基于Harbor搭建docker registry
環(huán)境
本文記錄一下在Centos7.3操作系統(tǒng)上，基于Harbor來(lái)搭建docker registry。當(dāng)前環(huán)境為：
# cat /etc/centos-release
CentOS Linux release 7.3.1611 (Core)
# uname -a
Linux bogon 3.10.0-514.el7.x86_64 #1 SMP Tue Nov 22 16:42:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
# docker --version
Docker version 17.12.1-ce, build 7390fc6
# docker-compose --version
docker-compose version 1.20.1, build 5d8c71b
1. Harbor簡(jiǎn)介
Harbor工程是一個(gè)企業(yè)級(jí)的鏡像服務(wù)器，用于存儲(chǔ)和分發(fā)Docker鏡像。Harbor擴(kuò)展了開(kāi)源軟件Docker Distribution，添加了如security、identity和management等功能。作為一個(gè)企業(yè)級(jí)的私有鏡像倉(cāng)庫(kù)，Harbor提供了更好的性能和安全性。Harbor支持建立多個(gè)registries,并提供這些倉(cāng)庫(kù)間鏡像的復(fù)制能力。Harbor也提供了更加先進(jìn)的安全特性，比如用戶(hù)管理、訪(fǎng)問(wèn)控制、活動(dòng)審計(jì)。
Harbor特性：
基于角色的訪(fǎng)問(wèn)控制:
users和repositories都是以projects的方式組織的。在一個(gè)project下面，每一個(gè)用戶(hù)對(duì)鏡像有不同的全向。基于策略的鏡像復(fù)制: 在多個(gè)registry之間鏡像可以同步，并且在出現(xiàn)錯(cuò)誤的時(shí)候可以進(jìn)行自動(dòng)重試。在負(fù)載均衡、高可用性、多數(shù)據(jù)中心和異構(gòu)云環(huán)境下都表現(xiàn)出色。
脆弱性?huà)呙?Vulnerability Scanning): Harbor會(huì)周期性的掃描鏡像，然后警告用戶(hù)相應(yīng)的脆弱性
LDAP/AD支持: Harbor可以和已存在的企業(yè)版LDAP/AD系統(tǒng)集成，以提供用戶(hù)認(rèn)證和管理
鏡像刪除 & 垃圾回收: Images可以被刪除，然后回收它們所占用的空間
可信任(Notary): 可以確保鏡像的真實(shí)性
用戶(hù)界面(Graphical user portal): 用戶(hù)可以人容易的瀏覽、搜索倉(cāng)庫(kù)和管理工程
審計(jì)(Auditing): 所有對(duì)倉(cāng)庫(kù)的操作都會(huì)被跟蹤記錄
RESTful API: 對(duì)于大部分的管理操作都提供了RESTful API， 很容易和外部系統(tǒng)進(jìn)行集成
易部署: 提供了離線(xiàn)和在線(xiàn)安裝
2. Harbor的安裝
這里介紹的是通過(guò)Harbor安裝文件的方式來(lái)安裝Harbor。在Linux操作系統(tǒng)上至少需要如下環(huán)境：
2.1 下載Harbor離線(xiàn)安裝包
到Harbor Release頁(yè)面下載對(duì)應(yīng)的離線(xiàn)安裝包，目前我們下載最新版本v1.4.0:
# mkdir /opt/harbor-inst
# cd /opt/harbor-inst
# wget https://storage.googleapis.com/harbor-releases/release-1.4.0/harbor-offline-installer-v1.4.0.tgz
2.2 目標(biāo)主機(jī)相關(guān)配置推薦
Harbor部署完后會(huì)運(yùn)行多個(gè)Docker containers，因此可以部署在任何支持docker的Linux發(fā)布版本上。部署的目標(biāo)主機(jī)需要安裝Python, Docker和Docker Compose。
硬件環(huán)境：
| Resource | Capacity | Description |
|---|---|---|
| CPU | minimal 2 CPU | 4 CPU is prefered |
| Mem | minimal 4GB | 8GB is preffered |
| Disk | minimal 40GB | 160GB is preffered |
軟件環(huán)境
| Software | Version | Description |
|---|---|---|
| Python | version 2.7 or higher | 注意： 在有一些Linux發(fā)布版本(Gentoo、Arch)默認(rèn)沒(méi)有安裝Python，此時(shí)你必須手動(dòng)安裝 |
| Docker Engine | version 1.10 or higher | 具體安裝手冊(cè)，請(qǐng)參看相關(guān)文檔:https://docs.docker.com/engine/installation/ |
| Docker Compose | version 1.6.0 or higher | 具體安裝手冊(cè)，請(qǐng)參看相關(guān)文檔:https://docs.docker.com/compose/install/ |
| Openssl | latest is preffered | 用于為Harbor產(chǎn)生證書(shū)和秘鑰 |
網(wǎng)絡(luò)端口
| Port | Protocol | Description |
|---|---|---|
| 443 | HTTPS | 在https協(xié)議下，Harbor UI與API將會(huì)在本端口上接收請(qǐng)求 |
| 4443 | HTTPS | Harbor的Docker Content Trust service將會(huì)連接到本端口，只在Notary啟用時(shí)使用 |
| 80 | HTTP | 在http協(xié)議下，Harbor UI與API將會(huì)在本端口上接收請(qǐng)求 |
我們當(dāng)前的硬件環(huán)境：
//物理CPU個(gè)數(shù)
# cat /proc/cpuinfo| grep "physical id"| sort| uniq| wc -l
1
//每個(gè)CPU核數(shù)
# cat /proc/cpuinfo| grep "cpu cores"| uniq
cpu cores : 4
//邏輯CPU個(gè)數(shù)
# cat /proc/cpuinfo | grep processor
processor : 0
processor : 1
processor : 2
processor : 3
# cat /proc/meminfo | grep MemTotal
MemTotal: 10058704 kB
# fdisk -l | grep Disk
Disk /dev/sda: 85.9 GB, 85899345920 bytes, 167772160 sectors
Disk label type: dos
Disk identifier: 0x000c3eb0
我們當(dāng)前軟件環(huán)境：
