Docker仓库实际上提供两方面的功能，一个是镜像管理，一个是认证。
前者主要由docker-registry项目来实现，通过http服务来上传下载
后者可以通过docker-index（闭源）项目或者利用现成认证方案（如nginx）实现http请求管理。
利用docker registry镜像搭建好私有docker仓库后，我们可以结合nginx和https实现认证和加密功能。
【Docker Registry】用docker registry 镜像搭建私有测试仓库
https://www.jianshu.com/p/ec411265e5ee
一、实验环境
操作系统：CentOS7.3
docker registry服务器IP（serverA）：192.168.1.108
docker client 服务器IP（serverB）： 192.168.1.110
serverA上已经搭建好docker registry 私有仓库，serverB上已经装好docker。
二、软件安装
在serverA
# yum -y install epel-release
# yum -y install nginx
# vim /etc/nginx/nginx.conf
######################################
# For more information on configuration, see:
# * Official English Documentation:http://nginx.org/en/docs/
# * Official Russian Documentation:http://nginx.org/ru/docs/
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
upstream docker-registry {
server 192.168.1.108:5000;
}
server {
listen 443;
server_name docker.test.com;
ssl on;
ssl_certificate /etc/nginx/ssl/nginx-selfsigned.crt;
ssl_certificate_key /etc/nginx/ssl/nginx-selfsigned.key;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
client_max_body_size 0;
chunked_transfer_encoding on;
add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always;
location / {
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/auth/htpasswd.txt;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
proxy_pass http://docker-registry;
}
location /_ping {
auth_basic off;
proxy_pass http://docker-registry;
}
location /v2/_ping {
auth_basic off;
proxy_pass http://docker-registry;
}
location /v2/_catalog {
auth_basic off;
proxy_pass http://docker-registry;
}
}
}
#######################################
生成私钥和证书
# mkdir -p /etc/nginx/ssl
# openssl req -x509 -nodes \
-newkey rsa:2048 \
-days 365 \
-subj "/C=CN/ST=Gunagdong/L=Shenzhen/O=Test/OU=Test/CN=docker.test.com" \
-keyout /etc/nginx/ssl/nginx-selfsigned.key \
-out /etc/nginx/ssl/nginx-selfsigned.crt
htpasswd 工具生成用户账户 Micheal/Michael@123
# mkdir /etc/nginx/auth
# cd /etc/nginx/auth
# htpasswd -c htpasswd.txt Michael
# cat htpasswd.txt
# systemctl start nginx
# systemctl status nginx
浏览器访问 https://192.168.1.108:443
在serverB
添加域名解析
# echo "192.168.1.108 docker.test.com" >> /etc/hosts
从serverA拷贝证书
# scp root@192.168.1.108:/etc/nginx/ssl/nginx-selfsigned.crt /etc/pki/ca-trust/source/anchors
# update-ca-trust
# systemctl restart docker
三、实验测试
在serverB
登录仓库
# docker login docker.test.com:443 -u Michael -p"Michael@123"
# cat /root/.docker/config.json
测试push镜像
# docker pull busybox
# docker tag busybox:latest docker.test.com:443/busybox:v1
# docker push docker.test.com:443/busybox:v1
如果没有登录成功，那么就会出现推拉镜像失败
四、参考
用docker registry 镜像搭建私有测试仓库
https://www.jianshu.com/p/ec411265e5ee
Authenticate proxy with nginx
https://docs.docker.com/registry/recipes/nginx
透过 nginx 反向代理docker 私有 registry
https://www.jianshu.com/p/265f228a0471
https://blog.csdn.net/wanglei_storage/article/details/51444432
