[8] Docker – Rejestry

Zainstaluj Docker-Registry, aby zbudować prywatny rejestr dla obrazów Docker.

[1] Pobierz obraz rejestru i uruchom go.
Obrazy kontenerów znajdują się w katalogu [/ var / lib / regstry] w Registry v2 Container, więc zamapuj, aby zamontować [/var/lib/docker/register] na hoście nadrzędnym dla kontenera, aby używać go jako trwałego magazynu.

[root@vlsr01 ~]# docker pull registry:2
2: Pulling from library/registry
e95f33c60a64: Pull complete
4d7f2300f040: Pull complete
35a7b7da3905: Pull complete
d656466e1fe8: Pull complete
b6cb731e4f93: Pull complete
Digest: sha256:da946ca03fca0aade04a73aa94b54ff0dc614216bdd1d47585f97b4c1bdaa0e2
Status: Downloaded newer image for registry:2
docker.io/library/registry:2

[root@vlsr01 ~]# mkdir /var/lib/docker/registry
[root@vlsr01 ~]# docker run -d -p 5000:5000 -v /var/lib/docker/registry:/var/lib/registry registry:2
9cc1e343c846b35a0a411f4057967a5d89024e93be2e91b047adaf0c48b72cb9
[root@vlsr01 ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
9cc1e343c846 registry:2 "/entrypoint.sh /etc…" 10 seconds ago Up 10 seconds 0.0.0.0:5000->5000/tcp vigorous_archimedes
824eb0a89641 root_web "/usr/sbin/nginx -g …" 55 minutes ago Up 32 minutes 0.0.0.0:80->80/tcp root_web_1
a220dbbd5c81 zicher.lab/centos-httpd "/usr/sbin/httpd -D …" 22 hours ago Up 22 hours 0.0.0.0:8082->80/tcp charming_hofstadter
7db34cff96b6 zicher.lab/centos-nginx "/usr/sbin/nginx -g …" 23 hours ago Up 23 hours 0.0.0.0:8081->80/tcp cool_carson

# stwórz na [vlsr01.zicher.lab] kontener [nginx]
[root@vlsr01 ~]# docker run nginx /bin/bash -c "dnf -y install nginx"

# aby użyć rejestrów z innych klientów kontenera, ustaw
[root@vlsr02 ~]# mcedit /etc/docker/daemon.json
# stwórz nowy lub dodaj do istniejącego
# dodaj hosty, z którymi chcesz się łączyć po HTTP (domyślnie jest to HTTPS)
{
"insecure-registries":
[
"docker.internal:5000",
"vlsr01.zicher.lab"
]
}

[root@vlsr02 ~]# systemctl restart docker
[root@vlsr02 ~]# docker tag nginx vlsr01.zicher.lab:5000/nginx:my-registry
[root@vlsr02 ~]# docker push vlsr01.zicher.lab:5000/nginx:my-registry
The push refers to repository [vlsr01.zicher.lab:5000/nginx]
2acf82036f38: Pushed
9f65d1d4c869: Pushed
0f804d36244d: Pushed
9b23c8e1e6f9: Pushed
ffd3d6313c9b: Pushed
9eb82f04c782: Pushed
my-registry: digest: sha256:b08ecc9f7997452ef24358f3e43b9c66888fadb31f3e5de22fec922975caa75a size: 1570

[root@vlsr02 ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
zicher.lab/centos-nginx latest 7ef00d0aec4f 4 hours ago 289MB
vlsr01.zicher.lab:5000/nginx my-registry 35c43ace9216 7 days ago 133MB
nginx latest 35c43ace9216 7 days ago 133MB
centos latest 300e315adb2f 2 months ago 209MB

[2] Dotyczy to przypadku, gdy ustawisz CERTYFIKAT Z PODPISEM WŁASNYM i włączasz połączenie HTTPS.
Ten przykład jest oparty na tym, że certyfikat został utworzony w katalogu [/etc/pki/tls/certs].

[root@vlsr01 certs]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
f0219a93a827 registry:2 "/entrypoint.sh /etc…" 4 hours ago Up 4 hours 0.0.0.0:5000->5000/tcp stoic_bell
ffa9303583f5 zicher.lab/centos-nginx "/usr/sbin/nginx -g …" 4 hours ago Up 4 hours 0.0.0.0:8081->80/tcp vibrant_mayer
091ed20a5db7 centos "/bin/bash" 4 hours ago Up 4 hours focused_maxwell
[root@vlsr01 certs]# docker kill f0219a93a827
f0219a93a827
[root@vlsr01 certs]# docker run -d -p 5000:5000 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/server.crt -e REGISTRY_HTTP_TLS_KEY=/certs/server.key -v /etc/pki/tls/certs:/certs -v /var/lib/docker/registry:/var/lib/registry registry:2
f4353080cf766dc43de19e4f2a55d51289120e748059c7d959d10d068db5688d

