一.docker仓库：

Docker 仓库是用来包含镜像的位置，Docker提供一个注册服务器（Register）来保存多个仓库，每个仓库又可以包含多个具备不同tag的镜像。
Docker运行中使用的默认仓库是 Docker Hub 公共仓库。

二.docker hub:

1.登陆docker-hub，新建公共仓库

2.登陆后上传镜像

[root@server1 ~]# docker login
[root@server1 ~]# docker tag mario:latest sgoooua/mario:latest
[root@server1 ~]# docker push sgoooua/mario:latest

3.从仓库拉取镜像

[root@server1 ~]# docker pull sgoooua/mario:latest

4.删除镜像

[root@server1 ~]# docker rmi sgoooua/mario:latest

三.搭建私有仓库：

1.下载registry镜像,并运行容器：

[root@server1 ~]# docker pull registry
Using default tag: latest
latest: Pulling from library/registry
cbdbe7a5bc2a: Pull complete 
47112e65547d: Pull complete 
46bcb632e506: Pull complete 
c1cc712bcecd: Pull complete 
3db6272dcbfa: Pull complete 
Digest: sha256:8be26f81ffea54106bae012c6f349df70f4d5e7e2ec01b143c46e2c03b9e551d
Status: Downloaded newer image for registry:latest
docker.io/library/registry:latest
[root@server1 ~]# docker run -d -p 443:443 --restart=always --name registry -v /opt/registry:/var/lib/registry -v /root/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key registry
50d49a18ac734dcd49c3c63daac7577a8161646f5f2329f40e3c7a655fdbfd88

2.上传镜像到本地仓库：

docker tag nginx:latest localhost:443/nginx:latest
docker push localhost:443/nginx:latest

3.为docker仓库添加证书加密功能

（1）生成证书

[root@server1 ~]# mkdir certs
[root@server1 ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/westos.org.key -x509 -days 365 -out certs/westos.org.crt
Generating a 4096 bit RSA private key
....................................++
...............++
writing new private key to 'certs/westos.org.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:shaanxi
Locality Name (eg, city) [Default City]:xi'an
Organization Name (eg, company) [Default Company Ltd]:westos
Organizational Unit Name (eg, section) []:linux
Common Name (eg, your name or your server's hostname) []:westos.org
Email Address []:root@westos.org
[root@server1 ~]# ls certs
westos.org.crt  westos.org.key

4.重建容器

[root@server1 ~]# docker run -d   --restart=always   --name registry   -v /root/certs:/certs   -e REGISTRY_HTTP_ADDR=0.0.0.0:443   -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt   -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key   -p 443:443   registry
142b93bce5765c0765f8819abb7b4c5f19ef808324b8619f059cc5deb1d5cae6
[root@server1 ~]# docker port registry
443/tcp -> 0.0.0.0:443
[root@server1 ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                            NAMES
50d49a18ac73        registry            "/entrypoint.sh /etc…"   4 seconds ago       Up 4 seconds        0.0.0.0:443->443/tcp, 5000/tcp   registry

5.拷贝证书到docker主机

[root@server1 ~]# cd /etc/docker
[root@server1 docker]# mkdir -p certs.d/westos.org
[root@server1 docker]# cd certs.d/
[root@server1 certs.d]# cd westos.org/
[root@server1 westos.org]# cp /root/certs/westos.org.crt .
[root@server1 westos.org]# mv westos.org.crt ca.crt
[root@server1 docker]# scp -r certs.d/ root@172.25.13.2:/etc/docker/
root@172.25.13.2's password: 
ca.crt                                    100% 2098     2.4MB/s   00:00   

6 .测试上传镜像

[root@server1 ~]# docker tag nginx:1.16.1 westos.org/nginx
[root@server1 ~]# docker push westos.org/nginx
The push refers to repository [westos.org/nginx]
c23548ea0b99: Pushed 
82068c842707: Pushed 
c2adabaecedb: Pushed 
latest: digest: sha256:2963fc49cc50883ba9af25f977a9997ff9af06b45c12d968b7985dc1e9254e4b size: 948

###可以从私有仓库拉取
[root@server1 ~]# docker pull westos.org/nginx
Using default tag: latest
latest: Pulling from nginx
Digest: sha256:2963fc49cc50883ba9af25f977a9997ff9af06b45c12d968b7985dc1e9254e4b
Status: Image is up to date for westos.org/nginx:latest
westos.org/nginx:latest

7.添加用户认证功能

（1）生成用户密码文件

[root@server1 ~]# mkdir auth

###无法为admin用户添加密码
[root@server1 ~]# docker run --rm --entrypoint htpasswd registry Bbn admin westos > auth/htpasswd
docker: Error response from daemon: OCI runtime create failed: container_linux.go:349: starting container process caused "exec: \"htpasswd\": executable file not found in $PATH": unknown.
ERRO[0000] error waiting for container: context canceled 

