| 服务器版本 | docker软件版本 | CPU架构 |
|---|---|---|
| CentOS Linux release 7.4.1708 (Core) | Docker version 20.10.12 | x86_64 |
在使用Docker拉取镜像时，Docker首先默认从Docker Hub官方下载镜像，很多时候我们的镜像都是使用Dockerfile自定义私有镜像，不对外公开，而且为了安全起见，docker可能在内网环境下运行，所以我们有必要搭建一套docker本地私有镜像仓库，以供整个内网集群环境使用。
搭建镜像仓库主流的有两种方法，一种是使用docker官方提供的registry镜像搭建仓库，简单快捷,但是功能有限；另一种是使用harbor搭建本地镜像仓库，harbor功能更强，使用范围更广，这里介绍使用harbor搭建本地镜像仓库。
关于使用registry搭建本地镜像仓库请查看博客《搭建docker镜像仓库(一)：使用registry搭建本地镜像仓库》https://www.cnblogs.com/renshengdezheli/p/16646969.html。
Harbor是由VMware公司开源的企业级的Docker镜像仓库管理项目，它包括权限管理(RBAC)、LDAP、日志审核、管理界面、自我注册、镜像复制和中文支持等功能。Harbor官网地址：https://github.com/goharbor/harbor
Harbor在架构上主要由6个组件构成：
Proxy：Harbor的registry, UI, token等服务，通过一个前置的反向代理统一接收浏览器、Docker客户端的请求，并将请求转发给后端不同的服务。
Registry： 负责储存Docker镜像，并处理docker push/pull 命令。由于我们要对用户进行访问控制，即不同用户对Docker image有不同的读写权限，Registry会指向一个token服务，强制用户的每次docker pull/push请求都要携带一个合法的token, Registry会通过公钥对token 进行解密验证。
Core services： 这是Harbor的核心功能，主要提供以下服务：
Database：为core services提供数据库服务，负责储存用户权限、审计日志、Docker image分组信息等数据。
Job Services：提供镜像远程复制功能，可以把本地镜像同步到其他Harbor实例中。
Log collector：为了帮助监控Harbor运行，负责收集其他组件的log，供日后进行分析。
各个组件之间的关系如下图所示：
架构：k8smaster作为harbor镜像仓库，k8sworker1作为客户端
| 服务器 | 操作系统版本 | CPU架构 | 进程 | 功能描述 |
|---|---|---|---|---|
| k8smaster/192.168.110.137 | CentOS Linux release 7.4.1708 (Core) | x86_64 | harbor | harbor镜像仓库 |
| k8sworker1/192.168.110.138 | CentOS Linux release 7.4.1708 (Core) | x86_64 | docker | docker客户端 |
首先配置k8smaster节点，注释：harbor默认端口为80
由于harbor依赖于docker-compose，所以需要先安装docker-compose
[root@k8smaster ~]# yum -y install docker-compose......正在解决依赖关系--> 正在检查事务---> 软件包 docker-compose.noarch.0.1.18.0-4.el7 将被 安装--> 正在处理依赖关系 python(abi) = 3.6，它被软件包 docker-compose-1.18.0-4.el7.noarch 需要......已安装: docker-compose.noarch 0:1.18.0-4.el7 ......完毕！harbor下载：去网上https://github.com/goharbor/harbor/releases/tag/v2.4.1下载harbor离线包：harbor-offline-installer-v2.4.1.tgz
解压harbor离线包
[root@k8smaster ~]# ll -t总用量 1137380-rw-r--r-- 1 root root 612698835 1月 5 11:39 harbor-offline-installer-v2.4.1.tgz[root@k8smaster ~]# tar xf harbor-offline-installer-v2.4.1.tgz[root@k8smaster ~]# cd harbor#harbor.v2.4.1.tar.gz这个压缩包里包含harbor所需的镜像#harbor.yml.tmpl是harbor配置文件范例[root@k8smaster harbor]# lscommon.sh harbor.v2.4.1.tar.gz harbor.yml.tmpl install.sh LICENSE prepareharbor.v2.4.1.tar.gz这个压缩包里包含harbor所需的镜像，加载镜像harbor.v2.4.1.tar.gz
[root@k8smaster harbor]# docker load -i harbor.v2.4.1.tar.gz1e3f0dc884e2: Loading layer [==================================================>] 39.45MB/39.45MB3fd9ccd5eeaa: Loading layer [==================================================>] 5.275MB/5.275MB......Loaded image: goharbor/prepare:v2.4.1eb57d0945b2e: Loading layer [==================================================>] 7.192MB/7.192MBdd9069fd53a8: Loading layer [==================================================>] 7.355MB/7.355MBe779dab1d180: Loading layer [==================================================>] 1.754MB/1.754MBLoaded image: goharbor/harbor-portal:v2.4.1harbor.yml.tmpl是harbor配置文件范例，复制一份配置文件
