一、Harbor
是由VMware公司的中国团队开发的。私有的docker镜像仓库。
Harbor是一个开放源代码可信云本机注册表项目，用于存储，签名和扫描内容。Harbor通过添加
用户通常需要的功能（例如安全性，身份和管理）扩展了开源Docker Distribution。使注册表更
接近于构建和运行环境可以提高图像传输效率。Harbor支持在注册表之间复制映像，还提供高级
安全功能，例如用户管理，访问控制和活动审核。
官方：https://hub.docker.com/
第三方：https://registry.cn-hangzhou.aliyuncs.com
私有的docker镜像仓库：Harbor
1、登录注册
2、安全认证
3、镜像仓库
官网：https://goharbor.io/
| 硬件 |
最低要求 |
推荐 |
| CPU |
2 CPU |
4 CPU |
| 内存 |
4GB |
8 GB |
| 磁盘 |
40 GB |
160 GB |
二、安装部署Harbor
#安装依赖
[root@harbor ~]# yum install -y yum-utils device-mapper-persistent-data lvm2
#安装阿里云源仓库
[root@harbor ~]# yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
[root@harbor ~]# sed -i 's+download.docker.com+mirrors.aliyun.com/docker-ce+' /etc/yum.repos.d/docker-ce.repo
#查看docker版本
[root@harbor ~]# yum list docker-ce --showduplicates | sort -r
#选择19版本，进行安装
[root@harbor ~]# yum install -y docker-ce-19.03.9
[root@harbor ~]# mkdir /etc/docker -p
[root@harbor ~]# cd /etc/docker
[root@harbor ~]# cat > /etc/docker/daemon.json <<EOF
{
"registry-mirrors": ["https://dp0vxr93.mirror.aliyuncs.com"]
}
EOF
[root@harbor ~]# systemctl daemon-reload
[root@harbor ~]# systemctl enable --now docker
#安装OpenSSL
[root@harbor ~]# yum install openssl openssl-devel -y
#下载Harbor
下载地址： https://github.com/goharbor/harbor/releases
[root@harbor ~]# tar xf harbor-offline-installer-v2.3.3.tgz -C /usr/local/
#安装docker-compose
下载地址：https://github.com/docker/compose/releases
[root@harbor /usr/local/bin]# wget https://github.com/docker/compose/releases/download/1.29.2/docker-compose-Linux-x86_64
[root@harbor /usr/local/bin]# mv docker-compose-Linux-x86_64 docker-compose
[root@harbor /usr/local/bin]# chmod +x docker-compose
[root@harbor /usr/local/bin]# docker-compose version
docker-compose version 1.29.2, build 5becea4c
docker-py version: 5.0.0
CPython version: 3.7.10
OpenSSL version: OpenSSL 1.1.0l 10 Sep 2019
#生成CA证书私钥
[root@harbor ~]# mkdir /opt/ssl
[root@harbor ~]# cd /opt/ssl
[root@harbor /opt/ssl]# openssl genrsa -out ca.key 4096
#生成CA证书
[root@harbor /opt/ssl]# openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=CN/ST=ShangHai/L=ShangHai/O=example/OU=Personal/CN=10.0.0.75" -key ca.key -out ca.crt
#生成服务器端证书
1.生成私钥
[root@harbor /opt/ssl]# openssl genrsa -out 10.0.0.75.key 4096
2.生成证书签名请求
[root@harbor /opt/ssl]# openssl req -sha512 -new -subj "/C=CN/ST=ShangHai/L=ShangHai/O=example/OU=Personal/CN=10.0.0.75" -key 10.0.0.75.key -out 10.0.0.75.csr
#生成x509 v3服务文件
[root@harbor /opt/ssl]# cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = IP:10.0.0.75
EOF
#使用该 v3.ext 文件为您的Harbor主机生成证书
[root@harbor /opt/ssl]# openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in 10.0.0.75.csr \
-out 10.0.0.75.crt
#使用该 v3.ext 文件为您的Harbor主机生成证书
[root@harbor /opt/ssl]# openssl x509 -inform PEM -in 10.0.0.75.crt -out 10.0.0.75.cert
[root@harbor /opt/ssl]# ll
-rw-r--r-- 1 root root 2053 Nov 10 20:13 10.0.0.75.cert
-rw-r--r-- 1 root root 2053 Nov 10 20:12 10.0.0.75.crt
-rw-r--r-- 1 root root 1704 Nov 10 20:10 10.0.0.75.csr
-rw-r--r-- 1 root root 3243 Nov 10 20:09 10.0.0.75.key
-rw-r--r-- 1 root root 2033 Nov 10 20:06 ca.crt
-rw-r--r-- 1 root root 3243 Nov 10 20:06 ca.key
-rw-r--r-- 1 root root 17 Nov 10 20:12 ca.srl
-rw-r--r-- 1 root root 201 Nov 10 20:12 v3.ext
#创建docker证书存放目录
[root@harbor /opt/ssl]# mkdir -p /etc/docker/certs.d/10.0.0.75
[root@harbor /opt/ssl]# cp 10.0.0.75.key /etc/docker/certs.d/10.0.0.75/
[root@harbor /opt/ssl]# cp 10.0.0.75.cert /etc/docker/certs.d/10.0.0.75/
[root@harbor /opt/ssl]# cp ca.crt /etc/docker/certs.d/10.0.0.75/
[root@harbor /opt/ssl]# ll /etc/docker/certs.d/10.0.0.75
-rw-r--r-- 1 root root 2053 Nov 10 20:16 10.0.0.75.cert
-rw-r--r-- 1 root root 3243 Nov 10 20:16 10.0.0.75.key
-rw-r--r-- 1 root root 2033 Nov 10 20:16 ca.crt
[root@harbor /opt/ssl]# systemctl restart docker
#编辑yml文件
[root@harbor /opt/ssl]# cd /usr/local/harbor
[root@harbor /usr/local/harbor]# cp harbor.yml.tmpl harbor.yml
[root@harbor /usr/local/harbor]# vim harbor.yml
hostname: 10.0.0.75
certificate: /opt/ssl/10.0.0.75.crt
private_key: /opt/ssl/10.0.0.75.key
#生成配置并安装
[root@harbor /usr/local/harbor]# ./prepare
[root@harbor /usr/local/harbor]# ./install.sh
#浏览器访问10.0.0.75:80
#用户：admin
#密码：Harbor12345
3.报错
[root@harbor /usr/local/harbor]# docker login 10.0.0.75
Username: root
Password:
Error response from daemon: Get https://10.0.0.75/v2/: x509: certificate signed by unknown authority
#修改 /lib/systemd/system/docker.service 文件里的 ExecStart= 行：
[root@harbor /usr/local/harbor]# vim /lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --insecure-registry=10.0.0.75
#重载、重启 docker 服务
[root@harbor /usr/local/harbor]# systemctl daemon-reload
[root@harbor /usr/local/harbor]# systemctl restart docker
#登录
[root@harbor /usr/local/harbor]# docker login 10.0.0.75
Username: root
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded