harbor 2.0 搭建docker私有仓库

harbor

Harbor 是一个CNCF基金会托管的开源的可信的云原生docker registry项目，可以用于存储、签名、扫描镜像内容，Harbor 通过添加一些常用的功能如安全性、身份权限管理等来扩展 docker registry 项目，此外还支持在 registry 之间复制镜像，还提供更加高级的安全功能，如用户管理、访问控制和活动审计等，在新版本中还添加了Helm仓库托管的支持。

Harbor最核心的功能就是给 docker registry 添加上一层权限保护的功能，要实现这个功能，就需要我们在使用 docker login、pull、push 等命令的时候进行拦截，先进行一些权限相关的校验，再进行操作，其实这一系列的操作 docker registry v2 就已经为我们提供了支持，v2 集成了一个安全认证的功能，将安全认证暴露给外部服务，让外部服务去实现。

环境准备

linux 3.10.0-957.5.1.el7.x86_64
centos 7.6.1810
配置 2c2g500g

安装

docker 安装

docker 为centos用户提供了三种安装方式，我们选择第一种，也是官网推荐的安装方式

1. 移除旧的docker 依赖

 sudo yum remove docker \
                  docker-client \
                  docker-client-latest \
                  docker-common \
                  docker-latest \
                  docker-latest-logrotate \
                  docker-logrotate \
                  docker-engine

2. 设置docker 源

sudo yum install -y yum-utils
sudo yum-config-manager \
    --add-repo \
    https://download.docker.com/linux/centos/docker-ce.repo

3. 安装docker引擎，默认最新版本

sudo yum install docker-ce docker-ce-cli containerd.io

4. 启动

systemctl enable docker
systemctl start docker

6. 测试

docker -v
Docker version 19.03.12, build 48a66213fe

docker-compose 安装

1. 下载可执行文件

sudo curl -L "https://github.com/docker/compose/releases/download/1.26.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

2. 修改权限

sudo chmod +x /usr/local/bin/docker-compose

3. 测试

docker-compose -v
docker-compose version 1.26.0, build d4451659

harbor安装

1. 下载在线安装包
   harbor可通过在线和离线安装，由于离线安装包下载失败，所以选择在线安装

 wget https://github.com/goharbor/harbor/releases/download/v2.0.0/harbor-online-installer-v2.0.0.tgz

2. 解压

tar xvf harbor-online-installer-v2.0.0.tgz 

3. 修改配置
   harbor通过docker-compose 管理，harbor.yml 是compose 配置文件
   备份配置文件：cp harbor.yml.tmpl harbor.yml
   修改配置：vim harbor.yml

# Configuration file of Harbor

# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: xx.xx.xx.xx  # 对外开发访问的 ip或域名

# http related config
http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 80
# 注释掉https,当然你也可以通过设置证书，开放https，建议生产使用https
# https related config
#https:
  # https port for harbor, default is 443
#  port: 443
  # The path of cert and key files for nginx
#  certificate: /your/certificate/path
#  private_key: /your/private/key/path

# # Uncomment following will enable tls communication between all harbor components
# internal_tls:
#   # set enabled to true means internal tls is enabled
#   enabled: true
#   # put your cert and key files on dir
#   dir: /etc/harbor/tls/internal

# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433

# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: Harbor12345

# Harbor DB configuration
database:
  # The password for the root user of Harbor DB. Change this before any product