[root@k8smaster harbor]# lscommon.sh harbor.v2.4.1.tar.gz harbor.yml.tmpl install.sh LICENSE prepare[root@k8smaster harbor]# cp harbor.yml.tmpl harbor.yml修改配置文件harbor.yml
[root@k8smaster harbor]# vim harbor.ymlharbor配置文件harbor.yml修改内容如下：#hostname修改为私有仓库所在的主机名hostname: k8smaster#https的配置直接删除或者注释掉 # https related config #https: # # https port for harbor, default is 443 # port: 443# # The path of cert and key files for nginx # certificate: /your/certificate/path # private_key: /your/private/key/path
harbor的账号密码
#harbor的账号密码：harbor_admin_password: Harbor12345安装harbor
[root@k8smaster harbor]# ./prepare prepare base dir is set to /root/harborWARNING:root:WARNING: HTTP protocol is insecure. Harbor will deprecate http protocol in the future. Please make sure to upgrade to httpsGenerated configuration file: /config/portal/nginx.confGenerated configuration file: /config/log/logrotate.confGenerated configuration file: /config/log/rsyslog_docker.confGenerated configuration file: /config/nginx/nginx.confGenerated configuration file: /config/core/envGenerated configuration file: /config/core/app.confGenerated configuration file: /config/registry/config.ymlGenerated configuration file: /config/registryctl/envGenerated configuration file: /config/registryctl/config.ymlGenerated configuration file: /config/db/envGenerated configuration file: /config/jobservice/envGenerated configuration file: /config/jobservice/config.ymlGenerated and saved secret to file: /data/secret/keys/secretkeySuccessfully called func: create_root_certGenerated configuration file: /compose_location/docker-compose.ymlClean up the input dir#安装[root@k8smaster harbor]# ./install.sh [Step 0]: checking if docker is installed ...Note: docker version: 20.10.7[Step 1]: checking docker-compose is installed ...Note: docker-compose version: 1.18.0[Step 2]: loading Harbor images ...Loaded image: goharbor/registry-photon:v2.4.1Loaded image: goharbor/notary-signer-photon:v2.4.1......Loaded image: goharbor/chartmuseum-photon:v2.4.1Loaded image: goharbor/prepare:v2.4.1Loaded image: goharbor/harbor-portal:v2.4.1[Step 3]: preparing environment ...[Step 4]: preparing harbor configs ...prepare base dir is set to /root/harborWARNING:root:WARNING: HTTP protocol is insecure. Harbor will deprecate http protocol in the future. Please make sure to upgrade to httpsClearing the configuration file: /config/portal/nginx.confClearing the configuration file: /config/log/logrotate.confClearing the configuration file: /config/log/rsyslog_docker.conf......Creating harbor-jobservice ... Creating nginx ... ? ----Harbor has been installed and started successfully.----Harbor安装好之后在浏览器界面登录，直接在浏览器输入所在主机IP地址：http://192.168.110.137/，打开主页输入账号admin,密码：Harbor12345进行登录
harbor登录之后，主界面如下：
创建用户：点击用户管理-->创建用户
填写用户信息
用户创建成功
设置用户为管理员
新建项目
填写项目信息：访问级别不勾选公开则是私有，存储容量-1表示没有容量限制
bigdata项目创建成功，点击bigdata进入项目
因为bigdata这个项目是私有的，需要把lizhien用户添加进来，不然lizhien没有权限拉取/推送镜像
把lizhien这个用户添加到bigdata项目里：点击成员-->+用户
把lizhien添加进来
这时，用户lizhien就具有bigdata项目的权限了
