Docker. Docker Registry Server (own Docker Hub to store images)
Links
https://winitpro.ru/index.php/2021/03/03/nastrojka-lokalnogo-docker-registry/
Install
Docker-registry server
Docker install
sudo dnf -y config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo dnf -y remove podman buildah
sudo dnf -y install docker-ce docker-ce-cli containerd.io
sudo systemctl start docker.service
sudo systemctl enable docker.service
sudo docker version
Docker-registry server install
docker pull registry
HTTP
Create registry container
sudo docker run -d -p 5000:5000 --restart=always --name registry registry:2
If you want to mount local dir to store images not in the registry container
mkdir -p /opt/docker-registry/images
sudo docker run -d -p 5000:5000 --restart=always -v /opt/docker-registry:/var/lib/registry --name registry registry:2
HTTPS
Self-signed certificate
Local dir for certs
mkdir -p /certs
Create certs at local dir
openssl req -newkey rsa:4096 -nodes -sha256 -addext "subjectAltName = DNS:registry.domain123.ru" -keyout /certs/ca.key -x509 -days 3650 -out /certs/ca.crt
... Common Name (eg, your name or your server's hostname) []: registry.domain123.ru ...
Create registry container
docker run -d -p 5000:5000 --restart=always --name registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key registry:2
If you want to mount local dir to store images not in the registry container
mkdir -p /opt/docker-registry/images
docker run -d -p 5000:5000 --restart=always --name registry -v /opt/docker-registry:/var/lib/registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key registry:2
Letsencrypt cert
Create cert and put it to local dir /certs
certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d registry.domain123.ru
Create registry container
docker run -d -p 5000:5000 --restart=always --name registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/fullchain1.pem -e REGISTRY_HTTP_TLS_KEY=/certs/privkey1.pem registry:2
Docker client
Pull standart image
docker pull piuma/centos7-apache-php
Rename (tag) image to send it to registry
docker tag piuma/centos7-apache-php registry.domain123.ru:5000/centos7-apache24-php54:v1.0
HTTP
nano /etc/docker/daemon.json
{
<...>,
"insecure-registries": ["registry.domain123.ru:5000"]
}
HTTPS
Get ca.crt from docker-registry-server ant put it to dir
scp -pr root@registry.domain123.ru:/certs/ca.crt /etc/docker/certs.d/registry.domain123.ru\:5000/
Dealing with docker registry
Push image
docker push registry.domain123.ru:5000/centos7-apache24-php54:v1.0
Delete temp images
docker image rm piuma/centos7-apache-php
docker image rm registry.domain123.ru:5000/centos7-apache24-php54:v1.0
List images at registry server
HTTP:
curl "http:/registry.domain123.ru:5000/v2/_catalog"
HTTPS:
curl -k "https:/registry.domain123.ru:5000/v2/_catalog"
List images
curl -X GET -k https://registry.domain123.ru:5000/v2/_catalog
...
{"repositories":["centos7-apache24-php54"]}
...
List image versions
curl -X GET -k https://registry.domain123.ru:5000/v2/centos7-apache24-php54/tags/list
...
{"name":"centos7-apache24-php54","tags":["v1.0"]}
...
Case 1. pull image by Dockerfile
nano Dockerfile
FROM registry.domain123.ru:5000/centos7-apache24-php54:v1.0
docker build .
...
Sending build context to Docker daemon 2.048kB
Step 1/1 : FROM registry.domain123.ru:5000/centos7-apache24-php54:v1.0
v1.0: Pulling from centos7-apache24-php54
85432449fd0f: Pull complete
b0ab9cac454f: Pull complete
54f95e958f19: Pull complete
58808b33fc80: Pull complete
a36e7ad34fb4: Pull complete
48671b2dfef3: Pull complete
1b8315d2ff99: Pull complete
c1aad7b0dff2: Pull complete
64072889578d: Pull complete
19bc62c4642d: Pull complete
b9627ad61d03: Pull complete
6b2679961086: Pull complete
Digest: sha256:db90682c4412274808ada30d1cd106062f7de959b4559d004f73fcbf007c88c2
Status: Downloaded newer image for registry.domain123.ru:5000/centos7-apache24-php54:v1.0
---> ce6aa6d7b81c
Successfully built ce6aa6d7b81c
...
Case 2. pull image by command and run container
docker run -d registry.domain123.ru:5000/centos7-apache24-php54:v1.0
Show pulled image
docker images
... registry.domain123.ru:5000/centos7-apache24-php54 v1.0 ce6aa6d7b81c 4 years ago 389MB ...
