摘要
随着docker使用的镜像越来越多，就需要有一个保存镜像的地方，这就是仓库。目前常用的两种仓库：公共仓库和私有仓库。最方便的就是使用公共仓库上传和下载，下载公共仓库的镜像是不需要注册的，但是上传时，是需要注册的。私有仓库最常用的就是Registry、Harbor两种，那接下来详细介绍如何搭建registry私有仓库。
一、环境准备两台CentOS7.4，一台为Docker私有仓库；另一台为Docker客户端，测试使用；
二、配置registry私有仓库#
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p
net.ipv4.ip_forward = 1
vim /etc/docker/daemon.json
{"registry-mirrors":["https://6kx4zyno.mirror.aliyuncs.com"]}
systemctl reload docker
docker search registry
docker pull registry
docker run -d -p 5000:5000 --name registry --restart=always -v /opt/registry:/var/lib/registry registry
docker ps
docker images
vim /etc/docker/daemon.json
{"registry-mirrors":["https://6kx4zyno.mirror.aliyuncs.com"],
"insecure-registries":["192.168.100.10:5000"]
}
systemctl reload docker
docker info
# 给镜像打标签
docker tag mysql 192.168.25.140:5000/mysql
# 上传的镜像
docker push 192.168.25.140:5000/mysql
vim /etc/docker/daemon.json
{"registry-mirrors":["https://6kx4zyno.mirror.aliyuncs.com"],
"insecure-registries":["192.168.100.10:5000"]
}
systemctl restart docker
docker pull 192.168.25.140:5000/mysql
docker images 
但是现在存在一个问题，如果这也部署的话企业内部所有人员皆可访问我们的私有仓库，为了安全起见，接下来为registry添加一个身份验证，只有通过了身份验证才可以上传或者下载私有仓库中的镜像。
yum -y install httpd-tools
mkdir /opt/registry-auth
htpasswd -Bbn bob pwd@123 > /opt/registry-auth/htpasswd
docker run -d -p 5000:5000 --restart=always \
-v /opt/registry-auth/:/auth/ \
-v /opt/registry:/var/lib/registry --name registry-auth -e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" registry
docker tag tomcat:latest 192.168.100.10:5000/image/tomcat:1.0
docker push 192.168.100.10:5000/image/tomcat:1.0
no basic auth credentials
docker login 192.168.100.10:5000
Username: bob
Password:
docker push 192.168.100.10:5000/image/tomcat:1.0
docker pull 192.168.100.10:5000/image/tomcat:1.0
Error response from daemon: Get http://192.168.100.10:5000/v2/image/tomcat/manifests/1.0: no basic auth credentials
docker login 192.168.100.10:5000
Username: bob
Password:
docker pull 192.168.100.10:5000/image/tomcat:1.0
docker images 修改tag (以hello-world为例)
拉取镜像
docker pull hello-world
修改镜像
docker tag hello-world hub.test.com:5000/hello-world:1.0
上传、删除、再下载镜像，删除后能下载成功
docker images
docker push hub.test.com:5000/hello-world:1.0
docker rmi hub.test.com:5000/hello-world:1.0
docker images
docker pull hub.test.com:5000/hello-world:1.0
docker images查看仓库镜像
curl hub.test.com:5000/v2/_catalogregistry开启删除
#查看默认配置
docker exec -it registry sh -c 'cat /etc/docker/registry/config.yml'
#开启删除(添加 delete: enabled: true)
docker exec -it registry sh -c "sed -i '/storage:/a\ delete:' /etc/docker/registry/config.yml"
docker exec -it registry sh -c "sed -i '/delete:/a\ enabled: true' /etc/docker/registry/config.yml"
#重启
docker restart registry查询、删除镜像
#查询镜像
curl /v2/_catalog
#查询镜像tag(版本)
curl /v2//tags/list
#删除镜像API
curl -I -X DELETE "/v2//manifests/"
#获取镜像digest_hash
curl /v2//manifests/ \
--header "Accept: application/vnd.docker.distribution.manifest.v2+json"为了保证的仓库的高可用，利用的docker registry构建多个镜像仓库。但是docker registry好像是没有提供各个仓库之间镜像构建的功能。因此如果你自己需要做docker registry集群构建的相关工具，这里提供一个思路给你参考，帮助你实现docker registry集群构建。
- 首先获取到源 Registry 里的所有镜像列表
- 然后逐个获取镜像的 tags
- 然后依次遍历将对应的镜像拉到本地，然后 docker tag 一下，命名为新的 registry 镜像名称
- 然后 push docker 镜像到新的 registry
- 删除下载到本地的镜像和推送到新的 registry 的镜像、
这里提供一个powershell脚本供大家参考
# variables
$srcRegUser = "xxx"
$srcRegPwd = "111111"
$srcRegHost = "xxx.azurecr.cn"
$destRegUser = "yyy"
$destRegPwd = "222"
$destRegHost = "registry.xxx.com"
# get repositories from source registry
# httpie
$response = (http -b -a "${srcRegUser}:${srcRegPwd}" "https://${srcRegHost}/v2/_catalog") | ConvertFrom-Json
# curl
#$response = (curl -u "${srcRegUser}:${srcRegPwd}" "https://${srcRegHost}/v2/_catalog") | ConvertFrom-Json
# repository
$repositories = $response.repositories
#
Write-Host $repositories
# login source registry
docker login $srcRegHost -u $srcRegUser -p $srcRegPwd
# login dest registry
docker login $destRegHost -u $destRegUser -p $destRegPwd
# sync
foreach($repo in $repositories)
{
Write-Host "sync $repo begin"
$srcTag = "${srcRegHost}/${repo}:latest"
$destTag = "${destRegHost}/${repo}:latest"
Write-Host "source image tag: $srcTag"
Write-Host "dest image tag $destTag"
Write-Host "docker pull $srcTag begin"
docker pull $srcTag
Write-Host "docker pull $srcTag completed"
Write-Host "docker tag $srcTag $destTag ing"
docker tag $srcTag $destTag
Write-Host "docker push $destTag begin"
docker push $destTag
Write-Host "docker push $destTag completed"
Write-Host "docker rmi $srcTag $destTag begin"
docker rmi $srcTag $destTag
Write-Host "docker rmi $srcTag $destTag end"
Write-Host "sync $repo completed"
}
Write-Host "Completed..."
