Postavljanje Docker Registry-a na Rocky Linux 8/AlmaLinux 8

Docker registar je sustav za pohranu i distribuciju sadržaja koji sadrži imenovane Docker slike, dostupne u različitim verzijama s oznakama. Korisnici koji koriste Docker komuniciraju s registrom pomoću naredbi docker push i docker pull. Ponekad je smisleno pohraniti Docker slike na lokalnom registru umjesto da ih šaljete na Docker hub. U ovom vodiču postavit ćemo privatni Docker registar na Rocky/AlmaLinux 8 osiguran Let’s Encrypt SSL certifikatom.

Uštedjet ćete puno propusnosti za veliki tim i osigurati slike koje ne želite da budu javno dostupne. Kreiranje lokalnog Docker registra sastoji se od nekoliko jednostavnih koraka. Za instalaciju Dockera na različite distribucije pogledajte Kako instalirati Docker CE na Linux sustavima.

Instaliraj Docker Engine

Za pokretanje registra potreban nam je Docker Engine. Ažurirajte svoj sustav prije instalacije.

sudo yum -y update

Pokrenite naredbe u nastavku za instalaciju Docker CE.

sudo curl -o /etc/yum.repos.d/docker-ce.repo https://download.docker.com/linux/centos/docker-ce.repo

Zatim instalirajte Docker CE pakete i Compose dodatak.

sudo yum -y install docker-ce docker-ce-cli containerd.io

Ako želite koristiti Docker kao korisnik bez administratorskih prava, sada biste trebali razmisliti o dodavanju svog korisnika u grupu „docker“:

sudo usermod -aG docker $USER
newgrp docker

Pokrenite donju naredbu da vidite koja je verzija Dockera instalirana.

$ docker --version
Docker version 26.1.3, build b72abbb

Pokrenite i omogućite Docker uslugu:

sudo systemctl enable --now docker

Status bi trebao biti pokrenut:

 $ systemctl status docker
● docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; vendor preset: disabled)
   Active: active (running) since Sat 2024-07-13 19:53:19 UTC; 4s ago
     Docs: https://docs.docker.com
 Main PID: 17832 (dockerd)
    Tasks: 7
   Memory: 30.4M
   CGroup: /system.slice/docker.service
           └─17832 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

Jul 13 19:53:19 rocky8.cloudspinx.com systemd[1]: Starting Docker Application Container Engine...
Jul 13 19:53:19 rocky8.cloudspinx.com dockerd[17832]: time="2024-07-13T19:53:19.316260221Z" level=info msg="Starting up"
Jul 13 19:53:19 rocky8.cloudspinx.com dockerd[17832]: time="2024-07-13T19:53:19.340012039Z" level=info msg="Loading containers: start."
Jul 13 19:53:19 rocky8.cloudspinx.com dockerd[17832]: time="2024-07-13T19:53:19.621507107Z" level=info msg="Loading containers: done."
Jul 13 19:53:19 rocky8.cloudspinx.com dockerd[17832]: time="2024-07-13T19:53:19.644692641Z" level=info msg="Docker daemon" commit=8e96db1 containerd-snapshotter=false storage-driver=overlay2 versio>
Jul 13 19:53:19 rocky8.cloudspinx.com dockerd[17832]: time="2024-07-13T19:53:19.644783862Z" level=info msg="Daemon has completed initialization"
Jul 13 19:53:19 rocky8.cloudspinx.com dockerd[17832]: time="2024-07-13T19:53:19.671038318Z" level=info msg="API listen on /run/docker.sock"
Jul 13 19:53:19 rocky8.cloudspinx.com systemd[1]: Started Docker Application Container Engine.
[root@rocky8 ~]#

Generiraj Let’s Encrypt SSL certifikate

Kao što je ranije obećano, koristit ćemo Let's Encrypt SSL certifikate za osiguranje naše Docker Registry postavke koja radi na Rocky/AlmaLinuxu.

