Docker Hub 存放着 Docker 及其组件的所有资源。它可以提供:

  • Docker 镜像主机
  • 用户认证
  • 自动镜像构建和工作流程工具,如构建触发器和 web hooks
  • 整合了 GitHub 和 BitBucket

但,有些场景我们需要一个私有仓库来管理自己的镜像,可以通过Registry来实现此目的。Registry作为Docker的核心组件之一负责镜像内容的存储与分发,客户端的docker pull以及push命令都将直接与registry进行交互。

环境:
  Docker 17.12.0-ce-rc4
  Centos 7.3

部署Docker

1
2
3
4
5
6
# yum remove docker docker-common docker-selinux docker-engine -y
# yum install -y yum-utils device-mapper-persistent-data lvm2
# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
# yum-config-manager --enable docker-ce-edge
# yum-config-manager --enable docker-ce-test
# yum install docker-ce -y

自建证书

1
2
# mkdir -p conf
# openssl req -new -newkey rsa:4096 -days 365 -subj "/CN=localhost" -nodes -x509 -keyout conf/auth.key -out conf/auth.cert

registry容器配置文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# 启动registry容器需要用到
# cat registry-srv.yml
version: 0.1
log:
fields:
service: registry
storage:
delete:
enabled: true
cache:
blobdescriptor: inmemory
filesystem:
rootdirectory: /var/lib/registry
http:
addr: 0.0.0.0:5000
headers:
X-Content-Type-Options: [nosniff]
health:
storagedriver:
enabled: true
interval: 10s
threshold: 3
auth:
token:
# external url to docker-web authentication endpoint
realm: http://registry-web:8080/api/auth
# should be same as registry.name of registry-web
service: registry-srv:5000
# should be same as registry.auth.issuer of registry-web
issuer: 'my issuer'
# path to auth certificate
rootcertbundle: /etc/docker/registry/auth.cert
#

registry-web容器配置文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# 启动registry-web容器需要用到
# cat registry-web.yml
registry:
# Docker registry url
url: http://registry-srv:5000/v2
# Docker registry fqdn
name: registry-srv:5000
# To allow image delete, should be false
readonly: false
auth:
# Enable authentication
enabled: true
# Token issuer
# should equals to auth.token.issuer of docker registry
issuer: 'my issuer'
# Private key for token signing
# certificate used on auth.token.rootcertbundle should signed by this key
key: /conf/auth.key
#
1
2
3
4
5
6
7
8
9
# tree docker-registry-web/
docker-registry-web/
└── conf
├── auth.cert
├── auth.key
├── registry-srv.yml
└── registry-web.yml
1 directory, 4 files

启动registry

1
2
3
# /root/docker-registry-web/conf需要有上述四个文件(auth.cert,auth.key,registry-srv.yml,registry-web.yml),文件内容见上面
# 如果配置文件改成了域名,在创建容器时CONTAINER NAME最好与配置文件一致
docker run -v /root/docker-registry-web/conf/registry-srv.yml:/etc/docker/registry/config.yml:ro -v /root/docker-registry-web/conf/auth.cert:/etc/docker/registry/auth.cert:ro -v /data:/var/lib/registry/ -p 5000:5000 --restart=always --name registry-srv -d registry:2.6.2

启动registry-web

1
2
3
# /root/docker-registry-web/conf需要有上述四个文件(auth.cert,auth.key,registry-srv.yml,registry-web.yml),文件内容见上面
# 如果配置文件改成了域名,在创建容器时CONTAINER NAME最好与配置文件一致
docker run -d -v /root/docker-registry-web/conf/registry-web.yml:/conf/config.yml:ro -v /root/docker-registry-web/conf/auth.key:/conf/auth.key -v /root/docker-registry-web/db:/data -it -p 8080:8080 --link registry-srv --restart=always --name registry-web hyper/docker-registry-web
1
2
3
4
5
6
7
8
9
10
11
# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
docker.io/registry 2.6.2 177391bcf802 2 weeks ago 33.26 MB
docker.io/hyper/docker-registry-web latest 0db5683824d8 14 months ago 598.6 MB
#
# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1b4c0efd8465 hyper/docker-registry-web "start.sh" 58 minutes ago Up 58 minutes 0.0.0.0:8080->8080/tcp registry-web
2d475b4d0603 registry:2.6.2 "/entrypoint.sh /etc/" 58 minutes ago Up 17 minutes 0.0.0.0:5000->5000/tcp registry-srv
#

hosts解析

1
2
3
# tail -2 /etc/hosts
192.168.1.61 registry-srv
192.168.1.61 registry-web

忽略认证

Question:如果报下面的错误

1
2
3
4
# docker login http://registry-srv:5000
Username (admin): admin
Password:
Error response from daemon: Get https://registry-srv:5000/v2/: http: server gave HTTP response to HTTPS client