# python --version
Python 2.7.5
# docker --version
Docker version 17.12.1-ce, build 7390fc6
# docker-compose --version
docker-compose version 1.20.1, build 5d8c71b
# openssl version -v
OpenSSL 1.0.2k-fips 26 Jan 2017
2.3 安裝步驟
安裝Harbor一般遵循如下步驟：
下載Harbor installer
配置harbor.cfg
運(yùn)行
install.sh腳本進(jìn)行安裝并啟動(dòng)harbor
2.3.1 解壓harbor安裝包
我們?cè)谏厦嫦螺d了harbor安裝包，這里解壓：
# pwd
/opt/harbor-inst
# ls
harbor-offline-installer-v1.4.0.tgz
# tar -zxvf harbor-offline-installer-v1.4.0.tgz
# cd harbor
2.3.2 配置Harbor
Harbor配置參數(shù)處于harbor.cfg文件中。在harbor.cfg配置文件中，有兩大類(lèi)參數(shù)： 必填參數(shù)和可選參數(shù)
required parameters: 這些參數(shù)在配置文件中必須填寫(xiě)。在更新harbor.cfg配置文件后，調(diào)用install.sh重新安裝Harbor，這些參數(shù)就會(huì)起作用optional parameters: 這些參數(shù)在更新時(shí)是可選的。例如， 用戶(hù)可以先讓這些參數(shù)取默認(rèn)值，然后在Harbor啟動(dòng)后在Web UI上來(lái)進(jìn)行修改。假如這些參數(shù)在harbor.cfg中也進(jìn)行了配置，那么只在第一次啟動(dòng)harbor有效。后續(xù)再對(duì)harbor.cfg進(jìn)行更新將會(huì)被忽略。
Note: 假如你選擇通過(guò)Web UI的方式來(lái)更改這些參數(shù)，確保在Harbor啟動(dòng)之后馬上進(jìn)行更改。通常，你必須在注冊(cè)或創(chuàng)建新的用戶(hù)之前設(shè)置auth_mode。
當(dāng)Harbor系統(tǒng)中有用戶(hù)之后（出admin管理用戶(hù)外)，auth_mode是不能被修改的
如下所描述的參數(shù)，你至少需要更改hostname屬性：
Required parameters:
hostname: 目標(biāo)主機(jī)的hostname名稱(chēng)，被用于訪(fǎng)問(wèn)WebUI和registry服務(wù)。其可以被設(shè)置為IP地址，或者你目標(biāo)機(jī)器的全限定域名。例如:192.168.1.10或者reg.yourdomain.com。注意不要將hostname設(shè)置為localhost或者127.0.0.1, registry服務(wù)需要能夠被外網(wǎng)訪(fǎng)問(wèn)的到。ui_url_protocol: 可以設(shè)置為http或者h(yuǎn)ttps，默認(rèn)值為http。該協(xié)議被用于訪(fǎng)問(wèn)Web UI和token/notification服務(wù)。假如Notary被使能的話(huà)，則必須設(shè)置為https。默認(rèn)情況下采用http協(xié)議，要想設(shè)置為https,請(qǐng)參看Configuring Harbor with HTTPS Accessdb_password: 當(dāng)auth采用db_auth方式時(shí)，用于設(shè)置MySQL數(shù)據(jù)庫(kù)的密碼。請(qǐng)?jiān)谌魏螌?shí)際生產(chǎn)環(huán)境中，修改此密碼max_job_workers: 用于設(shè)置job service中replicationworker的最大數(shù)（默認(rèn)為3）。對(duì)于每一個(gè)image replication任務(wù)，一個(gè)worker會(huì)同步repository中所有tags到遠(yuǎn)程目標(biāo)地址。增大本字段的值，允許在一個(gè)系統(tǒng)中有更多的并發(fā)復(fù)制進(jìn)程。然而，每個(gè)replication worker都會(huì)消耗一定數(shù)量的network/CPU/IO資源，請(qǐng)基于你當(dāng)前的硬件環(huán)境選擇一個(gè)合適的值。customize_crt: 可以被設(shè)置為on或者off，默認(rèn)值為on。當(dāng)本屬性設(shè)置為on時(shí)，prepare腳本會(huì)創(chuàng)建一個(gè)private key及root certificate,以用于registry token的驗(yàn)證。假如本屬性被設(shè)置為off的話(huà)，你可以自己手動(dòng)來(lái)產(chǎn)生private key及root certificate。請(qǐng)參看:Customize Key and Certificate of Harbor Token Servicessl_cert: SSL certificate路徑，當(dāng)協(xié)議被設(shè)置為https時(shí)使用ssl_cert_key: SSL key路徑，當(dāng)協(xié)議被設(shè)置為https時(shí)使用secretkey_path: 用于加密和機(jī)密遠(yuǎn)程registry密碼的key路徑log_rotate_count: 用于設(shè)置日志在回滾多少次之后被刪除。假如被設(shè)置為0，則日志不會(huì)被回滾，而是會(huì)被直接刪除log_rotate_size: 用于設(shè)置日志在多大時(shí)會(huì)進(jìn)行回滾，單位可以是K/M/G，分別表示KB/MB/GB。
Optional parameters:
Email settings: 這些信息主要是為了重置Harbor密碼時(shí)使用，通常情況下我們并不需要。harbor_admin_password: 用于設(shè)置管理員初始密碼。該密碼只在Harbor第一次啟動(dòng)時(shí)有效。啟動(dòng)之后該密碼將會(huì)被忽略，Administrator的密碼應(yīng)該在UI中進(jìn)行設(shè)置。注意，默認(rèn)的用戶(hù)名/密碼為admin/Harbor12345。auth_mode: 用戶(hù)認(rèn)證的類(lèi)型，默認(rèn)情況下為db_auth，這種情況下用戶(hù)名密碼被存放在數(shù)據(jù)庫(kù)中。如果要使用LDAP認(rèn)證的話(huà)，請(qǐng)將此字段設(shè)置為ldap_auth。
IMPORTANT: 當(dāng)要從一個(gè)已存在的Harbor實(shí)例升級(jí)的時(shí)候，你必須確保在harbor.cfg中配置的auth_mode是相同的，否則在更新后可能會(huì)造成用戶(hù)不能正常登錄
ldap_url: LDAP端點(diǎn)的URL(例如：ldaps://ldap.mydomain.com)。只在auth_mode被設(shè)置為ldap_auth時(shí)使用ldap_searchdn、ldap_search_pwd、ldap_basedn、ldap_filter、ldap_uid、ldap_scopeself_registration: 可選值為on/off，默認(rèn)為on。本選項(xiàng)用于使能或禁止注冊(cè)成為本系統(tǒng)的賬戶(hù)。當(dāng)被禁止時(shí)，新用戶(hù)只能由admin用戶(hù)來(lái)創(chuàng)建，在Harbor中只有admin用戶(hù)可以創(chuàng)建新用戶(hù)。注意： 當(dāng)auth_mode被設(shè)置為ldap_auth時(shí)，self-registration功能總是會(huì)被禁止，并且此選項(xiàng)會(huì)被忽略。token_expiration: token創(chuàng)建多長(zhǎng)時(shí)間之后會(huì)過(guò)期，默認(rèn)是30minproject_creation_restriction: 本flag用于控制哪些用戶(hù)有權(quán)限來(lái)創(chuàng)建projects。默認(rèn)情況下，任何用戶(hù)都可以創(chuàng)建project，假如設(shè)置為adminonly，則只有admin用戶(hù)可以創(chuàng)建project。
2.3.3 配置存儲(chǔ)后端(可選）
默認(rèn)情況下，Harbor存儲(chǔ)鏡像到本地文件系統(tǒng)。在實(shí)際的生產(chǎn)環(huán)境下，你可以采用其他的存儲(chǔ)后端來(lái)代替本地文件系統(tǒng)，例如可以采用S3、OpenStack Swift、Ceph等。而這你需要修改的文件是common/templates/registry/config.yml的storage字段。例如，假如你需要配置存儲(chǔ)后端為Openstack swift，則storage段類(lèi)似如下：
storage:
swift:
username: admin
password: ADMIN_PASS
authurl: http://keystone_addr:35357/v3/auth
tenant: admin
domain: default
region: regionOne
container: docker_images
想要了解詳細(xì)的后端存儲(chǔ)配置，請(qǐng)參看Registry Configuration Reference
2.4 完成安裝并啟動(dòng)Harbor
一旦harbor.cfg及存儲(chǔ)后端(可選）完成配置，使用install.sh腳本完成安裝并啟動(dòng)Harbor。
1) 默認(rèn)安裝(without Notary/Clair)
Harbor已經(jīng)集成了Notary/Clair(用于vulnerability scanning）。然而，默認(rèn)的安裝并不包含Notary/Clair:
<pre style="margin-block-start: 0px; margin-block-end: 0px; margin: 0.5em 0px; padding: 0.5em 18.6094px; border: 1px solid rgb(204, 204, 204); outline: 0px; font-weight: inherit; font-style: inherit; font-family: Monaco, Menlo, Consolas, "Courier New", monospace; font-size: 0.9em; vertical-align: baseline; background: rgb(47, 43, 43); color: rgb(166, 226, 46); line-height: 1.5; border-radius: 0.35em; overflow-wrap: break-word; overflow: auto;"># sudo ./install.sh
</pre>
假如一切工作正常的話(huà)，你可以打開(kāi)一個(gè)用戶(hù)界面，然后訪(fǎng)問(wèn)后臺(tái)管理頁(yè)面http://reg.yourdomain.com/(注意這里請(qǐng)將reg.yourdomain.com替換為你在harbor.cfg中配置的hostname字段的值），默認(rèn)的后臺(tái)管理username/password為admin/Harbor12345
登錄admin管理頁(yè)面，然后創(chuàng)建一個(gè)新的工程，例如myproject，你可以使用docker命令來(lái)登錄并push鏡像(默認(rèn)情況下，registry server監(jiān)聽(tīng)在80端口上）:
# docker login reg.yourdomain.com
# docker push reg.yourdomain.com/myproject/myrepo:mytag
IMPORTANT: 默認(rèn)情況下安裝Harbor，使用的是http協(xié)議。這樣你必須為docker daemon添加--insecure-registry，并重啟docker daemon服務(wù)
2) Installation with Notary
要安裝帶Notary服務(wù)的Harbor，你可以在運(yùn)行install.sh腳本時(shí)添加一個(gè)參數(shù)：
# sudo ./install.sh --with-notary
NOTE: 要讓Harbor支持Notary服務(wù)的話(huà)，ui_url_protocol必須配置為https。要配置https,請(qǐng)參考另外的章節(jié)
要了解更多關(guān)于Notary及Docker Content Trust相關(guān)信息，請(qǐng)參看docker相關(guān)文檔：Docker Content Trust
3) Installation with Clair
要安裝帶Clair服務(wù)的Harbor，你可以在運(yùn)行install.sh腳本時(shí)添加一個(gè)參數(shù)：
# sudo ./install.sh --with-clair
要想了解更多Clair相關(guān)信息，請(qǐng)參看Clair文檔
注意： 假如要同時(shí)支持Notary與Clair，你必須在同一個(gè)命令中同時(shí)指定這兩個(gè)參數(shù)：
# sudo ./install.sh --with-notary --with-clair
欲了解更多Harbor的使用，請(qǐng)參看User Guide of Harbor
3. 配置Harbor以支持https訪(fǎng)問(wèn)
Harbor本身在發(fā)布時(shí)并不提供任何證書(shū)，默認(rèn)情況下，其使用http來(lái)提供相應(yīng)服務(wù)。這使得Harbor可以相對(duì)容易來(lái)建立及運(yùn)行，特別是在開(kāi)發(fā)及測(cè)試環(huán)境中，這很重要。然而在實(shí)際的生產(chǎn)環(huán)境中，并不建議采用http。要使能https，請(qǐng)參看Configuring Harbor with HTTPS Access
4. Harbor生命周期管理
你可以使用docker-compose來(lái)管理Harbor的生命周期，下面列出一些常用的命令（說(shuō)明必須在docker-compose.yml文件所在目錄運(yùn)行)：
1) 停止Harbor
# sudo docker-compose stop
Stopping nginx ... done
Stopping harbor-jobservice ... done
