Harbor部署
Docker Registry
网上有很多的Registry服务器都支持第三方用户注册，而后基于用户名去做自己的仓库，但是使用互联网上的Registry有一个缺陷，那就是我们去推送和下载镜像时都不会很快，而在生产环境中很可能并行启动的容器将达到几十、上百个，而且很有可能每个服务器本地是没有镜像的，此时如果通过互联网去下载镜像会有很多问题，比如下载速度会很慢、带宽会用很多等等，如果带宽不够的话，下载至启动这个过程可能要持续个几十分钟，这已然违背了使用容器会更加轻量、快速的初衷和目的。因此，很多时候我们很有可能需要去做自己的私有Registry。
Registry用于保存docker镜像，包括镜像的层次结构和元数据。用户可以自建Registry，也可以使用官方的Docker Hub。
Docker Registry分类：
- Sponsor Registry：第三方的Registry，供客户和Docker社区使用
- Mirror Registry：第三方的Registry，只让客户使用
- Vendor Registry：由发布docker镜像的供应商提供的registry
- Private Registry：通过设有防火墙和额外的安全层的私有实体提供的registry
事实上，如果运维的系统环境托管在云计算服务上，比如阿里云，那么用阿里云的Registry则是最好的选择。很多时候我们的生产环境不会在本地，而是托管在数据中心机房里，如果我们在数据中心机房里的某台主机上部署Registry，因为都在同一机房，所以属于同一局域网，此时数据传输走内网，效率会极大的提升。
所有的Registry默认情况下都是基于https工作的，这是Docker的基本要求，而我自建Registry时很可能是基于http工作的，但是Docker默认是拒绝使用http提供Registry服务的，除非明确的告诉它，我们就是要用http协议的Registry。
环境说明：
主机 | IP | 服务 |
registry.example.com/CentOS8 (Harbor仓库) | 192.168.240.30 | docker docker-compose harbor |
localhost.localdomain/CentOS8 | 192.168.240.40 | docker |
Harbor
Harbor镜像仓库部署
Harbor
无论是使用Docker-distribution去自建仓库，还是通过官方镜像跑容器的方式去自建仓库，通过前面的演示我们可以发现其是非常的简陋的，还不如直接使用官方的Docker Hub去管理镜像来得方便，至少官方的Docker Hub能够通过web界面来管理镜像，还能在web界面执行搜索，还能基于Dockerfile利用Webhooks和Automated Builds实现自动构建镜像的功能，用户不需要在本地执行docker build，而是把所有build上下文的文件作为一个仓库推送到github上，让Docker Hub可以从github上去pull这些文件来完成自动构建。
但无论官方的Docker Hub有多强大，它毕竟是在国外，所以速度是最大的瓶颈，我们很多时候是不可能去考虑使用官方的仓库的，但是上面说的两种自建仓库方式又十分简陋，不便管理，所以后来就出现了一个被 CNCF 组织青睐的项目，其名为Harbor。
Harbor简介
Harbor是由VMWare在Docker Registry的基础之上进行了二次封装，加进去了很多额外程序，而且提供了一个非常漂亮的web界面。
Harbor是一个开源可信的云原生的仓库项目，用于存储、用户管理和查找镜像。Harbor通过添加用户通常需要的功能，如安全、身份和管理，扩展了开源Docker分发版。Harbor支持高级特性，如用户管理、访问控制、活动监视和实例之间的复制。
Harbor的功能
- 多租户内容签名和验证
- 安全性和漏洞分析
- 审计日志记录
- 身份集成和基于角色的访问控制
- 实例之间的映像复制
- 可扩展API和图形UI
- 国际化(目前为中英文化)
Docker compose
Harbor在物理机上部署是非常难的，而为了简化Harbor的应用，Harbor官方直接把Harbor做成了在容器中运行的应用，而且这个容器在Harbor中依赖类似redis、mysql、pgsql等很多存储系统，所以它需要编排很多容器协同起来工作，因此VMWare Harbor在部署和使用时，需要借助于Docker的单机编排
Compose是一个用于定义和运行多容器Docker应用程序的工具。使用Compose，您可以使用YAML文件来配置应用程序的服务。然后，通过一个命令，您可以创建并启动配置中的所有服务
Harbor部署：
安装docker
registry.example.com 主机 安装
[root@localhost ~]# dnf -y install vim wget
# 配置docker源
[root@localhost ~]# cd /etc/yum.repos.d/
[root@localhost yum.repos.d]# curl -o docker-ce.repo https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/docker-ce.repo
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1919 100 1919 0 0 11156 0 --:--:-- --:--:-- --:--:-- 11156
[root@localhost yum.repos.d]# ls
CentOS-Stream-AppStream.repo CentOS-Stream-Extras.repo CentOS-Stream-PowerTools.repo
CentOS-Stream-BaseOS.repo CentOS-Stream-HighAvailability.repo CentOS-Stream-RealTime.repo
CentOS-Stream-Debuginfo.repo CentOS-Stream-Media.repo docker-ce.repo
# 替换docker-ce.repo中的关键字为mirrors.aliyun.com
[root@localhost yum.repos.d]# sed -i 's+download.docker.com+mirrors.aliyun.com/docker-ce+' /etc/yum.repos.d/docker-ce.repo
# 安装docker
[root@localhost yum.repos.d]# dnf -y install docker-ce
# 关闭防火墙和seLinux
[root@localhost yum.repos.d]# systemctl disable --now firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@localhost yum.repos.d]# setenforce 0
[root@localhost yum.repos.d]# getenforce
Permissive
# 设置docker开机自启
[root@localhost yum.repos.d]# systemctl enable --now docker
