Docker（7）Docker仓库之（私有仓库的加密认证和简单的web管理界面）_docker 私有仓库的web界面怎么进入

本地——>本地加密

私有仓库的加密，将本地镜像上传到docker仓库中

https://docs.docker.com/registry/insecure/  docker的官方文档

-v    本地的目录
-e    容器开启的端口
-p    映射端口

docker run -d --restart=always --name registry -v "$(pwd)"/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -p 443:443 -v "$(pwd)"/auth:/auth -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry

systemctl status docker先开启docker
创建目录certs
[root@server1 ~]# mkdir -p certs      
[root@server1 ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/westos.org.key -x509 -days 365 -out certs/westos.org.crt
Generating a 4096 bit RSA private key
..................................................................++
...................................................................................................................................++
writing new private key to 'certs/westos.org.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shaanxi
Locality Name (eg, city) [Default City]:Xi'an
Organization Name (eg, company) [Default Company Ltd]:University
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:westos.org
Email Address []:root@westos.org

[root@server1 ~]# docker ps -a
查看私有仓库
[root@server1 ~]# docker rm -f registry
删掉之前的私有仓库,直到以下那种，删干净

[root@server1 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES

# 注意此处：REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -p 443:443 registry 不是：/root/...

root@server1 ~]# docker run -d   --restart=always   --name registry   -v "$(pwd)"/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -p 443:443 registry

Unable to find image 'registry:latest' locally
latest: Pulling from library/registry
c87736221ed0: Pull complete
1cc8e0bb44df: Pull complete
54d33bcb37f5: Pull complete
e8afc091c171: Pull complete
b4541f6d3db6: Pull complete
Digest: sha256:8004747f1e8cd820a148fb7499d71a76d45ff66bac6a29129bfdbfdc0154d146
Status: Downloaded newer image for registry:latest
e6632b5d20e434dd064149b02f46efbe726a3195e78f02dc1d72c0fa03a8c927

添加本地解析，# 因为我们所使用的域名是westos.org 所以主机名要有解析
[root@server1 ~]# vim /etc/hosts
[root@server1 ~]# ping westos.org
PING server1 (172.25.28.1) 56(84) bytes of data.
64 bytes from server1 (172.25.28.1): icmp_seq=1 ttl=64 time=0.032 ms
64 bytes from server1 (172.25.28.1): icmp_seq=2 ttl=64 time=0.037 ms
^C
--- server1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.032/0.034/0.037/0.006 ms

查看端口是否开启
[root@server1 ~]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      848/sshd            
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      949/master          
tcp        0      0 172.25.28.1:22          172.25.28.250:37186     ESTABLISHED 1152/sshd: root@pts
tcp6       0      0 :::22                   :::*                    LISTEN      848/sshd            
tcp6       0      0 ::1:25                  :::*                    LISTEN      949/master          
tcp6       0      0 :::443                  :::*                    LISTEN      1625/docker-proxy

此时进行本地上传镜像
[root@server1 westos.org]# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
busybox             latest              020584afccce        9 days ago          1.22MB
registry            latest              f32a97de94e1        8 months ago        25.8MB
game2048            latest              19299002fdbe        2 years ago         55.5MB
[root@server1 westos.org]# docker tag busybox westos.org/busyox
                                                   上传后的名字
[root@server1 westos.org]# docker push westos.org/busyox
The push refers to repository [westos.org/busyox]
1da8e4c8d307: Pushed
latest: digest: sha256:679b1c1058c1f2dc59a3ee70eed986a88811c0205c8ceea57cec5f22d2c3fbb1 size: 527

成功！！！

 

# 添加客户端的push认证
# 在之前的443更改 不用官网的5000

[root@server1 ~]# docker run --entrypoint htpasswd registry -Bbn testuser testpassword > auth/htpasswd
[root@server1 ~]# cd auth/
[root@server1 auth]# ls
htpasswd
[root@server1 auth]# cat htpasswd
testuser:$2y$05$dqGVPcspJv.UNnwJ8y47FuywJ17eW9weLgoDFIbgHe9UlXVmPB1SO