Stopping harbor-ui ... done
Stopping harbor-db ... done
Stopping registry ... done
Stopping harbor-log ... done
2) 在Harbor停止后，重啟Harbor
# sudo docker-compose start
Starting log ... done
Starting ui ... done
Starting mysql ... done
Starting jobservice ... done
Starting registry ... done
Starting proxy ... done
3) 如果要改變Harbor的配置，首先要停止當(dāng)前已存在的Harbor實(shí)例，然后更新harbor.cfg。然后再運(yùn)行prepare腳本更新配置文件，最后再重新創(chuàng)建并啟動(dòng)Harbor實(shí)例
# sudo docker-compose down -v
# vim harbor.cfg
# sudo prepare
# sudo docker-compose up -d
4) 移除Harbor容器，但保留文件系統(tǒng)上的image data及Harbor數(shù)據(jù)庫(kù)
# sudo docker-compose down -v
5) 移除Harbor數(shù)據(jù)庫(kù)及image data(用于干凈環(huán)境下Harbor重裝)
# rm -rf /data/database
# rm -rf /data/registry
4.1 Harbor with Notary生命周期管理
當(dāng)Harbor被安裝支持Notary服務(wù)時(shí)，需要給docker-compose提供一個(gè)額外的模板文件docker-compose.notary.yml。docker-compose管理Harbor生命周期的命令：
# sudo docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml [ up|down|ps|stop|start ]
例如，假如你想要改變harbor.cfg配置文件，并重新部署帶Notary服務(wù)的Harbor，那么你可以用如下的命令：
# sudo docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml down -v
# vim harbor.cfg
# sudo prepare --with-notary
# sudo docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml up -d
4.2 Harbor with Clair生命周期管理
當(dāng)Harbor被安裝支持Clair服務(wù)時(shí)，需要給docker-compose提供一個(gè)額外的模板文件docker-compose.clair.yml。docker-compose管理Clair生命周期的命令：
# sudo docker-compose -f ./docker-compose.yml -f ./docker-compose.clair.yml [ up|down|ps|stop|start ]
例如，假如你想要改變harbor.cfg配置文件，并重新部署帶Clair服務(wù)的Harbor，那么你可以用如下的命令：
# sudo docker-compose -f ./docker-compose.yml -f ./docker-compose.clair.yml down -v
# vim harbor.cfg
# sudo prepare --with-clair
# sudo docker-compose -f ./docker-compose.yml -f ./docker-compose.clair.yml up -d
4.3 Harbor with Notary and Clair生命周期管理
假如你安裝了同時(shí)支持Notary及Clair服務(wù)的Harbor，你應(yīng)該在docker-compose命令中包含兩個(gè)組件：
# sudo docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml -f ./docker-compose.clair.yml down -v
# vim harbor.cfg
# sudo prepare --with-notary --with-clair
# sudo docker-compose -f ./docker-compose.yml -f ./docker-compose.notary.yml -f ./docker-compose.clair.yml up -d
請(qǐng)參看Docker Compose command-line reference以了解更多docker-compose的用法。
5. 持久化數(shù)據(jù)及日志文件
默認(rèn)情況下，registry的數(shù)據(jù)會(huì)被持久化到主機(jī)的/data/目錄。即使在容器被移除或者重新創(chuàng)建的情況下，這些數(shù)據(jù)都會(huì)維持不變。
另外，Harbor使用rsyslog來(lái)收集每一個(gè)容器的日志。默認(rèn)情況下，這些日志文件都被存儲(chǔ)在/var/log/harbor目錄下，我們可以使用這些日志來(lái)處理一些相關(guān)問(wèn)題。
6. 定制化Harbor監(jiān)聽(tīng)端口
默認(rèn)情況下，Harbor會(huì)監(jiān)聽(tīng)80端口(http)和443端口(假如配置了https)，以此來(lái)處理Harbor的后臺(tái)管理操作及支持docker的相關(guān)命令。你也可以對(duì)這些端口進(jìn)行相應(yīng)的定制。
6.1 定制http協(xié)議端口
1) 修改docker-compose.yml文件
替換第一個(gè)80端口為一個(gè)定制化指定端口，例如8888:80:
proxy:
image: library/nginx:1.11.5
restart: always
volumes:
- ./config/nginx:/etc/nginx
ports:
- 8888:80
- 443:443
depends_on:
- mysql
- registry
- ui
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://127.0.0.1:1514"
tag: "proxy"
2) 修改harbor.cfg文件，添加端口到hostname參數(shù)
hostname = 192.168.0.2:8888
3) 重新部署Harbor
請(qǐng)參看前面”Harbor生命周期管理”相關(guān)章節(jié)。
6.2 定制https協(xié)議端口
1) 在Harbor中使能HTTPS
請(qǐng)參看相關(guān)章節(jié)。
2) 修改docker-compose.yml文件
將第一個(gè)443端口替換為一個(gè)定制化指定端口，例如8888:80:
proxy:
image: library/nginx:1.11.5
restart: always
volumes:
- ./config/nginx:/etc/nginx
ports:
- 80:80
- 8888:443
depends_on:
- mysql
- registry
- ui
