Harbor企业级容器镜像仓库安装配置

一、Harbor介绍

Harbor是VMware公司开源的企业级Docker Registry项目。

项目地址：https://github.com/goharbor/harbor

安装要求

二、自签HTTPS证书

Docker安装及启动服务

[root@harbor1 ~]# yum install docker-ce -y[root@harbor1 ~]# systemctl start docker[root@harbor1 ~]# systemctl enable dockerCreated symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.

安装docker-compose

[root@node01 ~]# curl -L https://get.daocloud.io/docker/compose/releases/download/1.24.1/docker-compose-uname -s-uname -m > /usr/local/bin/docker-compose % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                             Dload  Upload   Total   Spent    Left  SpeedBashCC++C#CSSGoHaskellHTMLJavaJavaScriptJSONJSXkotlinPHPPowerShellPythonRubyRustSQLSwiftTypeScriptXML100   423  100   423    0     0   1574      0 --:--:-- --:--:-- --:--:--  1572100 15.4M  100 15.4M    0     0  5314k      0  0:00:02  0:00:02 --:--:-- 6117k[root@node01 ~]# chmod +x /usr/local/bin/docker-compose

Harbor 安装

[root@harbor1 ~]# mkdir harbor[root@harbor1 ~]# mkdir /data/cert -p[root@harbor1 ~]# cd /opt/software/[root@harbor1 software]# tar xf harbor-offline-installer-v1.8.1.tgz [root@harbor1 software]# mv harbor/* /root/harbor/[root@harbor1 software]# cd /root/harbor/[root@harbor1 harbor]# lltotal 551208-rw-r--r--. 1 root root 564403568 Jun 17 11:30 harbor.v1.8.1.tar.gz-rw-r--r--. 1 root root      4519 Jun 17 11:29 harbor.yml-rwxr-xr-x. 1 root root      5088 Jun 17 11:29 install.sh-rw-r--r--. 1 root root     11347 Jun 17 11:29 LICENSE-rwxr-xr-x. 1 root root      1654 Jun 17 11:29 prepare

配置自签证书

[root@harbor1 ~]# cd /data/cert[root@harbor1 cert]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 365 -out ca.crtGenerating a 4096 bit RSA private key...........++.............................................++writing new private key to 'ca.key'You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:Locality Name (eg, city) [Default City]:Organization Name (eg, company) [Default Company Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) []:harbor1Email Address []:[root@node01 cert]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout harbor1.linuxplus.com.key -out harbor1.linuxplus.com.csrGenerating a 4096 bit RSA private key...........................................................................................++................................................................................................++writing new private key to 'harbor1.linuxplus.com.key'You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:Locality Name (eg, city) [Default City]:Organization Name (eg, company) [Default Company Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) []:harbor1.linuxplus.comEmail Address []:Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:An optional company name []:[root@harbor1 cert]# lsca.crt  ca.key  harbor1.linuxplus.com.csr  harbor1.linuxplus.com.key[root@harbor1 cert]# openssl x509 -req -days 365 -in reg.linuxplus.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out reg.linuxplus.com.crtSignature oksubject=/C=CN/L=Default City/O=Default Company Ltd/CN=harbor1.linuxplus.comGetting CA Private Key[root@harbor1 cert]# ca.crt  ca.key  ca.srl  harbor1.linuxplus.com.crt  harbor1.linuxplus.com.csr  harbor1.linuxplus.com.key