Created symlink /etc/systemd/system/multi-user.target.wants/docker.service → /usr/lib/systemd/system/docker.service.
[root@localhost yum.repos.d]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
# 配置阿里云加速器
[root@localhost ~]# vim /etc/docker/daemon.json
{
"registry-mirrors": ["https://wn5c7d7w.mirror.aliyuncs.com"]
}
[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# systemctl restart docker
[root@localhost ~]# docker info
Client:
Context: default
Debug Mode: false
Plugins:
app: Docker App (Docker Inc., v0.9.1-beta3)
buildx: Docker Buildx (Docker Inc., v0.7.1-docker)
scan: Docker Scan (Docker Inc., v0.12.0)
Server:
Containers: 0
Running: 0
Paused: 0
.........
Experimental: false
Insecure Registries:
127.0.0.0/8
Registry Mirrors:
https://wn5c7d7w.mirror.aliyuncs.com/ # 查看已生效
Live Restore Enabled: false安装docker-compose
**registry.example.com 主机 **安装
安装官网：安装 Docker Compose |Docker 文档
[root@localhost yum.repos.d]# cd
[root@localhost ~]# ls /usr/local/bin/
[root@localhost ~]#
[root@localhost ~]# curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 664 100 664 0 0 750 0 --:--:-- --:--:-- --:--:-- 749
100 12.1M 100 12.1M 0 0 587k 0 0:00:21 0:00:21 --:--:-- 885k
[root@localhost ~]# ls /usr/local/bin/
docker-compose
[root@localhost ~]# chmod +x /usr/local/bin/docker-compose
[root@localhost ~]# which docker-compose
/usr/local/bin/docker-compose
[root@localhost ~]# echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin
[root@localhost ~]# docker --version
Docker version 20.10.12, build e91ed57搭建Harbor
registry.example.com 主机 安装
下载地址：Release v2.3.5 · goharbor/harbor · GitHub
# 下载并上传Harbor包
[root@localhost ~]# cd /usr/src
[root@localhost src]# ls
debug harbor-offline-installer-v2.3.5.tgz kernels md5sum
# 对比md5sum值，确保安装包的完整性
[root@localhost src]# cat md5sum
f1e01bbb4b62bf4a31a103d8c7c5a215 harbor-offline-installer-v2.3.5.tgz
762377f15c4483c18434fb43ec4efdab harbor-offline-installer-v2.3.5.tgz.asc
aa7c52f1aae0e46aaeb9cb426a190721 harbor-online-installer-v2.3.5.tgz
4ada42697aa7d6bd8ab3b2cfa1559aaa harbor-online-installer-v2.3.5.tgz.asc
[root@localhost src]# md5sum harbor-offline-installer-v2.3.5.tgz
f1e01bbb4b62bf4a31a103d8c7c5a215 harbor-offline-installer-v2.3.5.tgz
# 解压
[root@localhost src]# ls /usr/local/
bin etc games include lib lib64 libexec sbin share src
[root@localhost src]# tar xf harbor-offline-installer-v2.3.5.tgz -C /usr/local/
[root@localhost src]# cd /usr/local/
[root@localhost local]# ls
bin etc games harbor include lib lib64 libexec sbin share src
# 修改主机名
[root@localhost local]# cd harbor
[root@localhost harbor]# hostnamectl set-hostname registry.example.com
[root@localhost harbor]# bash
[root@registry harbor]# hostname
registry.example.com
[root@registry harbor]# cp harbor.yml.tmpl harbor.yml
# 修改配置文件
[root@registry harbor]# vim harbor.yml
# Configuration file of Harbor
# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: registry.example.com # 修改为当前主机名
# http related config
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 80
# https related config
#https: # 添加注释
# https port for harbor, default is 443
#port: 443 # 添加注释
# The path of cert and key files for nginx
#certificate: /your/certificate/path # 添加注释
#private_key: /your/private/key/path # 添加注释
........