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://127.0.0.1:1514"
tag: "proxy"
3) 修改harbor.cfg文件，添加端口到hostname參數(shù)
hostname = 192.168.0.2:8888
4) 重新部署Harbor
請(qǐng)參看前面”Harbor生命周期管理”相關(guān)章節(jié)。
7. 性能調(diào)優(yōu)
默認(rèn)情況下，Harbor會(huì)限制Clair容器的的CPU使用率為15000來(lái)避免其占用所有的CPU資源。這是在docker-compose.clair.yml文件中進(jìn)行配置的。你可以根據(jù)你的硬件配置進(jìn)行相應(yīng)的修改。
8. Troubleshooting
1） 當(dāng)Harbor不能正常工作時(shí)，通過(guò)運(yùn)行如下的命令來(lái)找出是否所有的容器都處于UP狀態(tài)
# sudo docker-compose ps
Name Command State Ports
-----------------------------------------------------------------------------------------------------
harbor-db docker-entrypoint.sh mysqld Up 3306/tcp
harbor-jobservice /harbor/harbor_jobservice Up
harbor-log /bin/sh -c crond && rsyslo ... Up 127.0.0.1:1514->514/tcp
harbor-ui /harbor/harbor_ui Up
nginx nginx -g daemon off; Up 0.0.0.0:443->443/tcp, 0.0.0.0:80->80/tcp
registry /entrypoint.sh serve /etc/ ... Up 5000/tcp
假如有一個(gè)container不是處于UP狀態(tài)，請(qǐng)檢查/var/log/harbor目錄下該容器的日志。例如，假如harbor-ui沒(méi)有運(yùn)行的話(huà)，你可以查詢(xún)ui.log日志文件。
- 當(dāng)在一個(gè)Nginx代代理或ELB(elastic load balancing)后端建立Harbor時(shí)，請(qǐng)?jiān)?code>common/templates/nginx/nginx.http.conf文件中查詢(xún)?nèi)缦滦校?/li>
proxy_set_header X-Forwarded-Proto $scheme;
假如代理中已經(jīng)有類(lèi)似于location /, location /v2/ 與 location /service/的設(shè)置，請(qǐng)將其從所在section移除，然后根據(jù)上面Harbor生命周期管理相關(guān)章節(jié)重新部署Harbor。
9. 部署示例
前面我們已經(jīng)下載并解壓好了harbor，這里我們進(jìn)入解壓好的根目錄：
# cd /opt/harbor-inst/harbor
# ls
common docker-compose.clair.yml docker-compose.notary.yml docker-compose.yml ha harbor.cfg harbor.v1.4.0.tar.gz install.sh LICENSE NOTICE prepare
我們當(dāng)前ip地址為192.168.69.128, 用netstat查看80、443等端口也沒(méi)有被占用。
1) 修改harbor.cfg的hostname字段
<pre style="margin-block-start: 0px; margin-block-end: 0px; margin: 0.5em 0px; padding: 0.5em 18.6094px; border: 1px solid rgb(204, 204, 204); outline: 0px; font-weight: inherit; font-style: inherit; font-family: Monaco, Menlo, Consolas, "Courier New", monospace; font-size: 0.9em; vertical-align: baseline; background: rgb(47, 43, 43); color: rgb(166, 226, 46); line-height: 1.5; border-radius: 0.35em; overflow-wrap: break-word; overflow: auto;">hostname = 192.168.69.128
</pre>
2) 執(zhí)行install.sh腳本
# ./install.sh
[Step 0]: checking installation environment ...
Note: docker version: 17.12.1
Note: docker-compose version: 1.20.1
[Step 1]: loading Harbor images ...
651f69aef02c: Loading layer [==================================================>] 135.8MB/135.8MB
40a1aad64343: Loading layer [==================================================>] 23.24MB/23.24MB
3fe2713e4072: Loading layer [==================================================>] 12.16MB/12.16MB
ba3a1eb0e375: Loading layer [==================================================>] 17.3MB/17.3MB
447427ec5e1a: Loading layer [==================================================>] 15.87kB/15.87kB
4ccb4026663c: Loading layer [==================================================>] 3.072kB/3.072kB
16faa95946a1: Loading layer [==================================================>] 29.46MB/29.46MB
Loaded image: vmware/notary-server-photon:v0.5.1-v1.4.0
fa7ba9fd42c9: Loading layer [==================================================>] 10.95MB/10.95MB
4e400f9ae23e: Loading layer [==================================================>] 17.3MB/17.3MB
2802fb27c88b: Loading layer [==================================================>] 15.87kB/15.87kB
