Просмотр кода страницы Docker. Docker Registry Server (own Docker Hub to store images)

= Links =
[https://winitpro.ru/index.php/2021/03/03/nastrojka-lokalnogo-docker-registry/https://www.itzgeek.com/how-tos/linux/centos-how-tos/how-to-setup-docker-private-registry-on-centos-7-ubuntu-16-04.html https://winitpro.ru/index.php/2021/03/03/nastrojka-lokalnogo-docker-registry/]

[https://winitpro.ru/index.php/2021/03/03/nastrojka-lokalnogo-docker-registry/https://www.itzgeek.com/how-tos/linux/centos-how-tos/how-to-setup-docker-private-registry-on-centos-7-ubuntu-16-04.html https://www.itzgeek.com/how-tos/linux/centos-how-tos/how-to-setup-docker-private-registry-on-centos-7-ubuntu-16-04.html]

= Install =

== Docker-registry server ==

=== Docker install ===
<code>sudo dnf -y config-manager --add-repo <nowiki>https://download.docker.com/linux/centos/docker-ce.repo</nowiki></code>

<code>sudo dnf -y remove podman buildah</code>

<code>sudo dnf -y install docker-ce docker-ce-cli containerd.io</code>

<code>sudo systemctl start docker.service</code>

<code>sudo systemctl enable docker.service</code>

<code>sudo docker version</code>

=== Docker-registry server install ===
<code>docker pull registry</code>

==== HTTP ====
Create registry container

<code>sudo docker run -d -p 5000:5000 --restart=always --name registry registry:2</code>

If you want to mount local dir to store images not in the registry container

<code>mkdir -p /opt/docker-registry/images</code>

<code>sudo docker run -d -p 5000:5000 --restart=always -v /opt/docker-registry:/var/lib/registry --name registry registry:2</code>

==== HTTPS ====

===== Self-signed certificate =====
Local dir for certs

<code>mkdir -p /certs</code>

Create certs at local dir

'''Case 1.''' If you are using '''Domain Name''' for server url address

<code>openssl req -newkey rsa:4096 -nodes -sha256 -addext "subjectAltName = DNS:registry.domain123.ru" -keyout /certs/ca.key -x509 -days 3650 -out /certs/ca.crt</code>
     ...
     Common Name (eg, your name or your server's hostname) []: registry.domain123.ru
     ...
'''Case 2.''' If you are using '''IP''' for server url address

<code>openssl req -newkey rsa:4096 -nodes -sha256 -addext "subjectAltName = IP:192.168.166.57" -keyout /certs/ca.key -x509 -days 3650 -out /certs/ca.crt</code>

Create registry container

<code>docker run -d -p 5000:5000 --restart=always --name registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key registry:2</code>

If you want to mount local dir to store images not in the registry container

<code>mkdir -p /opt/docker-registry/images</code>

<code>docker run -d -p 5000:5000 --restart=always --name registry -v /opt/docker-registry:/var/lib/registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key registry:2</code>

===== Letsencrypt cert =====
Create cert and put it to local dir /certs

<code>certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d registry.domain123.ru</code>

Create registry container

<code>docker run -d -p 5000:5000 --restart=always --name registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/fullchain1.pem -e REGISTRY_HTTP_TLS_KEY=/certs/privkey1.pem registry:2</code>

== Docker client ==

=== Required setting (otherwise you'll get an errors) ===

==== Case 1. HTTP Docker Registry Server ====
<code>nano /etc/docker/daemon.json</code>
 {
   <...>,
   "insecure-registries": ["registry.domain123.ru:5000"]
 }

==== Case 2. HTTPS Docker Registry Server ====
Create dir for certs at client

<code>mkdir -p /etc/docker/certs.d/registry.domain123.ru\:5000</code>

Get ca.crt from docker-registry-server ant put it to dir

<code>scp -pr root@registry.domain123.ru:/certs/ca.crt /etc/docker/certs.d/registry.domain123.ru\:5000/</code>

=== Getting image from Docker Registry Server ===
Pull standart image

<code>docker pull piuma/centos7-apache-php</code>

Rename (tag) image to send it to registry

<code>docker tag piuma/centos7-apache-php registry.domain123.ru:5000/centos7-apache24-php54:v1.0</code>

== Dealing with docker registry ==
Push image

<code>docker push registry.domain123.ru:5000/centos7-apache24-php54:v1.0</code>

Delete temp images

<code>docker image rm piuma/centos7-apache-php</code>

<code>docker image rm registry.domain123.ru:5000/centos7-apache24-php54:v1.0</code>