Answer:

1
2
3
4
5
6
# docker 1.12.6需要在这里修改
# grep -iv '^#' /etc/sysconfig/docker | grep -iv '^$'
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --insecure-registry registry-srv:5000'
if [ -z "${DOCKER_CERT_PATH}" ]; then
DOCKER_CERT_PATH=/etc/docker
fi

1
2
3
4
#docker 17.12.0-ce-rc4需要这里修改
# cat /etc/docker/daemon.json
{ "insecure-registries":["registry-srv:5000"] }
#
1
# systemctl restart docker

上传镜像到docker registry

Question:在docker 17.12.0-ce-rc4中登陆成功后,如果报下面的错误

1
2
3
4
5
6
7
8
9
10
11
12
13
14
# docker push registry-srv:5000/mysql:5.6
The push refers to a repository [registry-srv:5000/mysql]
67ab9337620e: Preparing
388e5e8563d4: Preparing
000529f48f17: Preparing
07d0b57bb93e: Preparing
d59453e8d7bb: Waiting
19aa284e9bf3: Waiting
889744378e18: Waiting
ae12d30e1dfc: Waiting
4bcdffd70da2: Waiting
unauthorized: authentication required
#

Answer:需要登陆registry-web给当前登陆的用户授权
Registry_Permissions
Registry_Roles
然后再登陆docker login http://registry-srv:5000即可成功上传