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: Harbor12345 # Harbor web界面登录密码
# Harbor DB configuration
database:
# The password for the root user of Harbor DB. Change this before any production use.
password: root123 # 数据库密码
# The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.
max_idle_conns: 100 # 空闲最大连接数
# The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.
# Note: the default number of connections is 1024 for postgres of harbor.
max_open_conns: 900 # 打开最大文件数
# The default data volume
data_volume: /data # 数据存放位置
# 修改hosts文件添加映射
[root@registry harbor]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.220.17 registry.example.com
[root@registry harbor]# ping registry.example.com
PING registory.example.com (192.168.220.17) 56(84) bytes of data.
64 bytes from registory.example.com (192.168.220.17): icmp_seq=1 ttl=64 time=0.054 ms
64 bytes from registory.example.com (192.168.220.17): icmp_seq=2 ttl=64 time=0.034 ms
64 bytes from registory.example.com (192.168.220.17): icmp_seq=3 ttl=64 time=0.027 ms
# 执行安装脚本
[root@registry harbor]# ./install.sh
[Step 0]: checking if docker is installed ...
Note: docker version: 20.10.12
[Step 1]: checking docker-compose is installed ...
Note: docker-compose version: 1.29.2
[Step 2]: loading Harbor images ...
...............
[Step 5]: starting Harbor ...
Creating network "harbor_harbor" with the default driver
Creating harbor-log ... done
Creating registryctl ... done
Creating redis ... done
Creating registry ... done
Creating harbor-portal ... done
Creating harbor-db ... done
Creating harbor-core ... done
Creating nginx ... done
Creating harbor-jobservice ... done
✔ ----Harbor has been installed and started successfully.----
# 查看
[root@registry harbor]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
goharbor/harbor-exporter v2.3.5 1730c6f650e2 5 days ago 81.9MB
goharbor/chartmuseum-photon v2.3.5 47004f032938 5 days ago 179MB
goharbor/redis-photon v2.3.5 3d0cedc89a0d 5 days ago 156MB
goharbor/trivy-adapter-photon v2.3.5 5c0212e98070 5 days ago 133MB
goharbor/notary-server-photon v2.3.5 f20a76c65359 5 days ago 111MB
goharbor/notary-signer-photon v2.3.5 b9fa38eef4d7 5 days ago 108MB
goharbor/harbor-registryctl v2.3.5 7a52567a76ca 5 days ago 133MB
goharbor/registry-photon v2.3.5 cf22d3e386b8 5 days ago 82.6MB
goharbor/nginx-photon v2.3.5 5e3b6d9ce11a 5 days ago 45.7MB
goharbor/harbor-log v2.3.5 a03e4bc963d6 6 days ago 160MB
goharbor/harbor-jobservice v2.3.5 2ac32df5a2e0 6 days ago 211MB
goharbor/harbor-core v2.3.5 23baee01156f 6 days ago 193MB
goharbor/harbor-portal v2.3.5 bb545cdedf5a 6 days ago 58.9MB
goharbor/harbor-db v2.3.5 9826c57a5749 6 days ago 221MB
goharbor/prepare v2.3.5 a1ceaabe47b2 6 days ago 255MB
[root@registry harbor]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
779cf4b59089 goharbor/harbor-jobservice:v2.3.5 "/harbor/entrypoint.…" 59 seconds ago Up 58 seconds (healthy) harbor-jobservice
686123a9e789 goharbor/nginx-photon:v2.3.5 "nginx -g 'daemon of…" 59 seconds ago Up 58 seconds (healthy) 0.0.0.0:80->8080/tcp, :::80->8080/tcp nginx