配置docker客户端的harbor私有仓库地址
#由于harbor默认端口为80，所以修改/etc/docker/daemon.json的insecure-registries[root@k8sworker1 ~]# cat /etc/docker/daemon.json{ "registry-mirrors": ["https://frz7i079.mirror.aliyuncs.com"],"insecure-registries":["192.168.110.137"]}重启docker使配置文件生效
[root@k8sworker1 ~]# systemctl restart docker[root@k8sworker1 ~]# systemctl status docker● docker.service - Docker Application Container Engine Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; vendor preset: disabled) Active: active (running) since 三 2022-01-05 11:28:02 CST; 8s ago Docs: https://docs.docker.com Main PID: 28037 (dockerd) Memory: 48.9M CGroup: /system.slice/docker.service └─28037 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock查看docker本地镜像，如果本地没有镜像，直接docker pull 拉取镜像即可
[root@k8sworker1 ~]# docker imagesREPOSITORY TAG IMAGE ID CREATED SIZE192.168.110.137:5000/boke/wordpress latest dccaeccfba36 4 years ago 406MB192.168.110.137:5000/web/tomcat v1 72d2be374029 4 years ago 292MBnginx 1.8 0d493297b409 5 years ago 133MB修改镜像的别名
[root@k8sworker1 ~]# docker tag 192.168.110.137:5000/boke/wordpress:latest k8smaster/bigdata/wordpress:latest[root@k8sworker1 ~]# docker tag 192.168.110.137:5000/web/tomcat:v1 k8smaster/bigdata/tomcat:v1[root@k8sworker1 ~]# docker imagesREPOSITORY TAG IMAGE ID CREATED SIZE192.168.110.137:5000/boke/wordpress latest dccaeccfba36 4 years ago 406MBk8smaster/bigdata/wordpress latest dccaeccfba36 4 years ago 406MB192.168.110.137:5000/web/tomcat v1 72d2be374029 4 years ago 292MBk8smaster/bigdata/tomcat v1 72d2be374029 4 years ago 292MBnginx 1.8 0d493297b409 5 years ago 133MB推送镜像到harbor仓库，发现推送到了docker.io/k8smaster/bigdata/wordpress，明显是不对的，推送失败
[root@k8sworker1 ~]# docker push k8smaster/bigdata/wordpress:latestThe push refers to repository [docker.io/k8smaster/bigdata/wordpress]53e16fa1f104: Preparing 562dd11ed871: Preparing 6671cb9eb6b3: Preparing 4214911d5945: Preparing fed26d7fe7b9: Preparing c8c6d352c96e: Waiting 5a151fa4136e: Waiting 8747705a74d9: Waiting adfd7c98cdf6: Waiting 354b4ef9664b: Waiting 2da371244fc1: Waiting 315db89f9acb: Waiting 3d2582fdede2: Waiting 53da01089a82: Waiting 0fd7a67d49b3: Waiting f0c367fa8636: Waiting ddd6dcab19ff: Waiting 2c40c66f7667: Waiting ^C重新修改tag，把主机名修改为IP
[root@k8sworker1 ~]# docker tag 192.168.110.137:5000/boke/wordpress:latest 192.168.110.137/bigdata/wordpress:latest[root@k8sworker1 ~]# docker tag 192.168.110.137:5000/web/tomcat:v1 192.168.110.137/bigdata/tomcat:v1[root@k8sworker1 ~]# docker imagesREPOSITORY TAG IMAGE ID CREATED SIZE192.168.110.137/bigdata/wordpress latest dccaeccfba36 4 years ago 406MB192.168.110.137:5000/boke/wordpress latest dccaeccfba36 4 years ago 406MBk8smaster/bigdata/wordpress latest dccaeccfba36 4 years ago 406MB192.168.110.137/bigdata/tomcat v1 72d2be374029 4 years ago 292MB192.168.110.137:5000/web/tomcat v1 72d2be374029 4 years ago 292MBk8smaster/bigdata/tomcat v1 72d2be374029 4 years ago 292MBnginx 1.8 0d493297b409 5 years ago 133MB继续推送镜像，但是unauthorized,需要登录才能推送镜像
