jobservice_db_index: 2
# chartmuseum_db_index: 3
# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
# ca_file: /path/to/ca
5.3、启动Harbor
-
启动
修改完配置文件后，在的当前目录执行./install.sh，Harbor服务就会根据当期目录下的docker-compose.yml开始下载依赖的镜像，检测并按照顺序依次启动各镜像。 -
Harbor依赖的镜像及启动服务如下：
[root@localhost harbor]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
goharbor/chartmuseum-photon v2.0.2 7d8c1998edaf 4 weeks ago 175MB
goharbor/redis-photon v2.0.2 e547529bb6a1 4 weeks ago 72.3MB
goharbor/trivy-adapter-photon v2.0.2 f1b9e460421b 4 weeks ago 109MB
goharbor/clair-adapter-photon v2.0.2 9ec8853dc3cb 4 weeks ago 62MB
goharbor/clair-photon v2.0.2 73885002dda7 4 weeks ago 171MB
goharbor/notary-server-photon v2.0.2 0bd9c48f4c83 4 weeks ago 142MB
goharbor/notary-signer-photon v2.0.2 b7b1fee70606 4 weeks ago 139MB
goharbor/harbor-registryctl v2.0.2 9f8b7bb0f1ff 4 weeks ago 101MB
goharbor/registry-photon v2.0.2 eac8c5fc9ca8 4 weeks ago 83.6MB
goharbor/nginx-photon v2.0.2 eee4771b916c 4 weeks ago 43.6MB
goharbor/harbor-log v2.0.2 b2db762a6c3a 4 weeks ago 82.1MB
goharbor/harbor-jobservice v2.0.2 3960e027ccb9 4 weeks ago 164MB
goharbor/harbor-core v2.0.2 de2495b944cf 4 weeks ago 145MB
goharbor/harbor-portal v2.0.2 90088a0e64a9 4 weeks ago 52.5MB
goharbor/harbor-db v2.0.2 81e98a7af097 4 weeks ago 161MB
goharbor/prepare v2.0.2 7e804db05454 4 weeks ago 160MB
[root@localhost harbor]# docker-compose ps
Name Command State Ports
---------------------------------------------------------------------------------------------
harbor-core /harbor/entrypoint.sh Up (healthy)
harbor-db /docker-entrypoint.sh Up (healthy) 5432/tcp
harbor-jobservice /harbor/entrypoint.sh Up (healthy)
harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp
harbor-portal nginx -g daemon off; Up (healthy) 8080/tcp
nginx nginx -g daemon off; Up (healthy) 0.0.0.0:80->8080/tcp
redis redis-server /etc/redis.conf Up (healthy) 6379/tcp
registry /home/harbor/entrypoint.sh Up (healthy) 5000/tcp
registryctl /home/harbor/start.sh Up (healthy)
启动完成后就可以访问刚刚在配置文件中设置的hostname。默认是80端口，如果端口占用，我们可以去修改harbor.yml文件中，对应服务的端口映射。
默认账号密码：admin，Harbor12345
系统的地址：http://172.17.207.44/
6、docker的http方式登录
如果harbor为http方式（例如上述的：http://172.17.207.44/），需要添加运行http权限的地址信息，方式如下：
- 方式一
vim /usr/lib/systemd/system/docker.service
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
BindsTo=containerd.service
After=network-online.target firewalld.service containerd.service
Wants=network-online.target
Requires=docker.socket
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
# 这里使用参数--insecure-registry配置运行http权限的地址信息
ExecStart=/usr/bin/dockerd --insecure-registry=172.17.207.44 -H fd:// --containerd=/run/containerd/containerd.sock
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always
配置完成后重启docker生效：
systemctl daemon-reload
systemctl restart docker
- 方式二
vim /etc/sysconfig/docker
# 在OPTIONS下添加--insecure-registry=<host-ip>:<host-port>
OPTIONS='--selinux-enabled --log-driver=json-file --signature-verification=false --insecure-registry=172.17.207.44:80'
# 重启docker
systemctl restart docker
7、多镜像配置
配置文件 /etc/docker/daemon.json 为如下镜像地址：
注：主要是配置registry-mirrors和insecure-registries两项。
{
"registry-mirrors":[
"https://docker.mirrors.ustc.edu.cn",
"http://hub-mirror.c.163.com",
"http://172.17.207.44"
],
"insecure-registries": ["127.0.0.1/8","172.17.207.44"],
"max-concurrent-downloads":10,
"log-driver":"json-file",
"log-level":"warn",
"log-opts":{
"max-size":"10m",
"max-file":"3"
},
"data-root":"/var/lib/docker"
}
本文标题：基于Harbor的Docker私有镜像仓库搭建
本文链接：https://blog.quwenai.cn/post/8376.html
版权声明：本文不使用任何协议授权，您可以任何形式自由转载或使用。
还没有评论，来说两句吧...