Docker 私有Registry

硬件要求：

軟件要求：

安裝步驟：

1. Download the installer;
2. Configure harbor.yml;
3. Run install.sh to install and start Harbor;

下載完之后，先解壓：

[root@Harbor ~]# tar xvf harbor-offline-installer-v1.8.1.tar -C /opt
harbor/harbor.v1.8.1.tar.gz
harbor/prepare
harbor/LICENSE
harbor/install.sh
harbor/harbor.yml
[root@Harbor ~]# 

下載的文件在解壓后就不需要了。解壓后的文件在安裝完成后也都是不需要的。所以下載到哪里，解壓到哪里其實(shí)都不重要。建議可以解壓到 /opt 或 /usr/local 這兩個(gè)目錄里。

安裝包中的鏡像
解壓后的文件中，有一個(gè)文件harbor.v1.8.1.tar.gz。這個(gè)是被導(dǎo)出的docker鏡像。還記得docker save命令吧，可以打包導(dǎo)出多個(gè)鏡像并完成壓縮：

$ docker save myimg/httpd:v1 myimg/httpd:v2 | gzip > myimage_latest.tar.gz

這個(gè)文件應(yīng)該就是這么來(lái)的。之后的安裝過(guò)程中，則是會(huì)把這個(gè)文件里的所有鏡像做一次批量導(dǎo)入：

$ docker load -i myimage_latest.tar.gz

在安裝時(shí)執(zhí)行的install.sh腳本里有解壓并導(dǎo)入鏡像的語(yǔ)句：

if [ -f harbor*.tar.gz ]
then
        h3 "[Step $item]: loading Harbor images ..."; let item+=1
        docker load -i ./harbor*.tar.gz
fi

安裝的依賴(lài)和過(guò)程
Harbor的安裝，就是給當(dāng)前的主機(jī)安裝很多容器，并且把這些容器都啟動(dòng)起來(lái)。啟動(dòng)Harbor就是用docker-compose把這些容器的啟動(dòng)起來(lái)，而關(guān)閉harbor也是通過(guò)docker-compose來(lái)把容器一次關(guān)閉。之所以需要借助docker-compose，因?yàn)閔arbor是由很多容器協(xié)同過(guò)程的，容器之間又依賴(lài)關(guān)系，這些都需要docker-compose這個(gè)單機(jī)編排工具來(lái)協(xié)調(diào)。

所以安裝harbor前，需要安裝好docker-compose，才能實(shí)現(xiàn)本地的容器的編排。需要安裝好docker，才能把本地的鏡像啟動(dòng)起來(lái)。鏡像就在下載解壓的文件中。并且還需要啟動(dòng)docker，這樣才能運(yùn)行容器。
準(zhǔn)備工作完成后，就是執(zhí)行harbor準(zhǔn)備的install.sh腳本，在本地加載好鏡像，通過(guò)docker-compose把這些鏡像依次啟動(dòng)起來(lái)，并且運(yùn)行在本地的docker上。

修改harbor.yml配置文件，主機(jī)名一定看改掉，最好使用本機(jī)的域名，如果沒(méi)有域名那么就用本機(jī)的IP地址。沒(méi)改的話，會(huì)有如下的錯(cuò)誤提示：

[root@Harbor harbor]# ./install.sh 
? Please set hostname and other necessary attributes in harbor.yml first. DO NOT use localhost or 127.0.0.1 for hostname, because Harbor needs to be accessed by external clients.
Please set --with-notary if needs enable Notary in Harbor, and set ui_url_protocol/ssl_cert/ssl_cert_key in harbor.yml bacause notary must run under https. 
Please set --with-clair if needs enable Clair in Harbor
Please set --with-chartmuseum if needs enable Chartmuseum in Harbor
[root@Harbor harbor]# 

檢查發(fā)現(xiàn)沒(méi)有安裝docker：

[root@Harbor harbor]# ./install.sh 

[Step 0]: checking installation environment ...
? Need to install docker(17.06.0+) first and run this script again.
[root@Harbor harbor]# 

檢查發(fā)現(xiàn)沒(méi)有安裝docker-compose：

[root@Harbor harbor]# ./install.sh 

[Step 0]: checking installation environment ...

Note: docker version: 19.03.1
? Need to install docker-compose(1.18.0+) by yourself first and run this script again.
[root@Harbor harbor]# 

檢查發(fā)現(xiàn)docker沒(méi)有啟動(dòng)：

[root@Harbor harbor]# ./install.sh 

[Step 0]: checking installation environment ...