e6367a4e1e1e: Loading layer [==================================================>] 3.072kB/3.072kB
8ece8dfcdd98: Loading layer [==================================================>] 28.24MB/28.24MB
Loaded image: vmware/notary-signer-photon:v0.5.1-v1.4.0
a7dd1a8afcaf: Loading layer [==================================================>] 396.7MB/396.7MB
05adebbe496f: Loading layer [==================================================>] 9.216kB/9.216kB
86eb534949fa: Loading layer [==================================================>] 9.216kB/9.216kB
d7f127c69380: Loading layer [==================================================>] 7.68kB/7.68kB
5ac1c4dc5ee9: Loading layer [==================================================>] 1.536kB/1.536kB
d0bec56b5b1a: Loading layer [==================================================>] 9.728kB/9.728kB
4bbe83860556: Loading layer [==================================================>] 2.56kB/2.56kB
e526f9e6769f: Loading layer [==================================================>] 3.072kB/3.072kB
Loaded image: vmware/harbor-db:v1.4.0
1cff102bbda2: Loading layer [==================================================>] 154.1MB/154.1MB
04c9f3e07de1: Loading layer [==================================================>] 10.75MB/10.75MB
7b6c7bf54f5c: Loading layer [==================================================>] 2.048kB/2.048kB
42f8acdb7fe3: Loading layer [==================================================>] 48.13kB/48.13kB
5b6299d0a1df: Loading layer [==================================================>] 10.8MB/10.8MB
Loaded image: vmware/clair-photon:v2.0.1-v1.4.0
6534131f457c: Loading layer [==================================================>] 94.76MB/94.76MB
73f582101e4b: Loading layer [==================================================>] 6.656kB/6.656kB
86d847823c48: Loading layer [==================================================>] 6.656kB/6.656kB
Loaded image: vmware/postgresql-photon:v1.4.0
5cd250d5a352: Loading layer [==================================================>] 23.24MB/23.24MB
ad3fd52b54f3: Loading layer [==================================================>] 14.99MB/14.99MB
13b1e24cc368: Loading layer [==================================================>] 14.99MB/14.99MB
Loaded image: vmware/harbor-adminserver:v1.4.0
c26c69706710: Loading layer [==================================================>] 23.24MB/23.24MB
223f6fe02cc8: Loading layer [==================================================>] 23.45MB/23.45MB
1fc843c8698a: Loading layer [==================================================>] 7.168kB/7.168kB
e09293610ee7: Loading layer [==================================================>] 10.39MB/10.39MB
d59f9780b1d8: Loading layer [==================================================>] 23.44MB/23.44MB
Loaded image: vmware/harbor-ui:v1.4.0
dd4753242e59: Loading layer [==================================================>] 73.07MB/73.07MB
95aed61ca251: Loading layer [==================================================>] 3.584kB/3.584kB
1864f9818562: Loading layer [==================================================>] 3.072kB/3.072kB
da2a19f80b81: Loading layer [==================================================>] 4.096kB/4.096kB
058531639e75: Loading layer [==================================================>] 3.584kB/3.584kB
a84e69fb619b: Loading layer [==================================================>] 10.24kB/10.24kB
Loaded image: vmware/harbor-log:v1.4.0
