Docker. Docker Registry Server (own Docker Hub to store images)
Links
https://winitpro.ru/index.php/2021/03/03/nastrojka-lokalnogo-docker-registry/
Install
Docker-registry server
Docker install
sudo dnf -y config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo dnf -y remove podman buildah
sudo dnf -y install docker-ce docker-ce-cli containerd.io
sudo systemctl start docker.service
sudo systemctl enable docker.service
sudo docker version
Docker-registry server install
docker pull registry
HTTP
Create registry container
sudo docker run -d -p 5000:5000 --restart=always --name registry registry:2
If you want to mount local dir to store images not in the registry container
mkdir -p /opt/docker-registry/images
sudo docker run -d -p 5000:5000 --restart=always -v /opt/docker-registry:/var/lib/registry --name registry registry:2
HTTPS
Self-signed certificate
Local dir for certs
mkdir -p /certs
Create certs at local dir
Case 1. If you are using Domain Name for server url address
openssl req -newkey rsa:4096 -nodes -sha256 -addext "subjectAltName = DNS:registry.domain123.ru" -keyout /certs/ca.key -x509 -days 3650 -out /certs/ca.crt
... Common Name (eg, your name or your server's hostname) []: registry.domain123.ru ...
Case 2. If you are using IP for server url address
openssl req -newkey rsa:4096 -nodes -sha256 -addext "subjectAltName = IP:192.168.166.57" -keyout /certs/ca.key -x509 -days 3650 -out /certs/ca.crt
Create registry container
docker run -d -p 5000:5000 --restart=always --name registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key registry:2
If you want to mount local dir to store images not in the registry container
mkdir -p /opt/docker-registry/images
docker run -d -p 5000:5000 --restart=always --name registry -v /opt/docker-registry:/var/lib/registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key registry:2
Letsencrypt cert
Create cert and put it to local dir /certs
certbot certonly --standalone -m it@alef-studio.ru --agree-tos -d registry.domain123.ru
Create registry container
docker run -d -p 5000:5000 --restart=always --name registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/fullchain1.pem -e REGISTRY_HTTP_TLS_KEY=/certs/privkey1.pem registry:2
Docker client
Required setting (otherwise you'll get an errors)
Case 1. HTTP Docker Registry Server
nano /etc/docker/daemon.json
{
<...>,
"insecure-registries": ["registry.domain123.ru:5000"]
}
Case 2. HTTPS Docker Registry Server
Create dir for certs at client
mkdir -p /etc/docker/certs.d/registry.domain123.ru\:5000
Get ca.crt from docker-registry-server ant put it to dir
scp -pr root@registry.domain123.ru:/certs/ca.crt /etc/docker/certs.d/registry.domain123.ru\:5000/
Getting image from Docker Registry Server
Pull standart image
docker pull piuma/centos7-apache-php
Rename (tag) image to send it to registry
docker tag piuma/centos7-apache-php registry.domain123.ru:5000/centos7-apache24-php54:v1.0
Dealing with docker registry
Push image
docker push registry.domain123.ru:5000/centos7-apache24-php54:v1.0
Delete temp images
docker image rm piuma/centos7-apache-php
docker image rm registry.domain123.ru:5000/centos7-apache24-php54:v1.0
List images at registry server
HTTP:
curl "http:/registry.domain123.ru:5000/v2/_catalog"
HTTPS:
curl -k "https:/registry.domain123.ru:5000/v2/_catalog"
List images
curl -X GET -k https://registry.domain123.ru:5000/v2/_catalog
...
{"repositories":["centos7-apache24-php54"]}
...
List image versions
curl -X GET -k https://registry.domain123.ru:5000/v2/centos7-apache24-php54/tags/list
...
{"name":"centos7-apache24-php54","tags":["v1.0"]}
...
Case 1. pull image by Dockerfile
nano Dockerfile
FROM registry.domain123.ru:5000/centos7-apache24-php54:v1.0
docker build .
...
Sending build context to Docker daemon 2.048kB
Step 1/1 : FROM registry.domain123.ru:5000/centos7-apache24-php54:v1.0
v1.0: Pulling from centos7-apache24-php54
85432449fd0f: Pull complete
b0ab9cac454f: Pull complete
54f95e958f19: Pull complete
58808b33fc80: Pull complete
a36e7ad34fb4: Pull complete
48671b2dfef3: Pull complete
1b8315d2ff99: Pull complete
c1aad7b0dff2: Pull complete
64072889578d: Pull complete
19bc62c4642d: Pull complete
b9627ad61d03: Pull complete
6b2679961086: Pull complete
Digest: sha256:db90682c4412274808ada30d1cd106062f7de959b4559d004f73fcbf007c88c2
Status: Downloaded newer image for registry.domain123.ru:5000/centos7-apache24-php54:v1.0
---> ce6aa6d7b81c
Successfully built ce6aa6d7b81c
...
Case 2. pull image by command and run container
docker run -d registry.domain123.ru:5000/centos7-apache24-php54:v1.0
Show pulled image
docker images
... registry.domain123.ru:5000/centos7-apache24-php54 v1.0 ce6aa6d7b81c 4 years ago 389MB ...