List images at registry server

HTTP:

<code>curl "http:/registry.domain123.ru:5000/v2/_catalog"</code>

HTTPS:

<code>curl -k "https:/registry.domain123.ru:5000/v2/_catalog"</code>

List images

<code>curl -X GET -k <nowiki>https://registry.domain123.ru:5000/v2/_catalog</nowiki></code>
     ...
     {"repositories":["centos7-apache24-php54"]}
     ...
List image versions

<code>curl -X GET -k <nowiki>https://registry.domain123.ru:5000/v2/centos7-apache24-php54/tags/list</nowiki></code>
     ...
     {"name":"centos7-apache24-php54","tags":["v1.0"]}
     ...

=== Case 1. pull image by Dockerfile ===
<code>nano Dockerfile</code>
 FROM registry.domain123.ru:5000/centos7-apache24-php54:v1.0
<code>docker build .</code>
     ...
     Sending build context to Docker daemon  2.048kB
     Step 1/1 : FROM registry.domain123.ru:5000/centos7-apache24-php54:v1.0
     v1.0: Pulling from centos7-apache24-php54
     85432449fd0f: Pull complete
     b0ab9cac454f: Pull complete
     54f95e958f19: Pull complete
     58808b33fc80: Pull complete
     a36e7ad34fb4: Pull complete
     48671b2dfef3: Pull complete
     1b8315d2ff99: Pull complete
     c1aad7b0dff2: Pull complete
     64072889578d: Pull complete
     19bc62c4642d: Pull complete
     b9627ad61d03: Pull complete
     6b2679961086: Pull complete
     Digest: sha256:db90682c4412274808ada30d1cd106062f7de959b4559d004f73fcbf007c88c2
     Status: Downloaded newer image for registry.domain123.ru:5000/centos7-apache24-php54:v1.0
     ---> ce6aa6d7b81c
     Successfully built ce6aa6d7b81c
     ...

=== Case 2. pull image by command and run container ===
<code>docker run -d registry.domain123.ru:5000/centos7-apache24-php54:v1.0</code>

Show pulled image

<code>docker images</code>
     ...
     registry.domain123.ru:5000/centos7-apache24-php54   v1.0      ce6aa6d7b81c   4 years ago     389MB
     ...

== Docker registry auth ==

=== Docker registry server ===
Install htpasswd

<code>dnf install httpd-tools</code>

Create dir for auth file

<code>mkdir -p /opt/docker-registry/auth</code>

<code>cd /opt/docker-registry/auth</code>

Create users<blockquote>-c - create new file</blockquote><code>htpasswd -Bc registry.password admin</code>

<code>htpasswd -B registry.password user01</code>

List users

<code>cat /opt/docker-registry/auth/registry.password</code>
     ...
     admin:$2y$05$MVFUcbrnLOjrqsPT8tR.6OL4fwTYUiP4yLmwP9.31PbRVJoWTQsCq
     user01:$2y$05$IhX/Ch1xkWfaHWyxQE9vSO6eVCnBRSc8uM.jyWzUnBFDtJw.6qYue
     ...
Create registry container<blockquote>-e позволяют передать в контейнер переменные окружения(environment).

   REGISTRY_AUTH — auth type - htpasswd;

   REGISTRY_AUTH_HTPASSWD_REALM — head realm from <nowiki>RFC 7235</nowiki>;

   REGISTRY_AUTH_HTPASSWD_PATH — path to registry.password

   REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY — container directory to store images, we mount local directory /opt/docker-registry to it</blockquote><code>docker run -d -p 5000:5000 --restart=always -e REGISTRY_AUTH=htpasswd -e REGISTRY_AUTH_HTPASSWD_REALM=Registry -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/registry.password -e REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/var/lib/registry -v "/opt/docker-registry/auth:/auth" -v /opt/docker-registry:/var/lib/registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key --name registry registry:2</code>

=== Docker client ===

==== Auth at registry server ====
<code>docker login registry.domain123.ru:5000</code>
 Username: admin
 Password:
List images

<code>curl -X GET -k -u admin:PassWord <nowiki>https://registry.domain123.ru:5000/v2/_catalog</nowiki></code>
     ...
     {"repositories":["centos7-apache24-php54"]}
     ...
List image versions