b1056051f246: Loading layer [==================================================>] 23.24MB/23.24MB
07678065e08b: Loading layer [==================================================>] 19.19MB/19.19MB
a2d9bdb8f5fb: Loading layer [==================================================>] 19.19MB/19.19MB
Loaded image: vmware/harbor-jobservice:v1.4.0
7f58ce57cd5e: Loading layer [==================================================>] 4.805MB/4.805MB
Loaded image: vmware/nginx-photon:v1.4.0
4c8965978b77: Loading layer [==================================================>] 23.24MB/23.24MB
1466c942edde: Loading layer [==================================================>] 2.048kB/2.048kB
ac5c17331735: Loading layer [==================================================>] 2.048kB/2.048kB
86824c7c466a: Loading layer [==================================================>] 2.048kB/2.048kB
fd3bd0e70d67: Loading layer [==================================================>] 22.8MB/22.8MB
b02195d77636: Loading layer [==================================================>] 22.8MB/22.8MB
Loaded image: vmware/registry-photon:v2.6.2-v1.4.0
Loaded image: vmware/photon:1.0
Loaded image: vmware/mariadb-photon:v1.4.0
454c81edbd3b: Loading layer [==================================================>] 135.2MB/135.2MB
e99db1275091: Loading layer [==================================================>] 395.4MB/395.4MB
051e4ee23882: Loading layer [==================================================>] 9.216kB/9.216kB
6cca4437b6f6: Loading layer [==================================================>] 9.216kB/9.216kB
1d48fc08c8bc: Loading layer [==================================================>] 7.68kB/7.68kB
0419724fd942: Loading layer [==================================================>] 1.536kB/1.536kB
526b2156bd7a: Loading layer [==================================================>] 637.8MB/637.8MB
9ebf6900ecbd: Loading layer [==================================================>] 78.34kB/78.34kB
Loaded image: vmware/harbor-db-migrator:1.4
[Step 2]: preparing environment ...
Generated and saved secret to file: /data/secretkey
Generated configuration file: ./common/config/nginx/nginx.conf
Generated configuration file: ./common/config/adminserver/env
Generated configuration file: ./common/config/ui/env
Generated configuration file: ./common/config/registry/config.yml
Generated configuration file: ./common/config/db/env
Generated configuration file: ./common/config/jobservice/env
Generated configuration file: ./common/config/log/logrotate.conf
Generated configuration file: ./common/config/jobservice/app.conf
Generated configuration file: ./common/config/ui/app.conf
Generated certificate, key file: ./common/config/ui/private_key.pem, cert file: ./common/config/registry/root.crt
The configuration files are ready, please use docker-compose to start the service.
[Step 3]: checking existing instance of Harbor ...
[Step 4]: starting Harbor ...
Creating network "harbor_harbor" with the default driver
Creating harbor-log ... done
Creating harbor-adminserver ... done
Creating harbor-db ... done
Creating registry ... done
Creating harbor-ui ... done
Creating harbor-jobservice ... done
Creating nginx ... done
? ----Harbor has been installed and started successfully.----
Now you should be able to visit the admin portal at http://192.168.69.128\.
For more details, please visit https://github.com/vmware/harbor .