Instalirajte alat certbot koji će se koristiti za zahtjev za Let’s Encrypt certifikatom.

sudo yum -y install epel-release
sudo yum -y install certbot

Zahtjev za SSL certifikat:

export DOMAIN="registry.domain.com"
export EMAIL="[email "
certbot certonly --standalone -d $DOMAIN --preferred-challenges http --agree-tos -n -m $EMAIL --keep-until-expiring

Očekivani rezultat generiranja certifikata:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for registry.computingforgeeks.com
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/registry.computingforgeeks.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/registry.computingforgeeks.com/privkey.pem
   Your cert will expire on 2021-07-28. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

Vaši certifikati bit će spremljeni pod /etc/letsencrypt/live/

/etc/letsencrypt/live/registry.domain.com/fullchain.pem
/etc/letsencrypt/live/registry.domain.com/privkey.pem

Gdje :

fullchain.pem ⇒ kombinirana datoteka cert.pem i chain.pem
chain.pem ⇒ posredni certifikat
cert.pem ⇒ SSL poslužiteljski certifikat (uključuje javni ključ)
privkey.pem ⇒ datoteka privatnog ključa

Pokrenite Docker registar na Rocky Linux/AlmaLinux 8

Docker registar možete pokrenuti s SSL-om ili bez njega. Pokazat ćemo vam kako možete pokrenuti Docker registar na oba načina.

Ali prvo, stvorite direktorij koji će sadržavati Docker registry slike:

sudo mkdir /var/lib/docker/registry

Pokretanje lokalnog Docker registra bez SSL-a

docker run -d -p 5000:5000 \
--name docker-registry \
--restart=always \
-v /var/lib/docker/registry:/var/lib/registry \
registry:2

Pokretanje lokalnog Docker registra s SSL-om

Napravite direktorij i postavite certifikate na računalo:

export DOMAIN="registry.domain.com"
mkdir /certs
sudo cp /etc/letsencrypt/live/$DOMAIN/fullchain.pem /certs/fullchain.pem
sudo cp /etc/letsencrypt/live/$DOMAIN/privkey.pem /certs/privkey.pem
sudo cp /etc/letsencrypt/live/$DOMAIN/cert.pem /certs/cert.pem

Kreirajte Docker Registry spremnik:

docker run -d --name docker-registry --restart=always \
-p 5000:5000 \
-e REGISTRY_HTTP_ADDR=0.0.0.0:5000 \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/fullchain.pem  \
-e REGISTRY_HTTP_TLS_KEY=/certs/privkey.pem \
-v /certs:/certs \
-v /var/lib/docker/registry:/var/lib/registry \
registry:2

Zamijenite registry.domain.com svojim nazivom poddomene registra.

Preuzet će Docker sliku registry:2 ako ne postoji i stvoriti kontejner

Unable to find image 'registry:2' locally
2: Pulling from library/registry
ddad3d7c1e96: Pull complete
6eda6749503f: Pull complete
363ab70c2143: Pull complete
5b94580856e6: Pull complete
12008541203a: Pull complete
Digest: sha256:bac2d7050dc4826516650267fe7dc6627e9e11ad653daca0641437abdf18df27
Status: Downloaded newer image for registry:2
ed960bd27529be26e7ef728027844a62b0731b08bafdbbf63dea328dac46e024

Provjeri stanje spremnika:

# docker ps
CONTAINER ID   IMAGE        COMMAND                  CREATED          STATUS          PORTS                                       NAMES
ed960bd27529   registry:2   "/entrypoint.sh /etc…"   28 seconds ago   Up 27 seconds   0.0.0.0:5000->5000/tcp, :::5000->5000/tcp   docker-registry

Za slanje slika na Registry Container server, postavite kao dolje:

$ curl https://$DOMAIN:5000/v2/_catalog
{"repositories":[]}

Ako imate uključen SELinux, mogli biste naići na problem pri korištenju porta 5000, razmislite o onemogućavanju SELinux-a ili postavljanju na permisivni način ako se pojave problemi.