Docker registry auth
Docker registry server
Install htpasswd
dnf install httpd-tools
Create dir for auth file
mkdir -p /opt/docker-registry/auth
cd /opt/docker-registry/auth
Create users
-c - create new file
htpasswd -Bc registry.password admin
htpasswd -B registry.password user01
List users
cat /opt/docker-registry/auth/registry.password
... admin:$2y$05$MVFUcbrnLOjrqsPT8tR.6OL4fwTYUiP4yLmwP9.31PbRVJoWTQsCq user01:$2y$05$IhX/Ch1xkWfaHWyxQE9vSO6eVCnBRSc8uM.jyWzUnBFDtJw.6qYue ...
Create registry container
-e позволяют передать в контейнер переменные окружения(environment).
REGISTRY_AUTH — auth type - htpasswd;
REGISTRY_AUTH_HTPASSWD_REALM — head realm from RFC 7235;
REGISTRY_AUTH_HTPASSWD_PATH — path to registry.password
REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY — container directory to store images, we mount local directory /opt/docker-registry to it
docker run -d -p 5000:5000 --restart=always -e REGISTRY_AUTH=htpasswd -e REGISTRY_AUTH_HTPASSWD_REALM=Registry -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/registry.password -e REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/var/lib/registry -v "/opt/docker-registry/auth:/auth" -v /opt/docker-registry:/var/lib/registry -v /certs:/certs -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/ca.crt -e REGISTRY_HTTP_TLS_KEY=/certs/ca.key --name registry registry:2
Docker client
Auth at registry server
docker login registry.domain123.ru:5000
Username: admin Password:
List images
curl -X GET -k -u admin:PassWord https://registry.domain123.ru:5000/v2/_catalog
...
{"repositories":["centos7-apache24-php54"]}
...
List image versions
curl -X GET -k -u admin:PassWord https://registry.domain123.ru:5000/v2/centos7-apache24-php54/tags/list
...
{"name":"centos7-apache24-php54","tags":["v1.0"]}
...
Pull image centos7-apache24-php54:v1.0 and run container
docker run -d registry.domain123.ru:5000/centos7-apache24-php54:v1.0
Kubernetes pull and run pod
You have to create secret in NAMESPACE, which you'll be use for pod or deployment. If you'll use pod in custom NAMESPACES, then you must create secret in this custom NAMESPACE
'registry.domain123.ru.5000' - custom secret name
Create entity called "secret", which we will use to aith at docker-registry in "default" NAMESPACE
kubectl create secret docker-registry 'registry.domain123.ru.5000' --docker-server=registry.domain123.ru:5000 --docker-username=admin --docker-password=PassWord
Create entity called "secret", which we will use to aith at docker-registry in custom "ns01" NAMESPACE
kubectl create -n ns01 secret docker-registry 'registry.domain123.ru.5000' --docker-server=registry.domain123.ru:5000 --docker-username=admin --docker-password=PassWord
Show secret contents in yaml
kubectl get secret registry.domain123.ru.5000 -o yaml
... apiVersion: v1 data: .dockerconfigjson: eyJhdXRocyI6eyJyZWdpc3RyeS5kb21haW4xMjMucnU6NTAwMCI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJkaXNwZXJzaWE4NUQiLCJhdXRoIjoiWVdSdGFXNDZaR2x6Y0dWeWMybGhPRFZFIn19fQ== kind: Secret metadata: creationTimestamp: "2022-10-16T10:49:14Z" name: registry.domain123.ru.5000 namespace: default resourceVersion: "10223630" uid: 13733e45-e3c1-40ef-91aa-b6dfca576c2c type: kubernetes.io/dockerconfigjson ...
Create manifest to creating pod
nano ./pod.yaml
apiVersion: v1 kind: Pod metadata: name: centos7-apache24-php54-pod spec: containers: - name: centos7-apache24-php54-container image: registry.domain123.ru:5000/centos7-apache24-php54:v1.0 imagePullSecrets: - name: registry.domain123.ru.5000
Create pod
kubectl apply -f ./pod.yaml
Show pod
kubectl get pods -o wide --all-namespaces
... NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES default centos7-apache24-php54-pod 1/1 Running 0 30s 172.16.213.120 kub-node-2 <none> <none> ...
Create manifest to creating deployment
nano ./deployment.yaml
apiVersion: apps/v1 kind: Deployment metadata: name: enc-httpd-php labels: app: enc-httpd-php spec: replicas: 2 selector: matchLabels: app: enc-httpd-php template: metadata: labels: app: enc-httpd-php spec: containers: - name: enc-httpd-php image: registry.domain123.ru:5000/centos7-apache24-php54:v1.0 ports: - containerPort: 80 imagePullSecrets: - name: registry.domain123.ru.5000
Create deployment
kubectl apply -f deployment.yaml
Show deployment
kubectl get -n default deployments.apps
... NAME READY UP-TO-DATE AVAILABLE AGE enc-httpd-php 2/2 2 2 106s ...
Show pods
kubectl get pods -o wide --all-namespaces
... NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES default enc-httpd-php-86495d59f-fx2w2 1/1 Running 0 2m20s 172.16.213.121 kub-node-2 <none> <none> default enc-httpd-php-86495d59f-r8fz5 1/1 Running 0 2m20s 172.16.213.122 kub-node-2 <none> <none> ...