阿里云好像有一个镜像同步工具，GitHub - AliyunContainerService/image-syncer: Docker image synchronization tool for Docker Registry V2 based services image-syncer 是一个docker镜像同步工具，可用来进行多对多的镜像仓库同步，支持目前绝大多数主流的docker镜像仓库服务，看介绍还是很棒的，有需要 registry 之间同步镜像的可以试试这个工具，看介绍这个工具不会拉取到本地磁盘，从源 registry 获取镜像数据之后直接就推送到新的 registry 里了，效率会高很多。
在了解以上前提后,开始排查哪些registry repo的历史镜像较多(分层数量多)。1.从宿主机进入docker registry容器内部,使用registry GC分析命令查看分层情况:
# 1.--dry-run选项为layer层级分析,并不实际进行GC
registry garbage-collect --dry-run /etc/docker/registry/config.yml
# 2.可以便捷使用以下命令对分层数较多的镜像做一个排序:
registry garbage-collect --dry-run /etc/docker/registry/config.yml >> res.txt
6ac03183e197:~# cat res.txt | awk -F : '{print $1}' | sort | uniq -c | sort -rn -k1 | head -10 | grep -v "redis\|jdk\|php\|mysql\|nginx\|apache\|zk\|elastic"
134161 zdtest
56101 ordertest
42691 bjdev
35881 zhqtest
13801 systemtest
9601 zddev
9361 bjtest
7411 dsystemtest
505 tooltest
无论是delete方法调用restful接口,还是registry 自带工具的GC清理,都需要registry的配置文件中开启允许删除功能:
vim /etc/docker/registry/config.yml
storage:
delete:
enabled: true
由于数量较多,因此使用python多线程来调用registry restful api进行删除操作,脚本内容如下,可根据自己的场景修改registry url:
import requests
from concurrent.futures import ThreadPoolExecutor
class DockerHub(object):
def __init__(self, hub, repos):
self.hub = hub
self.repos = repos
@staticmethod
def get_tag_list(hub, repo):
# 获取这个repo的所有tags
tag_list_url = '%s/v2/%s/tags/list' % (hub, repo)
r1 = requests.get(url=tag_list_url)
tag_list = r1.json().get('tags')
return tag_list
def main(self):
thpool = ThreadPoolExecutor(10)
for repo in self.repos:
thpool.submit(self.delete_images, repo)
thpool.shutdown(wait=True)
def delete_images(self, repo):
hub = self.hub
tag_list = self.get_tag_list(hub=hub, repo=repo)
num = 0
try:
# 保留最后两个版本的镜像
for tag in tag_list[:-2]:
# 获取image digest摘要信息
get_info_url = '{}/v2/{}/manifests/{}'.format(hub, repo, tag)
header = {"Accept": "application/vnd.docker.distribution.manifest.v2+json"}
r2 = requests.get(url=get_info_url, headers=header, timeout=10)
digest = r2.headers.get('Docker-Content-Digest')
# 删除镜像
delete_url = '%s/v2/%s/manifests/%s' % (hub, repo, digest)
r3 = requests.delete(url=delete_url)
if r3.status_code == 202:
num += 1
except Exception as e:
print(str(e))
print('仓库%s 共删除了%i个历史镜像' % (repo, num))
if __name__ == '__main__':
hub = 'http://registry.xxx.com:5000'
repos = ['zdtest', 'ordertest', 'bjdev', 'zhqtest', 'systemtest', 'zddev', 'bjtest', 'dsystemtest', 'tooltest']
d = DockerHub(hub=hub, repos=repos)
d.main()
回到docker registry容器内,直接运行GC命令,这次不再加 --dry-run选项
registry garbage-collect /etc/docker/registry/config.yml查看磁盘,可以发现磁盘容量已经空闲出许多了,镜像清理及存储空间释放完成!
博文参考https://www.jb51.net/article/187864.htm
安装docker registry - MartinEDM - 博客园