Docker registry auth
Docker registry server
Install htpasswd
dnf install httpd-tools
Create dir for auth file
mkdir -p /opt/docker-registry/auth
cd /opt/docker-registry/auth
Create users
-c - create new file
htpasswd -Bc registry.password admin
htpasswd -B registry.password user01
List users
cat /opt/docker-registry/auth/registry.password
... admin:$2y$05$MVFUcbrnLOjrqsPT8tR.6OL4fwTYUiP4yLmwP9.31PbRVJoWTQsCq user01:$2y$05$IhX/Ch1xkWfaHWyxQE9vSO6eVCnBRSc8uM.jyWzUnBFDtJw.6qYue ...
Create registry container
-e позволяют передать в контейнер переменные окружения(environment).
REGISTRY_AUTH — auth type - htpasswd;
REGISTRY_AUTH_HTPASSWD_REALM — head realm from RFC 7235;
REGISTRY_AUTH_HTPASSWD_PATH — path to registry.password
REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY — container directory to store images, we mount local directory /opt/docker-registry to it
docker run -d -p 5000:5000 -e REGISTRY_AUTH=htpasswd -e REGISTRY_AUTH_HTPASSWD_REALM=Registry -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/registry.password -e REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/var/lib/registry -v "/opt/docker-registry/auth:/auth" -v /opt/docker-registry:/var/lib/registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key --name registry registry:2
Docker client
Auth at registry server
docker login registry.domain123.ru:5000
Username: admin Password:
List images
curl -X GET -k -u admin:PassWord https://registry.domain123.ru:5000/v2/_catalog
...
{"repositories":["centos7-apache24-php54"]}
...
List image versions
curl -X GET -k -u admin:PassWord https://registry.domain123.ru:5000/v2/centos7-apache24-php54/tags/list
...
{"name":"centos7-apache24-php54","tags":["v1.0"]}
...
Pull image centos7-apache24-php54:v1.0 and run container
docker run -d registry.domain123.ru:5000/centos7-apache24-php54:v1.0
Kubernetes pull and run pod
You have to create secret in NAMESPACE> which you'll be use for pod or deployment If you'll use pod in custom NAMESPACES, then you must create secret in this custom NAMESPACE
'registry.domain123.ru.5000' - custom secret name
Create entity called "secret", which we will use to aith at docker-registry in "default" NAMESPACE
kubectl create secret docker-registry 'registry.domain123.ru.5000' --docker-server=registry.domain123.ru:5000 --docker-username=admin --docker-password=PassWord
Create entity called "secret", which we will use to aith at docker-registry in custom "ns01" NAMESPACE
kubectl create -n ns01 secret docker-registry 'registry.domain123.ru.5000' --docker-server=registry.domain123.ru:5000 --docker-username=admin --docker-password=PassWord
Show secret contents in yaml
kubectl get secret registry.domain123.ru.5000 -o yaml
... apiVersion: v1 data: .dockerconfigjson: eyJhdXRocyI6eyJyZWdpc3RyeS5kb21haW4xMjMucnU6NTAwMCI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJkaXNwZXJzaWE4NUQiLCJhdXRoIjoiWVdSdGFXNDZaR2x6Y0dWeWMybGhPRFZFIn19fQ== kind: Secret metadata: creationTimestamp: "2022-10-16T10:49:14Z" name: registry.domain123.ru.5000 namespace: default resourceVersion: "10223630" uid: 13733e45-e3c1-40ef-91aa-b6dfca576c2c type: kubernetes.io/dockerconfigjson ...
Create manifest to creating pod
nano ./pod.yaml
apiVersion: v1 kind: Pod metadata: name: centos7-apache24-php54-pod spec: containers: - name: centos7-apache24-php54-container image: registry.domain123.ru:5000/centos7-apache24-php54:v1.0 imagePullSecrets: - name: registry.domain123.ru.5000
Create pod
kubectl apply -f ./pod.yaml
Show pod
kubectl get pods -o wide --all-namespaces
... NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES default centos7-apache24-php54-pod 1/1 Running 0 30s 172.16.213.120 kub-node-2 <none> <none> ...
Create manifest to creating deployment
nano ./deployment.yaml
apiVersion: apps/v1 kind: Deployment metadata: name: enc-httpd-php labels: app: enc-httpd-php spec: replicas: 2 selector: matchLabels: app: enc-httpd-php template: metadata: labels: app: enc-httpd-php spec: containers: - name: enc-httpd-php image: registry.domain123.ru:5000/centos7-apache24-php54:v1.0 ports: - containerPort: 80 imagePullSecrets: - name: registry.domain123.ru.5000
Create deployment
kubectl apply -f deployment.yaml
Show deployment
kubectl get -n default deployments.apps
... NAME READY UP-TO-DATE AVAILABLE AGE enc-httpd-php 2/2 2 2 106s ...
Show pods
kubectl get pods -o wide --all-namespaces
... NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES default enc-httpd-php-86495d59f-fx2w2 1/1 Running 0 2m20s 172.16.213.121 kub-node-2 <none> <none> default enc-httpd-php-86495d59f-r8fz5 1/1 Running 0 2m20s 172.16.213.122 kub-node-2 <none> <none> ...