三、安装配置harbor

[root@harbor1 harbor]# vim harbor.ymlhostname: harbor1.linuxplus.comhttp:port for http, default is 80. If https enabled, this port will redirect to https port port: 80https: port: 443 certificate: /data/cert/harbor1.linuxplus.com.crt private_key: /data/cert/harbor1.linuxplus.com.keyharbor_admin_password: Harbor12345database:The password for the root user of Harbor DB. Change this before any production use. password: root123data_volume: /dataclair:The interval of clair updaters, the unit is hour, set to 0 to disable the updaters. updaters_interval: 12Config http proxy for Clair, e.g. http://my.proxy.com:3128Clair doesn't need to connect to harbor internal components via http proxy. http_proxy: https_proxy: no_proxy: 127.0.0.1,localhost,core,registryjobservice:Maximum number of job workers in job service max_job_workers: 10chart:Change the value of absolute_url to enabled can enable absolute url in chart absolute_url: disabledlog:options are debug, info, warning, error, fatal level: infoLog files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated. rotate_count: 50Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100Gare all valid. rotate_size: 200MThe directory on your host that store log location: /var/log/harbor_version: 1.8.0[root@harbor1 harbor]# ./install.sh [Step 0]: checking installation environment ...Note: docker version: 18.09.8Note: docker-compose version: 1.24.1[Step 1]: loading Harbor images ...ba58b7bb3f17: Loading layer [==================================================>]  33.32MB/33.32MB1351a2c39b77: Loading layer [==================================================>]  8.967MB/8.967MB13b531e88128: Loading layer [==================================================>]  46.85MB/46.85MB664abb325748: Loading layer [==================================================>]  5.632kB/5.632kB9f20c7a04d55: Loading layer [==================================================>]  27.14kB/27.14kB594e8fcaaae3: Loading layer [==================================================>]  46.85MB/46.85MBLoaded image: goharbor/harbor-core:v1.8.1779e79e64bef: Loading layer [==================================================>]  8.968MB/8.968MB8a9aeb8fc32b: Loading layer [==================================================>]  3.072kB/3.072kBa4ae88938e21: Loading layer [==================================================>]   20.1MB/20.1MB28b6b0ffc1f1: Loading layer [==================================================>]  3.072kB/3.072kBc1e7908f331a: Loading layer [==================================================>]  7.465MB/7.465MBa19f7fb04672: Loading layer [==================================================>]  27.56MB/27.56MBLoaded image: goharbor/harbor-registryctl:v1.8.154861210f3e5: Loading layer [==================================================>]  73.51MB/73.51MB501c77bcbdac: Loading layer [==================================================>]  3.072kB/3.072kB7d3ce9039ed2: Loading layer [==================================================>]   59.9kB/59.9kB7bba9a15dc1c: Loading layer [==================================================>]  61.95kB/61.95kBLoaded image: goharbor/redis-photon:v1.8.1fc559a3fef74: Loading layer [==================================================>]  8.967MB/8.967MBee2a0fed7764: Loading layer [==================================================>]  5.143MB/5.143MB900c7f7491cb: Loading layer [==================================================>]  15.13MB/15.13MBf0a444f2ab35: Loading layer [==================================================>]  26.47MB/26.47MBc5f0e5f3f9f4: Loading layer [==================================================>]  22.02kB/22.02kB26506d175699: Loading layer [==================================================>]  3.072kB/3.072kB47bcfef1acb5: Loading layer [==================================================>]  46.74MB/46.74MBLoaded image: goharbor/notary-server-photon:v0.6.1-v1.8.11b052a5ea7be: Loading layer [==================================================>]  8.972MB/8.972MBf4fa6cca061e: Loading layer [==================================================>]  35.77MB/35.77MBc5dc6f364e18: Loading layer [==================================================>]  2.048kB/2.048kBb79be0e51f9b: Loading layer [==================================================>]  3.072kB/3.072kB82899453e467: Loading layer [==================================================>]  35.77MB/35.77MBLoaded image: goharbor/chartmuseum-photon:v0.8.1-v1.8.17674fdf3aec8: Loading layer [==================================================>]  63.36MB/63.36MBf89719511663: Loading layer [==================================================>]  49.81MB/49.81MB746254f5dca5: Loading layer [==================================================>]  6.656kB/6.656kB3669f0dbd54b: Loading layer [==================================================>]  2.048kB/2.048kBd0c83bbc6fd5: Loading layer [==================================================>]   7.68kB/7.68kBa7cb2e952968: Loading layer [==================================================>]   2.56kB/2.56kB563892d38354: Loading layer [==================================================>]   2.56kB/2.56kB95da7578c175: Loading layer [==================================================>]   2.56kB/2.56kBLoaded image: goharbor/harbor-db:v1.8.1d4f0ba4c6978: Loading layer [==================================================>]  8.967MB/8.967MBf20b432a6985: Loading layer [==================================================>]  38.81MB/38.81MB16b52efd4bf9: Loading layer [==================================================>]  38.81MB/38.81MBLoaded image: goharbor/harbor-jobservice:v1.8.161982ee954e7: Loading layer [==================================================>]  3.548MB/3.548MBLoaded image: goharbor/nginx-photon:v1.8.1195156f64002: Loading layer [==================================================>]  8.968MB/8.968MB6f093bbedbfe: Loading layer [==================================================>]  3.072kB/3.072kB4ecbf9bd0f9b: Loading layer [==================================================>]   2.56kB/2.56kB970d58a16ac9: Loading layer [==================================================>]   20.1MB/20.1MBfe6015e1e3fc: Loading layer [==================================================>]   20.1MB/20.1MBLoaded image: goharbor/registry-photon:v2.7.1-patch-2819-v1.8.1b0feb119f01c: Loading layer [==================================================>]  343.7MB/343.7MB4c5027462195: Loading layer [==================================================>]  106.5kB/106.5kBLoaded image: goharbor/harbor-migrator:v1.8.1d3d89de23de4: Loading layer [==================================================>]   2.56kB/2.56kBd6cb22cc0142: Loading layer [==================================================>]  1.536kB/1.536kB45c2997b6abf: Loading layer [==================================================>]  68.74MB/68.74MBece1a297b8bf: Loading layer [==================================================>]  39.75MB/39.75MB270978aebbde: Loading layer [==================================================>]  144.4kB/144.4kB475e8090da36: Loading layer [==================================================>]  3.005MB/3.005MBLoaded image: goharbor/prepare:v1.8.1085f0cf72aa7: Loading layer [==================================================>]  3.548MB/3.548MB5050c82f527e: Loading layer [==================================================>]  6.569MB/6.569MB50bcc42e4e95: Loading layer [==================================================>]  160.8kB/160.8kB1b057a9ff0e2: Loading layer [==================================================>]    215kB/215kB107182cd08af: Loading layer [==================================================>]  3.584kB/3.584kBLoaded image: goharbor/harbor-portal:v1.8.1b3e2294bd95f: Loading layer [==================================================>]  50.51MB/50.51MBe680ad267b80: Loading layer [==================================================>]  3.584kB/3.584kBf15b30041974: Loading layer [==================================================>]  3.072kB/3.072kBade63a9f91ea: Loading layer [==================================================>]   2.56kB/2.56kB22574174ff2f: Loading layer [==================================================>]  3.072kB/3.072kBb6e99a8f129f: Loading layer [==================================================>]  3.584kB/3.584kB75b8d23356d1: Loading layer [==================================================>]  12.29kB/12.29kBLoaded image: goharbor/harbor-log:v1.8.160d61848f566: Loading layer [==================================================>]  13.72MB/13.72MB6301ffbcd8c1: Loading layer [==================================================>]  26.47MB/26.47MBe31c20fcae09: Loading layer [==================================================>]  22.02kB/22.02kBce48b434a471: Loading layer [==================================================>]  3.072kB/3.072kBacaabaff778a: Loading layer [==================================================>]  45.33MB/45.33MBLoaded image: goharbor/notary-signer-photon:v0.6.1-v1.8.1f606e390eada: Loading layer [==================================================>]    113MB/113MB39c63b1a9659: Loading layer [==================================================>]  10.94MB/10.94MBfcbb83300f3e: Loading layer [==================================================>]  2.048kB/2.048kB2d3a6f2b11a0: Loading layer [==================================================>]  48.13kB/48.13kBe268609393f5: Loading layer [==================================================>]  3.072kB/3.072kBa9aed4bfce3f: Loading layer [==================================================>]  10.99MB/10.99MBLoaded image: goharbor/clair-photon:v2.0.8-v1.8.1[Step 2]: preparing environment ...prepare base dir is set to /opt/harborClearing the configuration file: /config/log/logrotate.confClearing the configuration file: /config/nginx/nginx.confClearing the configuration file: /config/cert/server.keyClearing the configuration file: /config/cert/server.crtClearing the configuration file: /config/core/envClearing the configuration file: /config/core/app.confClearing the configuration file: /config/registry/config.ymlClearing the configuration file: /config/registry/root.crtClearing the configuration file: /config/registryctl/envClearing the configuration file: /config/registryctl/config.ymlClearing the configuration file: /config/db/envClearing the configuration file: /config/jobservice/envClearing the configuration file: /config/jobservice/config.ymlGenerated configuration file: /config/log/logrotate.confGenerated configuration file: /config/nginx/nginx.confGenerated configuration file: /config/core/envGenerated configuration file: /config/core/app.confGenerated configuration file: /config/registry/config.ymlGenerated configuration file: /config/registryctl/envGenerated configuration file: /config/db/envGenerated configuration file: /config/jobservice/envGenerated configuration file: /config/jobservice/config.ymlloaded secret from file: /secret/keys/secretkeyGenerated configuration file: /compose_location/docker-compose.ymlClean up the input dir[Step 3]: starting Harbor ...Creating harbor-log ... doneCreating redis       ... doneCreating registry    ... doneCreating registryctl ... doneCreating harbor-db   ... doneCreating harbor-core ... doneCreating harbor-portal     ... doneCreating harbor-jobservice ... doneCreating nginx             ... done✔ ----Harbor has been installed and started successfully.----Now you should be able to visit the admin portal at https://harbor1.linuxplus.com.For more details, please visit https://github.com/goharbor/harbor .[root@node01 harbor]# docker-compose ps  Name                     Command                  State                        Ports                  BashCC++C#CSSGoHaskellHTMLJavaJavaScriptJSONJSXkotlinPHPPowerShellPythonRubyRustSQLSwiftTypeScriptXMLharbor-core         /harbor/start.sh                 Up (healthy)                                           harbor-db           /entrypoint.sh postgres          Up (healthy)   5432/tcp                                harbor-jobservice   /harbor/start.sh                 Up                                                    harbor-log          /bin/sh -c /usr/local/bin/ ...   Up (healthy)   127.0.0.1:1514->10514/tcp               harbor-portal       nginx -g daemon off;             Up (healthy)   80/tcp                                  nginx               nginx -g daemon off;             Up (healthy)   0.0.0.0:443->443/tcp, 0.0.0.0:80->80/tcpredis               docker-entrypoint.sh redis ...   Up             6379/tcp                                registry            /entrypoint.sh /etc/regist ...   Up (healthy)   5000/tcp                                registryctl         /harbor/start.sh                 Up (healthy)