Note: docker version: 19.03.1

Note: docker-compose version: 1.18.0

[Step 1]: loading Harbor images ...
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
[root@Harbor harbor]# 

Docker Compose

Docker的單機(jī)編排工具。官方文檔：
https://docs.docker.com/compose/

為了簡(jiǎn)化harbor的安裝和部署，所以harbor做成了在容器中運(yùn)行的應(yīng)用。但是harbor的運(yùn)行還依賴(lài)很多其他的應(yīng)用，所以需要編排幾個(gè)容器來(lái)協(xié)同工作。所以harbor的部署和使用時(shí)需要借助Docker的單機(jī)編排工具Docker Compose。

安裝docker-compose，位于epel源中：

yum install docker-compose

Compose模板文件
模板文件是使用Compose的核心，設(shè)計(jì)的指令關(guān)鍵字也有很多，默認(rèn)的模板文件名稱(chēng)為docker-compose.yml，格式為YAML格式。
這個(gè)不是重點(diǎn)，能安裝使用harbor就好了，不過(guò)還是簡(jiǎn)單了解一下。
要使用docker-compose就要寫(xiě)一個(gè)編排腳本，和dockerfile類(lèi)似，也是有很多指令。定義要啟動(dòng)的每一個(gè)容器，指明依賴(lài)關(guān)系，這樣被依賴(lài)的容器需要先啟動(dòng)。關(guān)閉容器的時(shí)候也要對(duì)稱(chēng)，先把沒(méi)有被依賴(lài)的容器關(guān)閉掉。
順便就來(lái)看下harbor的docker-compose.yml文件：

[root@Harbor harbor]# cat docker-compose.yml 
version: '2.3'  # docker-compose的版本
services:  # 定義一個(gè)服務(wù)
  log:  # 服務(wù)的名稱(chēng)，服務(wù)是通過(guò)容器來(lái)提供的，具體就是下面的設(shè)置
    image: goharbor/harbor-log:v1.8.1  # 指定容器的鏡像，也可以用build指令通過(guò)dockerfile創(chuàng)建
    container_name: harbor-log  # 生成的容器的名稱(chēng)
    restart: always  # 容器自動(dòng)重啟
    dns_search: .
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - SETGID
      - SETUID
    volumes:  # 定義卷
      - /var/log/harbor/:/var/log/docker/:z
      - ./common/config/log/:/etc/logrotate.d/:z
    ports:
      - 127.0.0.1:1514:10514
    networks:  # 加入的網(wǎng)絡(luò)
      - harbor
  registry:
    image: goharbor/registry-photon:v2.7.1-patch-2819-v1.8.1
    container_name: registry
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    volumes:
      - /data/registry:/storage:z
      - ./common/config/registry/:/etc/registry/:z
      - type: bind
        source: /data/secret/registry/root.crt
        target: /etc/registry/root.crt
    networks:
      - harbor
    dns_search: .
    depends_on:  # 依賴(lài)的容器名稱(chēng)
      - log
    logging:
      driver: "syslog"
      options:  
        syslog-address: "tcp://127.0.0.1:1514"
        tag: "registry"
  registryctl:
    image: goharbor/harbor-registryctl:v1.8.1
    container_name: registryctl
    env_file:
      - ./common/config/registryctl/env
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    volumes:
      - /data/registry:/storage:z
      - ./common/config/registry/:/etc/registry/:z
      - type: bind
        source: ./common/config/registryctl/config.yml
        target: /etc/registryctl/config.yml
    networks:
      - harbor
    dns_search: .
    depends_on:
      - log
    logging:
      driver: "syslog"
      options:  
        syslog-address: "tcp://127.0.0.1:1514"
        tag: "registryctl"
  postgresql:
    image: goharbor/harbor-db:v1.8.1
    container_name: harbor-db
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - SETGID
      - SETUID
    volumes:
      - /data/database:/var/lib/postgresql/data:z
    networks:
      harbor:
    dns_search: .
    env_file:
      - ./common/config/db/env
    depends_on:
      - log
    logging:
      driver: "syslog"
      options:  
        syslog-address: "tcp://127.0.0.1:1514"
        tag: "postgresql"
  core:
    image: goharbor/harbor-core:v1.8.1
    container_name: harbor-core
    env_file:
      - ./common/config/core/env
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
    volumes:
      - /data/ca_download/:/etc/core/ca/:z
      - /data/psc/:/etc/core/token/:z
      - /data/:/data/:z
      - ./common/config/core/certificates/:/etc/core/certificates/:z
      - type: bind
        source: ./common/config/core/app.conf
        target: /etc/core/app.conf
      - type: bind
        source: /data/secret/core/private_key.pem
        target: /etc/core/private_key.pem
      - type: bind
        source: /data/secret/keys/secretkey
        target: /etc/core/key
    networks:
      harbor:
    dns_search: .
    depends_on:
      - log
      - registry
    logging:
      driver: "syslog"
      options:  
        syslog-address: "tcp://127.0.0.1:1514"
        tag: "core"
  portal:
    image: goharbor/harbor-portal:v1.8.1
    container_name: harbor-portal
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - NET_BIND_SERVICE
    networks:
      - harbor
    dns_search: .
    depends_on:
      - log
      - core
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://127.0.0.1:1514"
        tag: "portal"

