1、生成证书
安装openssl,并且生成证书:
yum install -y openssl
mkdir -p /opt/ssl/certs
cd /opt/ssl
openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/dev.registry.guonanjun.com.key -x509 -days 3650 -out certs/dev.registry.guonanjun.com.crt
显示如下:
[root@master ssl]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/dev.registry.guonanjun.com.key -x509 -days 3650 -out certs/dev.registry.guonanjun.com.crt
Generating a 4096 bit RSA private key
..............................................................................................++
..................................++
writing new private key to 'certs/dev.registry.guonanjun.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:guangdong
Locality Name (eg, city) [Default City]:shenzhen
Organization Name (eg, company) [Default Company Ltd]:guonanjun
Organizational Unit Name (eg, section) []:blog
Common Name (eg, your name or your server's hostname) []:dev.registry.guonanjun.com
Email Address []:guonj89@163.com
拷贝证书:
cd /opt/ssl/certs
mkdir -p /etc/docker/certs.d/dev.registry.guonanjun.com
cp dev.registry.guonanjun.com.crt /etc/docker/certs.d/dev.registry.guonanjun.com/ca.crt
2、设置域名解析
vi /etc/hosts
添加以下内容:
192.168.88.100 dev.registry.guonanjun.com
3、配置Nginx
mkdir -p /opt/nginx/conf.d
mkdir -p /opt/nginx/log
vi /opt/nginx/nginx.conf
添加如下内容:
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /tmp/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
}
配置域名信息:
cd /opt/nginx/conf.d/
vi dev.registry.guonanjun.com_ssl.conf
添加如下内容:
upstream docker-registry {
server registry_dev:5000;
}
## Set a variable to help us decide if we need to add the
## 'Docker-Distribution-Api-Version' header.
## The registry always sets this header.
## In the case of nginx performing auth, the header is unset
## since nginx is auth-ing before proxying.
map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
'' 'registry/2.0';
}
server {
listen 443 ssl;
server_name dev.registry.guonanjun.com;
# SSL
ssl_certificate /etc/nginx/conf.d/cert/dev.registry.guonanjun.com.crt;
ssl_certificate_key /etc/nginx/conf.d/cert/dev.registry.guonanjun.com.key;
# Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
# disable any limits to avoid HTTP 413 for large image uploads
client_max_body_size 0;
# required to avoid HTTP 411: see Issue #1486 (https://github.com/moby/moby/issues/1486)
chunked_transfer_encoding on;
location /v2/ {
# Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}
# To add basic authentication to v2 use auth_basic setting.
auth_basic "Registry realm";
auth_basic_user_file /etc/nginx/conf.d/auth/dev.registry.guonanjun.com.htpasswd;
## If $docker_distribution_api_version is empty, the header is not added.
## See the map directive above where this variable is defined.
add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;
proxy_pass http://docker-registry;
proxy_set_header Host $http_host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
}
拷贝证书:
mkdir -p /opt/nginx/conf.d/cert
cd /opt/nginx/conf.d/cert/
cp /opt/ssl/certs/dev.registry.guonanjun.com.key .
cp /opt/ssl/certs/dev.registry.guonanjun.com.crt .
设置密码:
mkdir -p /opt/nginx/conf.d/auth
cd /opt/nginx/conf.d/auth
docker run --rm \
--entrypoint htpasswd \
registry:2 -Bbn 您的用户 您的密码 > dev.registry.guonanjun.com.htpasswd
4、安装Registry
配置docker-compose:
mkdir -p /opt/docker-compose/registry
cd /opt/docker-compose/registry/
vi docker-compose.yml
添加如下内容:
version: '3.1'
services:
registry_dev:
container_name: registry_dev
image: registry:2
ports:
- "5000:5000"
volumes:
- /opt/docker-registry/data:/var/lib/registry
restart: always
nginx_dev:
container_name: nginx_dev
links:
- registry_dev
image: nginx:stable-alpine
ports:
- "80:80"
- "443:443"
volumes:
- "/opt/www:/var/www/html"
- "/opt/nginx/conf.d:/etc/nginx/conf.d"
- "/opt/nginx/nginx.conf:/etc/nginx/nginx.conf"
- "/opt/nginx/log:/var/log/nginx"
restart: always
environment:
TZ: Asia/Shanghai
注意:nginx的镜像一定要是alpine的才支持bcrypt。
5、创建并启动容器
docker-compose up -d
参考资料
未经允许不得转载:君子如兰 » Docker Registry 安装指南–CentOS