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# docker login registry-srv:5000
Username (admin): admin
Password:
Login Succeeded
# docker tag docker.io/mysql:5.6 registry-srv:5000/mysql:5.6
# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
registry-srv:5000/mysql 5.6 1c7972822e0c 8 days ago 299 MB
docker push registry-srv:5000/mysql:5.6
The push refers to a repository [registry-srv:5000/mysql]
67ab9337620e: Pushed
388e5e8563d4: Pushed
000529f48f17: Pushed
07d0b57bb93e: Pushed
324a3796c59a: Pushed
d59453e8d7bb: Pushed
19aa284e9bf3: Pushed
889744378e18: Pushed
ae12d30e1dfc: Pushed
4bcdffd70da2: Pushed
5.6: digest: sha256:92cd157a4d73a00a56993bce76d467ae170a86b264d24536648834d7f7501cdd size: 2409
#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# ls /data/
docker
# du -sh /data/
101M /data/
# tree docker/
docker/
└── registry
└── v2
├── blobs
│   └── sha256
│   ├── 1c
│   │   └── 1c7972822e0cfe7af284610af68fd23ab1c6e36566070199a2ecae0c540a6213
│   │   └── data
│   ├── 28
│   │   └── 28dd7bab809dc36871733509f298775d6e7e9a7b48411969fd40bbc5d42d4872
│   │   └── data
│   ├── 60
│   │   └── 60b597896d30e83b6451b5d287503c6ad5b966afcfe983beaac073cd14d3327e
│   │   └── data
│   ├── 67
│   │   └── 67ee8c6f60b5ee191862ae0beee2e27fc242c1548e724d42491aff9599783f14
│   │   └── data
│   ├── 74
│   │   └── 74616d0d8b72cce832e728b721a055ee94112f55d9152ea75c0c11df9255e5fe
│   │   └── data
│   ├── 78
│   │   └── 78032de49d65ab1151d278821068401fa7a8964c16b2f4441a3ef9ac8dd02229
│   │   └── data
│   ├── 83
│   │   └── 837546b20bc4af04c4cd0b34ac6cb74418f0400fa80045d02d341aecbc70f928
│   │   └── data
│   ├── 8b
│   │   └── 8b95be8b8d363b4fd0d3de912d206a4a83f9f445e7a0761c61e4225b55aa3f6a
│   │   └── data
│   ├── 92
│   │   └── 92cd157a4d73a00a56993bce76d467ae170a86b264d24536648834d7f7501cdd
│   │   └── data
│   ├── 9b
│   │   ├── 9b7ad7dfbf08cb21ae35a041aeceb634a80f6145d371fb793e18c9be75b491ce
│   │   │   └── data
│   │   └── 9b8316af6cc601a268bccfd58f93c2598e4a5f8a6b101cb9ffe365bcd467cb8e
│   │   └── data
│   └── f4
│   └── f49cf87b52c10aa83b4f4405800527a74400fb19ea1821d209293bc4d53966aa
│   └── data
└── repositories
└── mysql
├── _layers
│   └── sha256
│   ├── 1c7972822e0cfe7af284610af68fd23ab1c6e36566070199a2ecae0c540a6213
│   │   └── link
│   ├── 28dd7bab809dc36871733509f298775d6e7e9a7b48411969fd40bbc5d42d4872
│   │   └── link
│   ├── 60b597896d30e83b6451b5d287503c6ad5b966afcfe983beaac073cd14d3327e
│   │   └── link
│   ├── 67ee8c6f60b5ee191862ae0beee2e27fc242c1548e724d42491aff9599783f14
│   │   └── link
│   ├── 74616d0d8b72cce832e728b721a055ee94112f55d9152ea75c0c11df9255e5fe
│   │   └── link
│   ├── 78032de49d65ab1151d278821068401fa7a8964c16b2f4441a3ef9ac8dd02229
│   │   └── link
│   ├── 837546b20bc4af04c4cd0b34ac6cb74418f0400fa80045d02d341aecbc70f928
│   │   └── link
│   ├── 8b95be8b8d363b4fd0d3de912d206a4a83f9f445e7a0761c61e4225b55aa3f6a
│   │   └── link
│   ├── 9b7ad7dfbf08cb21ae35a041aeceb634a80f6145d371fb793e18c9be75b491ce
│   │   └── link
│   ├── 9b8316af6cc601a268bccfd58f93c2598e4a5f8a6b101cb9ffe365bcd467cb8e
│   │   └── link
│   └── f49cf87b52c10aa83b4f4405800527a74400fb19ea1821d209293bc4d53966aa
│   └── link
├── _manifests
│   ├── revisions
│   │   └── sha256
│   │   └── 92cd157a4d73a00a56993bce76d467ae170a86b264d24536648834d7f7501cdd
│   │   └── link
│   └── tags
│   └── 5.6
│   ├── current
│   │   └── link
│   └── index
│   └── sha256
│   └── 92cd157a4d73a00a56993bce76d467ae170a86b264d24536648834d7f7501cdd
│   └── link
└── _uploads
53 directories, 26 files
#

从docker registry下载镜像

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
# docker pull registry-srv:5000/mysql:5.6
Trying to pull repository registry-srv:5000/mysql ...
Get http://registry-srv:5000/v2/mysql/manifests/5.6: unauthorized: authentication required
# docker login registry-srv:5000 -uadmin -padmin
Login Succeeded
# docker pull registry-srv:5000/mysql:5.6
Trying to pull repository registry-srv:5000/mysql ...
5.6: Pulling from registry-srv:5000/mysql
f49cf87b52c1: Pull complete
78032de49d65: Pull complete
837546b20bc4: Pull complete
9b8316af6cc6: Pull complete
28dd7bab809d: Pull complete
8b95be8b8d36: Pull complete
67ee8c6f60b5: Pull complete
74616d0d8b72: Pull complete
9b7ad7dfbf08: Pull complete
60b597896d30: Pull complete
Digest: sha256:92cd157a4d73a00a56993bce76d467ae170a86b264d24536648834d7f7501cdd
#
# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
registry-srv:5000/mysql 5.6 1c7972822e0c 8 days ago 299 MB

删除docker registry仓库镜像

在2.4版本中对这一问题进行了解决,增加了一个垃圾回收命令,删除未被引用的层数据,操作如下:

  • 在启动仓库时,需在配置文件中的storage配置中增加delete=true配置项,允许删除镜像
    1
    2
    3
    4
    #完整配置文件请参考 registry-srv.yml
    storage:
    delete:
    enabled: true