3) 查詢(xún)Harbor運(yùn)行狀態(tài)
# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
10b95448f80f vmware/nginx-photon:v1.4.0 "nginx -g 'daemon of…" 5 seconds ago Up 4 seconds 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp nginx
64893e6ba9d3 vmware/harbor-jobservice:v1.4.0 "/harbor/start.sh" 5 seconds ago Up 4 seconds (health: starting) harbor-jobservice
62220b07e57f vmware/harbor-ui:v1.4.0 "/harbor/start.sh" 5 seconds ago Up 5 seconds (health: starting) harbor-ui
ce166d26724e vmware/harbor-db:v1.4.0 "/usr/local/bin/dock…" 7 seconds ago Up 6 seconds (health: starting) 3306/tcp harbor-db
a62d8f460c35 vmware/registry-photon:v2.6.2-v1.4.0 "/entrypoint.sh serv…" 7 seconds ago Up 5 seconds (health: starting) 5000/tcp registry
5e5e4bcee123 vmware/harbor-adminserver:v1.4.0 "/harbor/start.sh" 7 seconds ago Up 6 seconds (health: starting) harbor-adminserver
cb6dbc564382 vmware/harbor-log:v1.4.0 "/bin/sh -c /usr/loc…" 7 seconds ago Up 6 seconds (health: starting) 127.0.0.1:1514->10514/tcp harbor-log
4) 訪(fǎng)問(wèn)
首先我們用curl命令訪(fǎng)問(wèn)一下：
# curl -X GET http://192.168.69.128 -k -IL
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 02:43:20 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 810
Connection: keep-alive
Set-Cookie: beegosessionID=1720767232a3cdcb58a54cd13eead058; Path=/; HttpOnly
然后我們?cè)儆脼g覽器訪(fǎng)問(wèn)。
5） 向Harbor push/pull鏡像
- 停止Harbor
# docker-compose stop
Stopping nginx ... done
Stopping harbor-jobservice ... done
Stopping harbor-ui ... done
Stopping harbor-db ... done
Stopping registry ...
Stopping registry ... done
Stopping harbor-adminserver ... done
Stopping harbor-log ... done
- 修改dockerd啟動(dòng)腳本
這里修改/lib/systemd/system/docker.service文件，將ExecStart修改為：
ExecStart=/usr/bin/dockerd \
--insecure-registry=192.168.69.128 \
-H tcp://0.0.0.0:2375 \
-H unix://var/run/docker.sock \
-H tcp://0.0.0.0:7654
上面添加了--insecure-registry選項(xiàng)。然后執(zhí)行再執(zhí)行如下命令重啟dockerd:
# systemctl daemon-reload
# systemctl restart docker
6） 重啟Harbor
# docker-compose start
Starting log ... done
Starting registry ... done
Starting mysql ... done
Starting adminserver ... done
Starting ui ... done
Starting jobservice ... done
Starting proxy ... done
# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
10b95448f80f vmware/nginx-photon:v1.4.0 "nginx -g 'daemon of…" 21 minutes ago Up Less than a second 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp nginx
64893e6ba9d3 vmware/harbor-jobservice:v1.4.0 "/harbor/start.sh" 21 minutes ago Up 4 seconds (health: starting) harbor-jobservice
62220b07e57f vmware/harbor-ui:v1.4.0 "/harbor/start.sh" 21 minutes ago Up 4 seconds (health: starting) harbor-ui
ce166d26724e vmware/harbor-db:v1.4.0 "/usr/local/bin/dock…" 21 minutes ago Up 57 seconds (healthy) 3306/tcp harbor-db
a62d8f460c35 vmware/registry-photon:v2.6.2-v1.4.0 "/entrypoint.sh serv…" 21 minutes ago Up 57 seconds (healthy) 5000/tcp registry
5e5e4bcee123 vmware/harbor-adminserver:v1.4.0 "/harbor/start.sh" 21 minutes ago Up 4 seconds (health: starting) harbor-adminserver
cb6dbc564382 vmware/harbor-log:v1.4.0 "/bin/sh -c /usr/loc…" 21 minutes ago Up 57 seconds (healthy) 127.0.0.1:1514->10514/tcp harbor-log
7) 往Harbor中push/pull鏡像
- 登錄
# docker login 192.168.69.128
Username: admin
Password:
Login Succeeded
- 重新為鏡像打tag
# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
test-image latest fe9c46d12863 7 days ago 195MB
friendlyhello latest f2ae8dec6267 9 days ago 150MB
redis alpine c27f56585938 3 weeks ago 27.7MB
//這里我們用Harbor中的默認(rèn)庫(kù)
# docker tag redis:alpine 192.168.69.128/library/redis:alpine
# docker images | grep redis
192.168.69.128/library/redis alpine c27f56585938 3 weeks ago 27.7MB
redis alpine c27f56585938 3 weeks ago 27.7MB
- 上傳鏡像到Harbor
# docker push 192.168.69.128/library/redis:alpine
The push refers to repository [192.168.69.128/library/redis]
f6b9463783dc: Pushed
222a85888a99: Pushed
1925395eabdd: Pushed
c3d278563734: Pushed
ad9247fe8c63: Pushed
cd7100a72410: Pushed
alpine: digest: sha256:9d017f829df3d0800f2a2582c710143767f6dda4df584b708260e73b1a1b6db3 size: 1568
然后我們登錄網(wǎng)站，可以看到鏡像上傳成功。（注： 這里Harbor默認(rèn)采用Www-Authenticate: Bearer認(rèn)證）
- 下載鏡像
//這里我們先把原來(lái)本地的鏡像刪除
# docker rmi 192.168.69.128/library/redis:alpine
//從Harbor鏡像庫(kù)拉取鏡像
# docker pull 192.168.69.128/library/redis:alpine
alpine: Pulling from library/redis
Digest: sha256:9d017f829df3d0800f2a2582c710143767f6dda4df584b708260e73b1a1b6db3
Status: Downloaded newer image for 192.168.69.128/library/redis:alpine
[參考]