# do korzystania z rejestru z innych hostów klientów Docker, ustaw w następujący sposób
# nie trzeba dodawać [insecure-registries], ale
# trzeba zlokalizować certyfikat serwera po stronie klienta w następujący sposób
[root@vlsr02 ~]# mkdir -p /etc/docker/certs.d/vlsr01.zicher.lab:5000
[root@vlsr02 ~]# scp vlsr01.zicher.lab:/etc/pki/tls/certs/server.crt /etc/docker/certs.d/vlsr01.zicher.lab:5000/ca.crt
The authenticity of host 'vlsr01.zicher.lab (192.168.100.101)' can't be established.
ECDSA key fingerprint is SHA256:lzdC5lruAD5xxsRMgnvi8WWMURvGh2hvBSutARdiZAc.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'vlsr01.zicher.lab,192.168.100.101' (ECDSA) to the list of known hosts.
root@vlsr01.zicher.lab's password: # wpisz hasło
server.crt 100% 1326 1.7MB/s 00:00

[root@vlsr02 ~]# docker tag centos vlsr01.zicher.lab:5000/centos:my-registry
[root@vlsr02 ~]# docker push vlsr01.zicher.lab:5000/centos:my-registry
The push refers to repository [vlsr01.zicher.lab:5000/centos]
2653d992f4ef: Pushed
my-registry: digest: sha256:dbbacecc49b088458781c16f3775f2a2ec7521079034a7ba499c8b0bb7f86875 size: 529
[root@vlsr02 ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
zicher.lab/centos-nginx latest 7ef00d0aec4f 5 hours ago 289MB
vlsr01.zicher.lab:5000/nginx my-registry 35c43ace9216 7 days ago 133MB
nginx latest 35c43ace9216 7 days ago 133MB
centos latest 300e315adb2f 2 months ago 209MB
vlsr01.zicher.lab:5000/centos my-registry 300e315adb2f 2 months ago 209MB

[3] Dotyczy to przypadku, gdy ustawisz ważny certyfikat, taki jak Let’s Encrypt, i włączysz połączenie HTTPS.
Ten przykład jest oparty na tym, że certyfikat został utworzony w katalogu [/etc/letsencrypt].

[root@vlsr02 ~]# docker run -d -p 5000:5000 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/fullchain.pem -e REGISTRY_HTTP_TLS_KEY=/certs/privkey.pem -v /etc/letsencrypt/live/vlsr01.zicher.lab:/certs -v /var/lib/docker/registry:/var/lib/registry registry:2
Unable to find image 'registry:2' locally
2: Pulling from library/registry
e95f33c60a64: Pull complete
4d7f2300f040: Pull complete
35a7b7da3905: Pull complete
d656466e1fe8: Pull complete
b6cb731e4f93: Pull complete
Digest: sha256:da946ca03fca0aade04a73aa94b54ff0dc614216bdd1d47585f97b4c1bdaa0e2
Status: Downloaded newer image for registry:2
f84790dcd5e55dd8c051a9508909f3ba7c23583cc6ca4a5925747cf0ec4e6db7

# do korzystania z rejestru z innych hostów/klientów Docker, ustawiamy w następujący sposób
# nie trzeba zmieniać żadnych konkretnych ustawień, można go używać domyślnie
[root@vlsr02 ~]# docker tag nginx vlsr01.zicher.lab:5000/my-nginx:my-registry
[root@vlsr02 ~]# docker push vlsr01.zicher.lab:5000/my-nginx:my-registry
The push refers to repository [vlsr01.zicher.lab:5000/my-nginx]
2acf82036f38: Mounted from nginx
9f65d1d4c869: Mounted from nginx
0f804d36244d: Mounted from nginx
9b23c8e1e6f9: Mounted from nginx
ffd3d6313c9b: Mounted from nginx
9eb82f04c782: Mounted from nginx
my-registry: digest: sha256:b08ecc9f7997452ef24358f3e43b9c66888fadb31f3e5de22fec922975caa75a size: 1570
[root@vlsr02 ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
zicher.lab/centos-nginx latest 7ef00d0aec4f 5 hours ago 289MB
registry 2 5c4008a25e05 14 hours ago 26.2MB
nginx latest 35c43ace9216 7 days ago 133MB
vlsr01.zicher.lab:5000/my-nginx my-registry 35c43ace9216 7 days ago 133MB
vlsr01.zicher.lab:5000/nginx my-registry 35c43ace9216 7 days ago 133MB
vlsr01.zicher.lab:5000/centos my-registry 300e315adb2f 2 months ago 209MB
centos latest 300e315adb2f 2 months ago 209MB