在kubernetes技術(shù)體系中，鏡像的倉庫扮演著重要的角色。應(yīng)用的更新與發(fā)布都是通過對鏡像進(jìn)行更新，并通過新的鏡像啟動容器實現(xiàn)的。

為方便之后的學(xué)習(xí)，本文將介紹在centos7上實現(xiàn)docker本地倉庫的搭建。之前寫過一篇在centos6上搭建本地倉庫的文章，當(dāng)時使用的registry版本為V1。V1版本在nginx代理上配置和v2版本存在較大差別，前文傳送門： http://blog.51cto.com/ylw6006/1597873

環(huán)境介紹：
操作系統(tǒng)版本：centos linux 7.2 64bit
Server: 192.168.115.5/24 vm1
Clinet: 192.168.115.6/24 vm2
docker版本： 1.12.6

一、在vm1上創(chuàng)建registry

# docker pull docker.io/registry # mkdir /home/registry # docker run -d -p 5000:5000 --name registry --privileged=true --restart=always \-v /home/registry:/var/lib/registry registry # curl -XGET http://192.168.115.5:5000/v2/_catalog

通過執(zhí)行上述命令就可以簡單構(gòu)建出一個可用的本地倉庫，但倉庫沒有配置用戶認(rèn)證，且使用的是http協(xié)議。

二、配置vm1使用本地倉庫
docker1.12.6版本默認(rèn)要求倉庫必須用https協(xié)議，我們可以修改docker配置文件允許使用http協(xié)議的倉庫。

# grep '5000' /etc/sysconfig/docker OPTIONS='-g /home/docker -H 0.0.0.0:2375 -H unix:///var/run/docker.sock --insecure-registry 192.168.115.5:5000' ADD_REGISTRY='--add-registry 192.168.115.5:5000' # systemctl restart docker # docker start registry # docker tag docker.io/busybox 192.168.115.5:5000/busybox # docker push 192.168.115.5:5000/busybox # curl -XGET http://192.168.115.5:5000/v2/_catalog # curl -XGET http://192.168.115.5:5000/v2/busybox/tags/list

三、使用腳本刪除本地倉庫中的鏡像文件,也可以直接刪除對應(yīng)目錄的文件夾達(dá)到效果

# curl \ https://raw.githubusercontent.com/burnettk/delete-docker-registry-image/master/delete_docker_registry_image.py | sudo tee /usr/local/bin/delete_docker_registry_image >/dev/null # chmod a+x /usr/local/bin/delete_docker_registry_image # export REGISTRY_DATA_DIR=/home/registry/docker/registry/v2 # delete_docker_registry_image --image busybox

四、使用nginx對客戶端的請求進(jìn)行代理
1、安裝nginx，這里為了省事，直接用rpm包安裝。準(zhǔn)備配置文件如下

# yum -y install nginx httpd-tools # cat /etc/nginx/conf.d/docker.conf upstream docker-registry {server 192.168.115.5:5000; } server {listen 443;server_name registry.fjhb.cn; ssl on;ssl_certificate /etc/nginx/keys/nginx.crt;ssl_certificate_key /etc/nginx/keys/nginx.key;proxy_set_header Host $http_host; # required for Docker client sakeproxy_set_header X-Real-IP $remote_addr; # pass on real client IPclient_max_body_size 0; # disable any limits to avoid HTTP 413 for large image uploads# required to avoid HTTP 411: see Issue #1486 (https://github.com/dotcloud/docker/issues/1486)chunked_transfer_encoding on; location /v2/ {# let Nginx know about our auth fileauth_basic "Restricted";auth_basic_user_file docker-registry.htpasswd;add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always;proxy_set_header Host $http_host; # required for docker client‘s sakeproxy_set_header X-Real-IP $remote_addr; # pass on real client‘s IPproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header X-Forwarded-Proto $scheme;proxy_read_timeout 900;proxy_pass http://docker-registry;} }

2、使用openssl工具創(chuàng)建自簽名證書

# cd /etc/pki/CA/ # touch ./{serial,index.txt} # echo "00" > serial # openssl genrsa -out private/cakey.pem 2048 # openssl req -new -x509 -key private/cakey.pem -days 3650 -out cacert.pem # cd /etc/ssl/ # openssl genrsa -out nginx.key 2048 # openssl req -new -key nginx.key -out nginx.csr # openssl ca -in nginx.csr -days 3650 -out nginx.crt # htpasswd -c /etc/nginx/docker-registry.htpasswd yang # mkdir /etc/nginx/keys/ # mv nginx.crt nginx.key /etc/nginx/keys/ # nginx -t # systemctl start nginx # netstat -ntpl |grep nginx

3、修改vm1主機(jī)的hosts文件，并進(jìn)行測試

# ping -c 1 registry.fjhb.cn # curl https://registry.fjhb.cn

以上是因為證書是自簽名的，操作系統(tǒng)認(rèn)證失敗

# cp /etc/pki/tls/certs/ca-bundle.crt{,.bak} # cat /etc/pki/CA/cacert.pem >> /etc/pki/tls/certs/ca-bundle.crt # systemctl restart docker # docker start registry # curl https://registry.fjhb.cn # curl -u yang:123 https://registry.fjhb.cn # docker login -u yang -p 123 -e ylw@fjhb.cn registry.fjhb.cn

# docker tag docker.io/busybox registry.fjhb.cn/busybox # docker push registry.fjhb.cn/busybox # curl -XGET http://192.168.115.5:5000/v2/_catalog # curl -XGET http://192.168.115.5:5000/v2/busybox/tags/list

參考文檔：
https://github.com/burnettk/delete-docker-registry-image

《新程序員》：云原生和全面數(shù)字化實踐50位技術(shù)專家共同創(chuàng)作，文字、視頻、音頻交互閱讀

總結(jié)

以上是生活随笔為你收集整理的Centos7系统创建Docker本地仓库的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。