<code>curl -X GET -k -u admin:PassWord <nowiki>https://registry.domain123.ru:5000/v2/centos7-apache24-php54/tags/list</nowiki></code>
     ...
     {"name":"centos7-apache24-php54","tags":["v1.0"]}
     ...
Pull image centos7-apache24-php54:v1.0 and run container

<code>docker run -d registry.domain123.ru:5000/centos7-apache24-php54:v1.0</code>

==== Kubernetes pull and run pod ====
<blockquote>You have to create secret in NAMESPACE, which you'll be use for pod or deployment. If you'll use pod in custom NAMESPACES, then you must create secret in this custom NAMESPACE</blockquote><blockquote>'<nowiki/>'''registry.domain123.ru.5000'''<nowiki/>' - custom secret name</blockquote>Create entity called "secret", which we will use to aith at docker-registry in "default" NAMESPACE

<code>kubectl create secret docker-registry 'registry.domain123.ru.5000' --docker-server=registry.domain123.ru:5000 --docker-username=admin --docker-password=PassWord</code>

Create entity called "secret", which we will use to aith at docker-registry in custom "ns01" NAMESPACE

<code>kubectl create -n ns01 secret docker-registry 'registry.domain123.ru.5000' --docker-server=registry.domain123.ru:5000 --docker-username=admin --docker-password=PassWord</code>

Show secret contents in yaml

<code>kubectl get secret registry.domain123.ru.5000 -o yaml</code>
     ...
     apiVersion: v1
     data:
     .dockerconfigjson: eyJhdXRocyI6eyJyZWdpc3RyeS5kb21haW4xMjMucnU6NTAwMCI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJkaXNwZXJzaWE4NUQiLCJhdXRoIjoiWVdSdGFXNDZaR2x6Y0dWeWMybGhPRFZFIn19fQ==
     kind: Secret
     metadata:
     creationTimestamp: "2022-10-16T10:49:14Z"
     name: registry.domain123.ru.5000
     namespace: default
     resourceVersion: "10223630"
     uid: 13733e45-e3c1-40ef-91aa-b6dfca576c2c
     type: kubernetes.io/dockerconfigjson
     ...
Create manifest to creating pod

<code>nano ./pod.yaml</code>
 apiVersion: v1
 kind: Pod
 metadata:
   name: centos7-apache24-php54-pod
 spec:
   containers:
   - name: centos7-apache24-php54-container
     image: registry.domain123.ru:5000/centos7-apache24-php54:v1.0
   imagePullSecrets:
   - name: registry.domain123.ru.5000
Create pod

<code>kubectl apply -f ./pod.yaml</code>

Show pod

<code>kubectl get pods -o wide --all-namespaces</code>
     ...
     NAMESPACE       NAME                                                     READY   STATUS        RESTARTS       AGE     IP                NODE           NOMINATED NODE   READINESS GATES
     default         centos7-apache24-php54-pod                               1/1     Running       0              30s     172.16.213.120    kub-node-2     <none>           <none>
     ...
Create manifest to creating deployment

<code>nano ./deployment.yaml</code>
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: enc-httpd-php
   labels:
     app: enc-httpd-php
 spec:
   replicas: 2
   selector:
     matchLabels:
       app: enc-httpd-php
   template:
     metadata:
       labels:
         app: enc-httpd-php
     spec:
       containers:
       - name: enc-httpd-php
         image: registry.domain123.ru:5000/centos7-apache24-php54:v1.0
         ports:
         - containerPort: 80
       imagePullSecrets:
         - name: registry.domain123.ru.5000
Create deployment

<code>kubectl apply -f deployment.yaml</code>

Show deployment

<code>kubectl get -n default deployments.apps</code>
     ...
     NAME            READY   UP-TO-DATE   AVAILABLE   AGE
     enc-httpd-php   2/2     2            2           106s
     ...
Show pods

<code>kubectl get pods -o wide --all-namespaces</code>
     ...
     NAMESPACE       NAME                                                     READY   STATUS        RESTARTS       AGE     IP                NODE           NOMINATED NODE   READINESS GATES
     default         enc-httpd-php-86495d59f-fx2w2                            1/1     Running       0              2m20s   172.16.213.121    kub-node-2     <none>           <none>
     default         enc-httpd-php-86495d59f-r8fz5                            1/1     Running       0              2m20s   172.16.213.122    kub-node-2     <none>           <none>
     ...
[[Категория:Docker]]
[[Категория:Kubernetes]]
__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__