访问：(user：admin，password：Harbor12345）

四、docker主机从harbor上传下载镜像

[root@db100 ~]# mkdir /data/cert -p[root@db100 ~]# scp 172.16.216.102:/data/cert/harbor1.linuxplus.com.crt /etc/docker/certs.d/harbor1.linuxplus.com/The authenticity of host '172.16.216.102 (172.16.216.102)' can't be established.ECDSA key fingerprint is SHA256:RSjZGjpxNF+3FfNVScnO7si+ixmb5cvjEQChMZANJl8.ECDSA key fingerprint is MD5:91:c5:3d:0a:22:4a:51:9b:b6:57:04:c8:f4:10:df:fd.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '172.16.216.102' (ECDSA) to the list of known hosts.root@172.16.216.102's password: harbor1.linuxplus.com.crt                                                                                               100% 1854     1.4MB/s   00:00    [root@db100 docker]# vim /usr/lib/systemd/system/docker.service ExecStart=/usr/bin/dockerd --insecure-registry 172.16.216.102:443 -H fd:// --containerd=/run/containerd/containerd.sock[root@db100 docker]# systemctl daemon-reload[root@db100 docker]# systemctl restart docker[root@db100 docker]# docker infoClient: Debug Mode: falseServer:Containers: 0 Running: 0 Paused: 0 Stopped: 0Images: 0Server Version: 19.03.0Storage Driver: overlay2 Backing Filesystem: xfs  Supports d_type: true  Native Overlay Diff: trueLogging Driver: json-fileCgroup Driver: cgroupfsPlugins: Volume: local  Network: bridge host ipvlan macvlan null overlay Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslogSwarm: inactiveRuntimes: runcDefault Runtime: runcInit Binary: docker-initcontainerd version: 894b81a4b802e4eb2a91d1ce216b8817763c29fbrunc version: 425e105d5a03fabd737a126ad93d62a9eeede87finit version: fec3683Security Options: seccomp  Profile: defaultKernel Version: 3.10.0-862.11.6.el7.x86_64 Operating System: CentOS Linux 7 (Core)OSType: linuxArchitecture: x86_64CPUs: 1Total Memory: 974.5MiBName: db100.linuxplus.comID: 4SS3:X52G:MGS2:TV6W:PAHP:5ZTE:X3V4:ZDHW:GCIQ:TUY3:23U5:26EUDocker Root Dir: /var/lib/docker Debug Mode: falseRegistry: https://index.docker.io/v1/Labels: Experimental: falseInsecure Registries: 172.16.216.102:443 127.0.0.0/8 Live Restore Enabled: false[root@db100 data]# docker login 172.16.216.102:443Username: stuartPassword:WARNING! Your password will be stored unencrypted in /root/.docker/config.json.Configure a credential helper to remove this warning. Seehttps://docs.docker.com/engine/reference/commandline/login/#credentials-storeLogin Succeeded[root@db100 data]# docker logout 172.16.216.102:443Removing login credentials for 172.16.216.102:443[root@db100 ~]# docker tag nginx:latest 172.16.216.102:443/nginx/nginx:latest[root@db100 ~]# docker push 172.16.216.102:443/nginx/nginx:latestThe push refers to repository [172.16.216.102:443/nginx/nginx]589561a3ffb4: Pushedef7dbb0cfc81: Pushedd56055da3352: Pushedlatest: digest: sha256:f83b2ffd963ac911f9e638184c8d580cc1f3139d5c8c33c87c3fb90aebdebf76 size: 948[root@db100 ~]# docker pull 172.16.216.102:443/nginx/nginxUsing default tag: latestlatest: Pulling from nginx/nginx0a4690c5d889: Pull complete9719afee3eb7: Pull complete44446b456159: Pull completeDigest: sha256:f83b2ffd963ac911f9e638184c8d580cc1f3139d5c8c33c87c3fb90aebdebf76Status: Downloaded newer image for 172.16.216.102:443/nginx/nginx:latest172.16.216.102:443/nginx/nginx:latest[root@db100 ~]# docker imagesREPOSITORY                       TAG                 IMAGE ID            CREATED             SIZE172.16.216.102:443/nginx/nginx   latest              98ebf73aba75        5 days ago          109MB

[root@db100 ~]# mkdir /data/cert -p

[root@db100 ~]# scp 172.16.216.102:/data/cert/harbor1.linuxplus.com.crt /etc/docker/certs.d/harbor1.linuxplus.com/

The authenticity of host '172.16.216.102 (172.16.216.102)' can't be established.

ECDSA key fingerprint is SHA256:RSjZGjpxNF+3FfNVScnO7si+ixmb5cvjEQChMZANJl8.