可以追加认证信息
[root@server1 ~]# docker run --entrypoint htpasswd registry -Bbn admin passwd >> auth/htpasswd
[root@server1 ~]# cat auth/htpasswd
yyz:$2y$05$X3FrmrdjhhsPT7h9.NgBxO2U.z9N2ic2uD/G2IJhPoeQ44r7gu1gK

admin:$2y$05$Yv6w1WENRjMkGd6rn6yqSOhfnc4TBZkAhOrWf4DyPobCNTPeE9X.O

[root@server1 ~]# docker run --entrypoint htpasswd registry -Bbn admin westos >> auth/htpasswd

[root@server1 ~]# docker run -d   --restart=always   --name registry   -v "$(pwd)"/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -p 443:443 -v "$(pwd)"/auth:/auth -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm"  -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry

此时失败，报错：
Error response from daemon: Conflict. The container name "/registry" is already in use by container "a1744536053ea3efdcff4f67db781c0622d726313687f3a7af90998c940ff308". You have to remove (or rename) that container to be able to reuse that name.

必须把私有仓库删除，才可以进行
[root@server1 ~]# docker rm -f registry  
registry
[root@server1 ~]# docker run -d   --restart=always   --name registry   -v "$(pwd)"/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -p 443:443 -v "$(pwd)"/auth:/auth -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm"  -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry
22bd3e55d45b70aa6048c32a73167a2dc623e780f35e9b1bec588bf7526982e1

[root@server1 ~]# docker ps -a
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS                      PORTS                            NAMES
22bd3e55d45b        registry            "/entrypoint.sh /etc…"   2 minutes ago       Up 2 minutes                0.0.0.0:443->443/tcp, 5000/tcp   registry
13a7a7843802        registry            "htpasswd -Bbn admin…"   4 minutes ago       Exited (0) 4 minutes ago                                     eager_agnesi
ad8ab4752f54        registry            "htpasswd -Bbn admin…"   31 minutes ago      Exited (0) 31 minutes ago                                    recursing_mendel
9dc48b269b06        registry            "htpasswd -Bbn yyz z…"   31 minutes ago      Exited (0) 31 minutes ago                                    quirky_chebyshev
9399720e5b34        registry            "htpasswd -Bbn testu…"   41 minutes ago      Exited (0) 41 minutes ago                                    angry_hertz
c5ac8e904955        busybox             "htpasswd testpasswo…"   43 minutes ago      Created                                                      focused_lovelace

[root@server1 ~]# docker login westos.org   用认证帐号等录
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
[root@server1 ~]# docker logout westos.org     退出，此时再进行上传，会提示没有进行登陆认证
Removing login credentials for westos.org
[root@server1 ~]# docker push westos.org/busyox
The push refers to repository [westos.org/busyox]
1da8e4c8d307: Preparing
no basic auth credentials     提示没有认证
[root@server1 ~]# docker login westos.org     再次登陆时，才可以进行上传镜像
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
[root@server1 ~]# docker push westos.org/busyox
The push refers to repository [westos.org/busyox]
1da8e4c8d307: Pushed
latest: digest: sha256:679b1c1058c1f2dc59a3ee70eed986a88811c0205c8ceea57cec5f22d2c3fbb1 size: 527

上传成功～～～～

#远程主机怎么连接
思想：其实在公司中，就是装配好的镜像，放到私有库里去，攻别人使用。
谁需要，就进行认证，和用公司域名去pull即可
再打开一台虚拟机，安装docker并启动
主机名要有解析
[root@server2 docker包]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.0.1    server1
172.25.0.2    server2
172.25.0.3    server3 westos.org
172.25.0.4    server4
172.25.0.5    server5
172.25.0.6    server6
172.25.0.7    server7
172.25.0.8    server8

[root@server2 docker包]# ping westos.org
PING server3 (172.25.0.3) 56(84) bytes of data.
64 bytes from server3 (172.25.0.3): icmp_seq=1 ttl=64 time=0.397 ms

要有认证文件，这个文件可以从server3这台主机获得
# 现有证书才能完成认证
[root@server3 ~]# cd /etc/docker/
[root@server3 docker]# ls
certs.d  daemon.json  key.json
[root@server3 docker]# scp -r certs.d/ server2:/etc/docker/
The authenticity of host 'server2 (172.25.0.2)' can't be established.
ECDSA key fingerprint is 67:9d:41:df:c9:b5:0e:f3:e1:30:72:c7:c9:07:69:e0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'server2,172.25.0.2' (ECDSA) to the list of known hosts.
root@server2's password:
ca.crt                                        100% 2098     2.1KB/s   00:00    