192afc12b0df goharbor/harbor-core:v2.3.5 "/harbor/entrypoint.…" About a minute ago Up 59 seconds (healthy) harbor-core
f22ed219514c goharbor/harbor-db:v2.3.5 "/docker-entrypoint.…" About a minute ago Up About a minute (healthy) harbor-db
68e99a0f8b1d goharbor/registry-photon:v2.3.5 "/home/harbor/entryp…" About a minute ago Up About a minute (healthy) registry
f31a1a3db38f goharbor/harbor-portal:v2.3.5 "nginx -g 'daemon of…" About a minute ago Up About a minute (healthy) harbor-portal
230852b4624f goharbor/harbor-registryctl:v2.3.5 "/home/harbor/start.…" About a minute ago Up About a minute (healthy) registryctl
4b251b48fa0c goharbor/redis-photon:v2.3.5 "redis-server /etc/r…" About a minute ago Up About a minute (healthy) redis
debb1c1a36d6 goharbor/harbor-log:v2.3.5 "/bin/sh -c /usr/loc…" About a minute ago Up About a minute (healthy) 127.0.0.1:1514->10514/tcp harbor-log
[root@registry harbor]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 127.0.0.1:1514 0.0.0.0:*
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 [::]:80 [::]:*浏览器访问
localhost.localdomain主机 安装docker步骤同上面Harbor仓库安装docker步骤一致
localhost.localdomain主机 配置参数 insecure(不安全的)，因为没有使用https,使用的是http
[root@localhost]# cat /etc/docker/daemon.json
{
"insecure-registries": ["registry.example.com"] # 添加Harbor仓库对应主机名
}
[root@localhost]# systemctl daemon-reload
[root@localhost]# systemctl restart docker修改 localhost.localdomain主机 的hosts文件
# 配置hosts文件
[root@localhost ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.220.17 registry.example.com # Harbor仓库的IP和主机名
[root@localhost ~]# ping registry.example.com # 测试ping
PING registry.example.com (192.168.220.17) 56(84) bytes of data.
64 bytes from registry.example.com (192.168.220.17): icmp_seq=1 ttl=64 time=0.359 ms
64 bytes from registry.example.com (192.168.220.17): icmp_seq=2 ttl=64 time=0.445 ms
64 bytes from registry.example.com (192.168.220.17): icmp_seq=3 ttl=64 time=0.234 mslocalhost.localdomain主机 使用docker来拉取官方镜像，然后传到刚搭建的Harbor仓库
[root@localhost docker]# docker pull busybox # 拉取官方镜像busybox
Using default tag: latest
latest: Pulling from library/busybox
3cb635b06aa2: Pull complete
Digest: sha256:b5cfd4befc119a590ca1a81d6bb0fa1fb19f1fbebd0397f25fae164abe1e8a6a
Status: Downloaded newer image for busybox:latest
docker.io/library/busybox:latest
[root@localhost docker]# docker images # 查看
REPOSITORY TAG IMAGE ID CREATED SIZE
busybox latest ffe9d497c324 8 days ago 1.24MB
# 将busybox镜像改名并上传到刚搭建的Harbor仓库
[root@localhost docker]# docker tag busybox:latest registry.example.com/library/busybox:latest
[root@localhost docker]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
busybox latest ffe9d497c324 8 days ago 1.24MB
registry.example.com/library/busybox latest ffe9d497c324 8 days ago 1.24MB
# 登录
[root@localhost ~]# docker login registry.example.com
Username: admin
Password: # 密码为登录web界面的密码
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
# 上传到Harbor仓库
[root@localhost ~]# docker push registry.example.com/library/busybox:latest
The push refers to repository [registry.example.com/library/busybox]
64cac9eaf0da: Pushed
latest: digest: sha256:50e44504ea4f19f141118a8a8868e6c5bb9856efa33f2183f5ccea7ac62aacc9 size: 527web界面 查看