[root@k8sworker1 ~]# docker push 192.168.110.137/bigdata/wordpress:latestThe push refers to repository [192.168.110.137/bigdata/wordpress]53e16fa1f104: Preparing 562dd11ed871: Preparing 6671cb9eb6b3: Preparing 4214911d5945: Preparing fed26d7fe7b9: Waiting c8c6d352c96e: Waiting 5a151fa4136e: Waiting 8747705a74d9: Waiting adfd7c98cdf6: Waiting 354b4ef9664b: Waiting 2da371244fc1: Waiting 315db89f9acb: Waiting 3d2582fdede2: Waiting 53da01089a82: Waiting 0fd7a67d49b3: Waiting f0c367fa8636: Waiting ddd6dcab19ff: Waiting 2c40c66f7667: Waiting unauthorized: unauthorized to access repository: bigdata/wordpress, action: push: unauthorized to access repository: bigdata/wordpress, action: push登录harbor
#使用主机名登录失败[root@k8sworker1 ~]# docker login k8smasterUsername: lizhienPassword: Error response from daemon: Get https://k8smaster/v2/: dial tcp 192.168.110.137:443: connect: connection refused#使用IP登录成功，使用刚才创建的lizhien用户登录[root@k8sworker1 ~]# docker login 192.168.110.137Username: lizhienPassword: WARNING! Your password will be stored unencrypted in /root/.docker/config.json.Configure a credential helper to remove this warning. Seehttps://docs.docker.com/engine/reference/commandline/login/#credentials-storeLogin Succeeded#此时家目录下会多了一个.docker/config.json 文件[root@k8sworker1 ~]# ls .docker/config.json[root@k8sworker1 ~]# cat .docker/config.json { "auths": { "192.168.110.137": { "auth": "bGl6aGllbjpMaXpoaWVuNjY2" } }}再次推送镜像，此时推送镜像成功
[root@k8sworker1 ~]# docker push 192.168.110.137/bigdata/wordpress:latestThe push refers to repository [192.168.110.137/bigdata/wordpress]53e16fa1f104: Pushed 562dd11ed871: Pushed ......f0c367fa8636: Pushed ddd6dcab19ff: Pushed 2c40c66f7667: Pushed latest: digest: sha256:ca4cf4692b7bebd81f229942c996b1c4e6907d6733e977e93d671a54b8053a22 size: 4078[root@k8sworker1 ~]# docker push 192.168.110.137/bigdata/tomcat:v1The push refers to repository [192.168.110.137/bigdata/tomcat]f79699072473: Pushed 8cb01d738d7e: Pushed ......fe40be59465f: Pushed cf4ecb492384: Pushed v1: digest: sha256:6241d7435b5c4e9d54be7d61e834836a71b1934b5403e01eff8768f0e2bcf210 size: 3045到harbor界面上查看，发现bigdata项目下已经存在镜像了
首先删除本地镜像
[root@k8sworker1 ~]# docker rmi 192.168.110.137:5000/web/tomcat:v1 192.168.110.137:5000/boke/wordpress:latest 192.168.110.137/bigdata/wordpress:latest[root@k8sworker1 ~]# docker imagesREPOSITORY TAG IMAGE ID CREATED SIZE从仓库拉取镜像，如果之前退出登录harbor了，则需要docker login 192.168.110.137登录仓库
[root@k8sworker1 ~]# docker pull 192.168.110.137/bigdata/tomcat:v1v1: Pulling from bigdata/tomcata2149b3f2ac2: Pull complete .....321b0457f24e: Pull complete 0f83e948f35a: Pull complete 8dbb09972def: Pull complete Digest: sha256:6241d7435b5c4e9d54be7d61e834836a71b1934b5403e01eff8768f0e2bcf210Status: Downloaded newer image for 192.168.110.137/bigdata/tomcat:v1192.168.110.137/bigdata/tomcat:v1[root@k8sworker1 ~]# docker imagesREPOSITORY TAG IMAGE ID CREATED SIZE192.168.110.137/bigdata/wordpress latest dccaeccfba36 4 years ago 406MB192.168.110.137/bigdata/tomcat v1 72d2be374029 4 years ago 292MB自此harbor仓库搭建完毕也可以正常上传和拉取镜像了