CentOs中docker 安装私有仓库，并通过https方式上传镜像

安装仓库registry, Tag为2

[weshzhu@weshzhu ~]$ docker pull registry:2

2: Pulling from library/registry

Digest: sha256:672d519d7fd7bbc7a448d17956ebeefe225d5eb27509d8dc5ce67ecb4a0bce54

Status: Image is up to date for registry:2

查看仓库，此时先不启动容器。

[zsd@greenvm-z16786v1 certs]$ docker images

REPOSITORY            TAG                IMAGE ID            CREATED            SIZE

registry              2                  d1fd7d86a825        4 weeks ago        33.3MB

通过OpenSSL工具生成自签名的证书，后面将用于对请求进行校验

对于证书以及OpenSSL, 请移目那些证书相关的玩意儿

首先找到OpenSSL工具配置文件openssl.cnf，对于Centos,目录在/etc/pki/tls/中

[weshzhu@weshzhu ~]$ cd /etc/pki/tls/

[weshzhu@weshzhu tls]$ ll

total 12

lrwxrwxrwx. 1 root root    49 Jan 26 19:10 cert.pem -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

drwxr-xr-x. 2 root root  193 Feb  7 21:42 certs

drwxr-xr-x. 2 root root    74 Jan 26 19:10 misc

-rw-r--r--. 1 root root 10955 Feb  7 20:12 openssl.cnf

drwxr-xr-x. 2 root root    6 Aug  4  2017 private

编辑openssl.cnf,在[v3_ca]下面添加：subjectAltName = IP:域名|IP地址

[ v3_ca ]

subjectAltName = IP:172.10.15.110

否则将会报错：

x509: cannot validate certificate for because it doesn't contain any IP SANs

这是因为在证书中，要包含一些信息，比如国家、机构等等，好像访问的私有仓库ip或者域名必须要有，否则不予通过，就会报上面的错误。如果有读者发现此处有错误，请在下方提出。谢谢！

修改完openssl配置文件后，可以生产私有证书，要记住生成证书的目录，后面会用到。

[weshzhu@weshzhu certs]$ sudo openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout registry.key -out registry.crt

[sudo] password for weshzhu:

Generating a 2048 bit RSA private key

.................................................................................................................................................+++

.........................................................................................................................................................+++

writing new private key to 'registry.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:      #该处让交互输入国家、省等，可以直接Enter跳过

State or Province Name (full name) []:

Locality Name (eg, city) [Default City]:

Organization Name (eg, company) [Default Company Ltd]:

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:172.10.15.110  #该处输入私有仓库的ip地址或者域名

Email Address []:

可以看到在当前目录中，有*.crt 和 *.key文件

[weshzhu@weshzhu certs]$ ll

total 8

-rw-r--r--. 1 root root 1306 Feb  8 15:04 registry.crt

-rw-r--r--. 1 root root 1704 Feb  8 15:04 registry.key

将生成的私有证书追加到系统的证书管理文件中，否则后面push和login和pull时会报如下错误：

[root@greenvm-z16786v1 certs]# cat ./registry.crt >> /etc/pki/tls/certs/ca-bundle.crt

未cat到系统的crt文件中

[weshzhu@weshzhu ~]$ docker push 192.168.0.123/rabbitmq:3.7

The push refers to repository [192.168.0.123/rabbitmq]

Get https:///v2/: x509: certificate signed by unknown authority

重启docker, 该步骤一定不要省略，否则有可能加载私钥失败 systemctl restart docker

启动私有仓库镜像 registry 注意：在启动时，有参数需要配置

docker run -d -p 443:443 --name registry -v /deploy/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt -e REGISTRY_HTTP_TLS_KEY=/certs/registry.key registry:2

-d 后台运行 -p 443:443 将容器的端口443映射到主机的443端口 --name 给容器起个名字 registry -v /deploy/certs:/certs 主机的目录/deploy/certs映射到容器的/certs ，目的是将生成的私有证书映射到容器中 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt 指定TLS协议验证的证书目录：该目录为容器的registry.crt所在的目录 -e REGISTRY_HTTP_TLS_KEY=/certs/registry.key 指定TLS协议使用的key的目录：该目录为容器的registry.key所在的目录

上面的步骤按顺序操作完成后，可以尝试docker push一个镜像到私有仓库中。 查看docker安装了哪些镜像：

[zsd@greenvm-z16786v1 certs]$ docker images

REPOSITORY            TAG                IMAGE ID            CREATED            SIZE

registry              2                  d1fd7d86a825        4 weeks ago        33.3MB

nginx                latest              3f8a4339aadd        6 weeks ago        108MB

将上传的镜像重新Tag一下：

docker tag nginx[:tag] [ipaddress]/nginx

#:tag 为镜像的tag,如果该镜像的tag为latest，则可以省略

#[ipaddress] 为私有仓库的ip地址或域名，也就是上面步骤在openssl中添加的`subjectAltName = IP:172.10.15.110`地址或域名

查看镜像，发现多了一个以ip地址为开头的image

[zsd@greenvm-z16786v1 certs]$ docker images

REPOSITORY            TAG                IMAGE ID            CREATED            SIZE

registry              2                  d1fd7d86a825        4 weeks ago        33.3MB

192.168.0.181/nginx  latest              3f8a4339aadd        6 weeks ago        108MB

nginx                latest              3f8a4339aadd        6 weeks ago        108MB

此时push该带ip地址的镜像到私有仓库中

[root@greenvm-z16786v1 certs]# docker push 172.28.8.124/nginx

The push refers to repository [172.28.8.124/nginx]

a103d141fc98: Pushed

73e2bd445514: Pushed

2ec5c0a4cb57: Pushing [===========================================>      ]  48.2MB/55.26MB

[root@greenvm-z16786v1 certs]# docker push 172.28.8.124/nginx

The push refers to repository [172.28.8.124/nginx]

a103d141fc98: Pushed

73e2bd445514: Pushed

2ec5c0a4cb57: Pushed

latest: digest: sha256:926b086e1234b6ae9a11589c4cece66b267890d24d1da388c96dd8795b2ffcfb size: 948