先在registry-web上执行删除操作
register_del
register_del

这时数据并未完全删除,需要执行垃圾回收
命令:registry garbage-collect config.yml

1
2
3
4
# 垃圾回收前
# du -sh *
101M docker
#

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
# docker exec -it registry-srv registry garbage-collect /etc/docker/registry/config.yml
mysql
0 blobs marked, 13 blobs eligible for deletion
blob eligible for deletion: sha256:9b8316af6cc601a268bccfd58f93c2598e4a5f8a6b101cb9ffe365bcd467cb8e
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/9b/9b8316af6cc601a268bccfd58f93c2598e4a5f8a6b101cb9ffe365bcd467cb8e go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:67ee8c6f60b5ee191862ae0beee2e27fc242c1548e724d42491aff9599783f14
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/67/67ee8c6f60b5ee191862ae0beee2e27fc242c1548e724d42491aff9599783f14 go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:78032de49d65ab1151d278821068401fa7a8964c16b2f4441a3ef9ac8dd02229
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/78/78032de49d65ab1151d278821068401fa7a8964c16b2f4441a3ef9ac8dd02229 go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:60b597896d30e83b6451b5d287503c6ad5b966afcfe983beaac073cd14d3327e
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/60/60b597896d30e83b6451b5d287503c6ad5b966afcfe983beaac073cd14d3327e go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:74616d0d8b72cce832e728b721a055ee94112f55d9152ea75c0c11df9255e5fe
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/74/74616d0d8b72cce832e728b721a055ee94112f55d9152ea75c0c11df9255e5fe go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:837546b20bc4af04c4cd0b34ac6cb74418f0400fa80045d02d341aecbc70f928
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/83/837546b20bc4af04c4cd0b34ac6cb74418f0400fa80045d02d341aecbc70f928 go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:8b95be8b8d363b4fd0d3de912d206a4a83f9f445e7a0761c61e4225b55aa3f6a
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/8b/8b95be8b8d363b4fd0d3de912d206a4a83f9f445e7a0761c61e4225b55aa3f6a go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:92cd157a4d73a00a56993bce76d467ae170a86b264d24536648834d7f7501cdd
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/92/92cd157a4d73a00a56993bce76d467ae170a86b264d24536648834d7f7501cdd go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:9b7ad7dfbf08cb21ae35a041aeceb634a80f6145d371fb793e18c9be75b491ce
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/9b/9b7ad7dfbf08cb21ae35a041aeceb634a80f6145d371fb793e18c9be75b491ce go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:1c7972822e0cfe7af284610af68fd23ab1c6e36566070199a2ecae0c540a6213
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/1c/1c7972822e0cfe7af284610af68fd23ab1c6e36566070199a2ecae0c540a6213 go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:28dd7bab809dc36871733509f298775d6e7e9a7b48411969fd40bbc5d42d4872
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/28/28dd7bab809dc36871733509f298775d6e7e9a7b48411969fd40bbc5d42d4872 go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/a3/a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430blob eligible for deletion: sha256:f49cf87b52c10aa83b4f4405800527a74400fb19ea1821d209293bc4d53966aa
INFO[0000] Deleting blob: /docker/registry/v2/blobs/sha256/f4/f49cf87b52c10aa83b4f4405800527a74400fb19ea1821d209293bc4d53966aa go.version=go1.7.6 instance.id=1cb0944e-c80c
-4111-9758-df3ed7b72430
#
1
2
3
4
# 垃圾回收后
# du -sh *
204K docker
#

注:在执行垃圾回收后,需要重启registry-srv,否则当再次上传相同IMAGE时,将无法成功上传

1
# docker restart registry-srv

效果图

register_login
register_repositories
register_tags
register_image

参考:
https://hub.docker.com/r/library/registry/
https://github.com/mkuchin/docker-registry-web
https://hub.docker.com/r/hyper/docker-registry-web/
http://www.widuu.com/chinese_docker/index.html

附件:
docker-registry-web.tar.gz


本作品采用知识共享署名 2.5 中国大陆许可协议进行许可,欢迎转载,但转载请注明来自Jack Wang Blog,并保持转载后文章内容的完整。本人保留所有版权相关权利。
打赏
本文出自”Jack Wang Blog”:http://www.yfshare.vip/2017/12/20/自建docker私有仓库-Registry/