测试：删除 localhost.localdomain主机 本地镜像，从Harbor仓库拉取
# 删除前查看
[root@localhost ~]# docker images # 删除前查看
REPOSITORY TAG IMAGE ID CREATED SIZE
busybox latest ffe9d497c324 8 days ago 1.24MB
registry.example.com/library/busybox latest ffe9d497c324 8 days ago 1.24MB
# 删除镜像registry.example.com/library/busybox
[root@localhost ~]# docker rmi registry.example.com/library/busybox
Untagged: registry.example.com/library/busybox:latest
Untagged: registry.example.com/library/busybox@sha256:50e44504ea4f19f141118a8a8868e6c5bb9856efa33f2183f5ccea7ac62aacc9
# 删除后查看
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
busybox latest ffe9d497c324 8 days ago 1.24MB
# 从Harbor仓库拉取镜像
[root@localhost ~]# docker push registry.example.com/library/busybox:latest
The push refers to repository [registry.example.com/library/busybox]
64cac9eaf0da: Pushed
latest: digest: sha256:50e44504ea4f19f141118a8a8868e6c5bb9856efa33f2183f5ccea7ac62aacc9 size: 527
# 查看
[root@localhost ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
busybox latest ffe9d497c324 8 days ago 1.24MB
registry.example.com/library/busybox latest ffe9d497c324 8 days ago 1.24MB用户管理
创建用户
退出，使用创建的开发者test登录
登录成功
docker-compose控制容器
**registry.example.com 主机 **操作
# 停止容器
[root@registry ~]# hostname
registry.example.com
[root@registry ~]# cd /usr/local/harbor/
[root@registry harbor]# pwd
/usr/local/harbor
[root@registry harbor]# docker-compose stop
Stopping harbor-jobservice ... done
Stopping nginx ... done
Stopping harbor-core ... done
Stopping harbor-db ... done
Stopping registry ... done
Stopping harbor-portal ... done
Stopping registryctl ... done
Stopping redis ... done
Stopping harbor-log ... done
[root@registry harbor]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES写一个脚本让docker-compose开机就启动容器
[root@registry harbor]# cat >harbor_start.sh <<EOF
> #!/bin/bash
> cd /usr/local/harbor
> docker-compose start
> EOF
[root@registry harbor]# cat harbor_start.sh
#!/bin/bash
cd /usr/local/harbor
docker-compose start
[root@registry harbor]# chmod +x harbor_start.sh
[root@registry harbor]# cat /etc/rc.local
#!/bin/bash
/bin/bash /usr/local/harbor/harbor_start.sh # 添加
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.
touch /var/lock/subsys/local
[root@registry harbor]# chmod +x /etc/rc.local
[root@registry harbor]# ll /etc/rc.local
lrwxrwxrwx. 1 root root 13 Dec 1 2020 /etc/rc.local -> rc.d/rc.local
[root@registry harbor]# ll /etc/rc.d/
total 4
drwxr-xr-x. 2 root root 37 Sep 30 05:10 init.d
-rwxr-xr-x. 1 root root 518 Dec 16 04:37 rc.local
# 重启
[root@registry harbor]# reboot
# 查看
[root@registry ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 127.0.0.1:1514 0.0.0.0:*
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:80 [::]:*
LISTEN 0 128 [::]:22 [::]:*
使用Harbor的注意事项：
- 在客户端上传镜像时一定要记得执行docker login进行用户认证，否则无法直接push
- 在客户端使用的时候如果不是用的https则必须要在客户端的/etc/docker/daemon.json配置文件中配置insecure-registries参数
- 数据存放路径应在配置文件中配置到一个容量比较充足的共享存储中
- Harbor是使用docker-compose命令来管理的，如果需要停止Harbor也应用docker-compose stop来停止，其他参数请–help
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