###下载该软件包
[root@server1 ~]# yum install httpd-tools
[root@server1 ~]# cd auth
[root@server1 auth]# ls
htpasswd

###添加用户密码
[root@server1 auth]# htpasswd -B htpasswd admin
New password: 
Re-type new password: 
Adding password for user admin
[root@server1 auth]# cat htpasswd
admin:$2y$05$ctPip/ZU/ck0g72sQD31w.cNjkg3pS8w5ZioL7owGUCTZCbsGBnZW
[root@server1 auth]# htpasswd -B htpasswd lj
New password: 
Re-type new password: 
Adding password for user lj

###查看密码文件
[root@server1 auth]# cat htpasswd
admin:$2y$05$ctPip/ZU/ck0g72sQD31w.cNjkg3pS8w5ZioL7owGUCTZCbsGBnZW
lj:$2y$05$w1w4RFGNMr0jR2TvEOSrseTwB4nmR9ydqYY50j6Pch2sBOmkfkmP

8.重建容器

[root@server1 auth]# docker run -d -p 443:443 --restart=always --name registry -v /opt/registry:/var/lib/registry -v /root/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/westos.org.crt -e REGISTRY_HTTP_TLS_KEY=/certs/westos.org.key -v /root/auth:/auth -e REGISTRY_AUTH=htpasswd -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry
f62d6ead8a8952d33f0b100afab363b24e483a8e89109cef3112a25fc4ac5b17

9.docker主机认证

[root@server2 ~]# docker login westos.org
Username: admin 
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

四.harbor仓库

1.解压软件包,建立数据目录

[root@server1 ~]# tar zxf harbor-offline-installer-v1.10.1.tgz
[root@server1 ~]# mkdir /data
[root@server1 ~]# mv certs/ /data/

2.修改配置文件

[root@server1 ~]# cd harbor/
[root@server1 harbor]# vim harbor.yml 

3.运行脚本，安装harbor

[root@server1 ~]# mv docker-compose-Linux-x86_64-1.24.1 /usr/local/bin/docker-compose
[root@server1 ~]# chmod +x /usr/local/bin/docker-compose 
[root@server1 ~]# cd harbor/
[root@server1 harbor]# ./install.sh 

[root@server2 ~]# docker login westos.org
Username: admin 
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
[root@server2 ~]# cd /etc/docker/
[root@server2 docker]# ls
certs.d  daemon.json  key.json
[root@server2 docker]# vim daemon.json 
[root@server2 docker]# cat daemon.json 
{
  "registry-mirrors": ["https://westos.org"]
}
[root@server2 docker]# systemctl daemon-reload 
[root@server2 docker]# systemctl restart docker

4.登陆harbor，创建仓库，添加项目维护成员

（1）登陆

（2）新建仓库

（3）添加用户

5.测试上传镜像

[root@server1 ~]# docker tag nginx:latest westos.org/library/nginx:latest
[root@server1 ~]# docker push westos.org/library/nginx:latest 
The push refers to repository [westos.org/library/nginx]
cdd1d8ebeb06: Pushed 
fe08d9d9f185: Pushed 
280ddd108a0a: Pushed 
f14cffae5c1a: Pushed 
d0fe97fa8b8c: Pushed 
latest: digest: sha256:4949aa7259aa6f827450207db5ad94cabaa9248277c6d736d5e1975d200c7e43 size: 1362

[root@server2 ~]# docker load -i game2048.tar 
011b303988d2: Loading layer   5.05MB/5.05MB
36e9226e74f8: Loading layer  51.46MB/51.46MB
192e9fad2abc: Loading layer  3.584kB/3.584kB
6d7504772167: Loading layer  4.608kB/4.608kB
88fca8ae768a: Loading layer  629.8kB/629.8kB
Loaded image: game2048:latest
[root@server2 ~]# docker tag game2048:latest westos.org/westos/game2048:latest
[root@server2 ~]# docker push westos.org/westos/game2048:latest
The push refers to repository [westos.org/westos/game2048]
88fca8ae768a: Pushed 
6d7504772167: Pushed 
192e9fad2abc: Pushed 
36e9226e74f8: Pushed 
011b303988d2: Pushed 
latest: digest: sha256:8a34fb9cb168c420604b6e5d32ca6d412cb0d533a826b313b190535c03fe9390 size: 1364
[root@server2 ~]# docker pull westos.org/westos/game2048
Using default tag: latest
latest: Pulling from westos/game2048
Digest: sha256:8a34fb9cb168c420604b6e5d32ca6d412cb0d533a826b313b190535c03fe9390
Status: Image is up to date for westos.org/westos/game2048:latest
westos.org/westos/game2048:latest