ECDSA key fingerprint is MD5:91:c5:3d:0a:22:4a:51:9b:b6:57:04:c8:f4:10:df:fd.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '172.16.216.102' (ECDSA) to the list of known hosts.

root@172.16.216.102's password:

harbor1.linuxplus.com.crt 100% 1854 1.4MB/s 00:00

[root@db100 docker]# vim /usr/lib/systemd/system/docker.service

ExecStart=/usr/bin/dockerd --insecure-registry 172.16.216.102:443 -H fd:// --containerd=/run/containerd/containerd.sock

[root@db100 docker]# systemctl daemon-reload

[root@db100 docker]# systemctl restart docker

[root@db100 docker]# docker info

Client:

Debug Mode: false

Server:

Containers: 0

Running: 0

Paused: 0

Stopped: 0

Images: 0

Server Version: 19.03.0

Storage Driver: overlay2

Backing Filesystem: xfs

Supports d_type: true

Native Overlay Diff: true

Logging Driver: json-file

Cgroup Driver: cgroupfs

Plugins:

Volume: local

Network: bridge host ipvlan macvlan null overlay

Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog

Swarm: inactive

Runtimes: runc

Default Runtime: runc

Init Binary: docker-init

containerd version: 894b81a4b802e4eb2a91d1ce216b8817763c29fb

runc version: 425e105d5a03fabd737a126ad93d62a9eeede87f

init version: fec3683

Security Options:

seccomp

Profile: default

Kernel Version: 3.10.0-862.11.6.el7.x86_64

Operating System: CentOS Linux 7 (Core)

OSType: linux

Architecture: x86_64

CPUs: 1

Total Memory: 974.5MiB

Name: db100.linuxplus.com

ID: 4SS3:X52G:MGS2:TV6W:PAHP:5ZTE:X3V4:ZDHW:GCIQ:TUY3:23U5:26EU

Docker Root Dir: /var/lib/docker

Debug Mode: false

Registry: https://index.docker.io/v1/

Labels:

Experimental: false

Insecure Registries:

172.16.216.102:443

127.0.0.0/8

Live Restore Enabled: false

[root@db100 data]# docker login 172.16.216.102:443

Username: stuart

Password:

WARNING! Your password will be stored unencrypted in /root/.docker/config.json.

Configure a credential helper to remove this warning. See

https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

[root@db100 data]# docker logout 172.16.216.102:443

Removing login credentials for 172.16.216.102:443

[root@db100 ~]# docker tag nginx:latest 172.16.216.102:443/nginx/nginx:latest

[root@db100 ~]# docker push 172.16.216.102:443/nginx/nginx:latest

The push refers to repository [172.16.216.102:443/nginx/nginx]

589561a3ffb4: Pushed

ef7dbb0cfc81: Pushed

d56055da3352: Pushed

latest: digest: sha256:f83b2ffd963ac911f9e638184c8d580cc1f3139d5c8c33c87c3fb90aebdebf76 size: 948

[root@db100 ~]# docker pull 172.16.216.102:443/nginx/nginx

Using default tag: latest

latest: Pulling from nginx/nginx

0a4690c5d889: Pull complete

9719afee3eb7: Pull complete

44446b456159: Pull complete

Digest: sha256:f83b2ffd963ac911f9e638184c8d580cc1f3139d5c8c33c87c3fb90aebdebf76

Status: Downloaded newer image for 172.16.216.102:443/nginx/nginx:latest

172.16.216.102:443/nginx/nginx:latest

[root@db100 ~]# docker images

REPOSITORY TAG IMAGE ID CREATED SIZE

172.16.216.102:443/nginx/nginx latest 98ebf73aba75 5 days ago 109MB

错误：

[root@node01 harbor]# docker rmi nginx:1.14-alpineError: No such image: nginx:1.14-alpine

解决方法：

[root@node01 harbor]# systemctl stop docker[root@node01 harbor]# rm -rf /var/lib/docker[root@node01 harbor]# systemctl start docker[root@node01 harbor]# docker imagesREPOSITORY          TAG                 IMAGE ID            CREATED             SIZE