  jobservice:
    image: goharbor/harbor-jobservice:v1.8.1
    container_name: harbor-jobservice
    env_file:
      - ./common/config/jobservice/env
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    volumes:
      - /data/job_logs:/var/log/jobs:z
      - type: bind
        source: ./common/config/jobservice/config.yml
        target: /etc/jobservice/config.yml
    networks:
      - harbor
    dns_search: .
    depends_on:
      - redis
      - core
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://127.0.0.1:1514"
        tag: "jobservice"
  redis:
    image: goharbor/redis-photon:v1.8.1
    container_name: redis
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    volumes:
      - /data/redis:/var/lib/redis
    networks:
      harbor:
    dns_search: .
    depends_on:
      - log
    logging:
      driver: "syslog"
      options:
        syslog-address: "tcp://127.0.0.1:1514"
        tag: "redis"
  proxy:
    image: goharbor/nginx-photon:v1.8.1
    container_name: nginx
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      - NET_BIND_SERVICE
    volumes:
      - ./common/config/nginx:/etc/nginx:z
    networks:
      - harbor
    dns_search: .
    ports:
      - 80:80
    depends_on:
      - postgresql
      - registry
      - core
      - portal
      - log
    logging:
      driver: "syslog"
      options:  
        syslog-address: "tcp://127.0.0.1:1514"
        tag: "proxy"
networks:
  harbor:
    external: false
[root@Harbor harbor]# 

安裝 Harbor

安裝前，需要去修改一下harbor.yml這個(gè)文件的配置，至少要把主機(jī)名改掉，之前已經(jīng)說(shuō)過(guò)了。其他配置按需要修改，不改也能夠安裝了。

一切準(zhǔn)備就行，就可以安裝了：

[root@Harbor harbor]# ./install.sh 

[Step 0]: checking installation environment ...

Note: docker version: 19.03.1

Note: docker-compose version: 1.18.0

[Step 1]: loading Harbor images ...
ba58b7bb3f17: Loading layer  33.32MB/33.32MB
......略過(guò)......
Loaded image: goharbor/clair-photon:v2.0.8-v1.8.1

[Step 2]: preparing environment ...
prepare base dir is set to /opt/harbor
Generated configuration file: /config/log/logrotate.conf
......略過(guò)......
Generated certificate, key file: /secret/core/private_key.pem, cert file: /secreCreating harbor-log ... done
Generated configuration file: /compose_location/docker-compose.yml
Clean up the input dir

Creating registry ... done
Creating harbor-core ... done
[Step 3]: starting Harbor ...
Creating harbor-portal ... done
Creating nginx ... done
Creating harbor-db ... 
Creating redis ... 
Creating registryctl ... 
Creating registry ... 
Creating harbor-core ... 
Creating harbor-portal ... 
Creating harbor-jobservice ... 
Creating nginx ... 

? ----Harbor has been installed and started successfully.----

Now you should be able to visit the admin portal at http://HarborStudy. 
For more details, please visit https://github.com/goharbor/harbor .

[root@Harbor harbor]# 

安裝成功，可以看看監(jiān)聽(tīng)的端口，安裝了哪些鏡像，啟動(dòng)了哪些容器：

$ ss -tnl
$ docker images
$ docker ps

登錄 Harbor

默認(rèn)的密碼在harbor.yml有設(shè)置的：

harbor_admin_password: Harbor12345

用戶(hù)名是admin，密碼沒(méi)改的話就是默認(rèn)的，可以登錄進(jìn)去。

使用瀏覽器訪問(wèn)Web頁(yè)面，可以看到一些管理界面。
另外要上傳或下載鏡像，需要在命令行使用docker命令，在那之前也需要登錄Harbor，使用docker login命令來(lái)完成登錄：

[root@Harbor harbor]# docker login localhost
Username: admin
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
[root@Harbor harbor]# 

登錄成功之后，才能推送鏡像。

停止 Harbor

要想停止或啟動(dòng)harbor，需要通過(guò)docker-compose命令。
在操作之前，最好先切換目錄到要操作的docker-compose.yml所在的目錄，這樣docker-compose能夠自動(dòng)找到模板文件并進(jìn)行操作。
停止harbor：

[root@Harbor harbor]# cd /opt/harbor/
[root@Harbor harbor]# docker-compose stop
Stopping nginx             ... done
Stopping harbor-portal     ... done
Stopping harbor-jobservice ... done
Stopping harbor-core       ... done
Stopping registryctl       ... done
Stopping harbor-db         ... done
Stopping registry          ... done
Stopping redis             ... done
Stopping harbor-log        ... done
[root@Harbor harbor]# 

然后再次啟動(dòng)：

[root@Harbor harbor]# docker-compose start
Starting log         ... done
Starting registry    ... done
Starting registryctl ... done
Starting postgresql  ... done
Starting core        ... done
Starting portal      ... done
Starting redis       ... done
Starting jobservice  ... done
Starting proxy       ... done
[root@Harbor harbor]#