[root@server2 docker包]# cd /etc/docker/
[root@server2 docker]# ls
certs.d  key.json

先认证再拉取
[root@server2 certs.d]# docker login westos.org
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
[root@server2 certs.d]# docker pull westos.org/nginx
Using default tag: latest
Error response from daemon: manifest for westos.org/nginx:latest not found
[root@server2 certs.d]# docker pull westos.org/nginx:v3
v3: Pulling from nginx
48f5bbc9baf5: Pull complete
15f1fc4f91e0: Pull complete
98331229c5fd: Pull complete
4c7f36e2f886: Pull complete
df58a187e237: Pull complete
Digest: sha256:ad7f1eadc6268d111c7c1763dd76943e4c1f831f59bde82796bc351b894526b5
Status: Downloaded newer image for westos.org/nginx:v3

测试运行成功
[root@server2 certs.d]# docker run -d --name nginx -p 80:80 westos.org/nginx:v3
299df76d6167d789883a1b7bdb9e338659f49be2e146bd4098e409a7f35d6a02
[root@server2 certs.d]# docker pa
docker: 'pa' is not a docker command.
See 'docker --help'
[root@server2 certs.d]# docker ps
CONTAINER ID        IMAGE                 COMMAND                  CREATED             STATUS              PORTS                NAMES
299df76d6167        westos.org/nginx:v3   "/usr/local/nginx/sb…"   9 seconds ago       Up 8 seconds        0.0.0.0:80->80/tcp   nginx
[root@server2 certs.d]# curl localhost

 

我们需要一个web页面，来济宁
# 拉取一个镜像
# 可以先search一下
[root@server3 docker]# docker pull hyper/docker-registry-web
Using default tag: latest
latest: Pulling from hyper/docker-registry-web
04c996abc244: Pull complete
d394d3da86fe: Pull complete
bac77aae22d4: Pull complete
b48b86b78e97: Pull complete
09b3dd842bf5: Pull complete
69f4c5394729: Pull complete
b012980650e9: Pull complete
7c7921c6fda1: Pull complete
e20331c175ea: Pull complete
40d5e82892a5: Pull complete
a414fa9c865a: Pull complete
0304ae3409f3: Pull complete
13effc1a664f: Pull complete
e5628d0e6f8c: Pull complete
0b0e130a3a52: Pull complete
d0c73ab65cd2: Pull complete
240c0b145309: Pull complete
f1fd6f874e5e: Pull complete
40b5e021928e: Pull complete
88a8c7267fbc: Pull complete
f9371a03010e: Pull complete
Digest: sha256:723ffa29aed2c51417d8bd32ac93a1cd0e7ef857a0099c1e1d7593c09f7910ae
Status: Downloaded newer image for hyper/docker-registry-web:latest

#去git hub搜索 按照文档做操作
https://github.com/mkuchin/docker-registry-web
[root@server3 ~]# cat .docker/config.json #查看之前的认证信息
{
    "auths": {
        "": {
            "auth": "ZGFuZ2Rhbmd3ZXN0b3M6ZGFuZ2Rhbmc="
        },
        "https://index.docker.io/v1/": {
            "auth": "ZGFuZ2Rhbmd3ZXN0b3M6ZGFuZ2Rhbmc="
        },
        "westos.org": {
            "auth": "YWRtaW46d2VzdG9z"  #-e REGISTRY_BASIC_AUTH="YWRtaW46d2VzdG9z"
        }
    },
    "HttpHeaders": {
        "User-Agent": "Docker-Client/18.09.6 (linux)"
    }

[root@server3 ~]# docker run -it -p 8080:8080 --name registry-web --link registry:westos.org -e REGISTRY_URL=https://westos.org/v2 -e REGISTRY_TRUST_ANY_SSL=true -e REGISTRY_BASIC_AUTH="YWRtaW46d2VzdG9z" -e REGISTRY_NAME=westos.org:443 hyper/docker-registry-web  #v2:是一个版本

在浏览器测试：http://172.25.28.1:8080/

# 推荐学习：https://goharbor.io/