Ako je firewalld omogućen i pokrenut, dopustite port na vatrozidu.

sudo firewall-cmd --add-port=5000/tcp --permanent
sudo firewall-cmd --reload

Dodaj Nesigurni Registar u Docker Engine

Po defaultu, Docker koristi https za povezivanje s Docker registrom. No, mogu postojati slučajevi kada je potrebno koristiti nesigurni registar, posebno ako se nalazite na pouzdanoj mreži. To uklanja potrebu za certifikatom koji je potpisao CA za internu upotrebu ili za povjerenje u samopotpisani certifikat na svim Docker čvorovima. Evo koraka kako dodati Nesigurni Registar u Docker Engine.

Za Ubuntu Xenial, uredite /etc/docker/daemon.json i ažurirajte ključ „insecure-registries“. npr.

{
 "insecure-registries" : ["registry.domain.com:5000"]
 }

Uredite datoteku /etc/docker/daemon.json, npr.

{
 "insecure-registries" : ["registry.domain.com:5000"]
 }

Za Ubuntu Trusty, uredite datoteku /etc/default/docker i ažurirajte DOCKER_OPTS, npr.

DOCKER_OPTS='--insecure-registry registry.domain.com:5000'

Zatim ponovno pokrenite Docker motor

sudo systemctl restart docker

Slanje Docker slika u lokalni registar

Sada kada je registar spreman, možete početi slati Docker slike u njega. Ako nemate aktivan DNS poslužitelj, koristite datoteku /etc/hosts za preslikavanje naziva računala na IP adresu.

$ sudo vim /etc/hosts
192.168.1.23 registry.domain.com

Preuzet ću najnoviju ubuntu Docker sliku s Docker huba i prenijeti je u svoj lokalni Docker registar.

$ docker pull ubuntu
Using default tag: latest
latest: Pulling from library/ubuntu
345e3491a907: Pull complete
57671312ef6f: Pull complete
5e9250ddb7d0: Pull complete
Digest: sha256:cf31af331f38d1d7158470e095b132acd126a7180a54f263d386da88eb681d93
Status: Downloaded newer image for ubuntu:latest
docker.io/library/ubuntu:latest

Označite sliku kao registry.domain.com:5000/ubuntu. Ovo stvara dodatnu oznaku za postojeću sliku. Kada je prvi dio oznake naziv hosta i port, Docker to tumači kao lokaciju registra prilikom slanja.

docker tag ubuntu $DOMAIN:5000/ubuntu

Gurnite sliku u lokalni registar koji radi na registry.domain.com:5000/ubuntu

$ docker push $DOMAIN:5000/ubuntu
Using default tag: latest
The push refers to repository [registry.domain.com:5000/ubuntu]
2f140462f3bc: Pushed
63c99163f472: Pushed
ccdbb80308cc: Pushed
latest: digest: sha256:86ac87f73641c920fb42cc9612d4fb57b5626b56ea2a19b894d0673fd5b4f2e9 size: 943

Ako je prijenos slike bio uspješan, na kraju biste trebali dobiti sha256 hash. Gurnute slike pohranjuju se u direktorij /var/lib/registry/docker/registry/v2/repositories.

$ ls /var/lib/docker/registry/docker/registry/v2/repositories/
ubuntu

Ovo je ista metoda koju ćete koristiti za gurnuti prilagođene Docker slike. Za preuzimanje Docker slika na lokalni registar, upotrijebite naredbu:

$ docker pull registry-hostname:500/image:tag
#E.g
$ docker pull registry.domain.com:5000/ubuntu

U svom sljedećem vodiču pokrit ću konfiguriranje nginx proxyja za pristup repozitoriju preko https-a.

Također možete pogledati Instalirajte Docker UI upravitelj – Portainer