\u4ee5\u4e0b\u662f\u90e8\u7f72\u79c1\u6709 Docker Registry \u5e76\u5177\u5907\u7528\u6237\u7ba1\u7406\u548c TLS \u529f\u80fd\u7684\u5b8c\u6574\u6b65\u9aa4\uff1a
\n
\n1. \u51c6\u5907\u5de5\u4f5c
\n\u4e00\u53f0\u670d\u52a1\u5668\uff08\u5982 ECS \u5b9e\u4f8b\uff09\u3002
\n\u5b89\u88c5 Docker \u548c Docker Compose\u3002
\n\u786e\u4fdd\u670d\u52a1\u5668\u5f00\u653e\u6240\u9700\u7aef\u53e3\uff08\u5982 5000 \u6216 443\uff09\u3002
\n2. \u521b\u5efa\u7528\u6237\u8ba4\u8bc1\u6587\u4ef6
\n\u4f7f\u7528 htpasswd \u521b\u5efa\u7528\u6237\u8ba4\u8bc1\u6587\u4ef6\uff1a<\/p>\n
htpasswd -Bc registry.password username
\n-B\uff1a\u4f7f\u7528 bcrypt \u52a0\u5bc6\u3002
\n-c\uff1a\u521b\u5efa\u65b0\u6587\u4ef6\uff08\u82e5\u6587\u4ef6\u5df2\u5b58\u5728\u5219\u8986\u76d6\uff09\u3002
\nusername\uff1a\u7528\u6237\u540d\u3002
\n\u6dfb\u52a0\u66f4\u591a\u7528\u6237\u65f6\uff0c\u53bb\u6389 -c \u9009\u9879\uff1a<\/p>\n
htpasswd -B registry.password anotheruser
\n3. \u751f\u6210 TLS \u8bc1\u4e66
\n\u4e3a Registry \u751f\u6210\u81ea\u7b7e\u540d\u8bc1\u4e66\uff1a<\/p>\n
openssl req -newkey rsa:4096 -nodes -sha256 \\ version: ‘3’<\/p>\n services: docker-compose up -d Linux\uff1a 7. \u63a8\u9001\u548c\u62c9\u53d6\u955c\u50cf curl -u username:password https:\/\/ docker logs registry docker run -d \\ \u603b\u7ed3 Markdown 2769 bytes 305 words 146 lines Ln 134, Col 15HTML 1942 characters 239 words 82 paragraphs<\/p>\n","protected":false},"excerpt":{"rendered":" \u4ee5\u4e0b\u662f\u90e8\u7f72\u79c1\u6709 Docker Registry \u5e76\u5177\u5907\u7528\u6237\u7ba1\u7406\u548c TLS \u529f\u80fd\u7684\u5b8c\u6574\u6b65\u9aa4\uff1a<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1556","post","type-post","status-publish","format-standard","hentry","category-unknown"],"_links":{"self":[{"href":"https:\/\/www.liujh168.com\/index.php\/wp-json\/wp\/v2\/posts\/1556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.liujh168.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.liujh168.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.liujh168.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.liujh168.com\/index.php\/wp-json\/wp\/v2\/comments?post=1556"}],"version-history":[{"count":0,"href":"https:\/\/www.liujh168.com\/index.php\/wp-json\/wp\/v2\/posts\/1556\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.liujh168.com\/index.php\/wp-json\/wp\/v2\/media?parent=1556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.liujh168.com\/index.php\/wp-json\/wp\/v2\/categories?post=1556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.liujh168.com\/index.php\/wp-json\/wp\/v2\/tags?post=1556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n -keyout domain.key -x509 -days 365 \\
\n -out domain.crt \\
\n -subj “\/CN=
\n -addext “subjectAltName=IP:
\n\u5c06
\n4. \u521b\u5efa Docker Compose \u6587\u4ef6
\n\u521b\u5efa\u4e00\u4e2a docker-compose.yml \u6587\u4ef6\uff0c\u914d\u7f6e Registry \u670d\u52a1\uff1a<\/p>\n
\n registry:
\n image: registry:2
\n container_name: registry
\n ports:
\n – “5000:5000”
\n environment:
\n REGISTRY_AUTH: htpasswd
\n REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
\n REGISTRY_AUTH_HTPASSWD_PATH: \/auth\/registry.password
\n REGISTRY_HTTP_TLS_CERTIFICATE: \/certs\/domain.crt
\n REGISTRY_HTTP_TLS_KEY: \/certs\/domain.key
\n volumes:
\n – .\/registry-data:\/var\/lib\/registry
\n – .\/certs:\/certs
\n – .\/auth:\/auth
\nregistry-data\uff1a\u5b58\u50a8\u955c\u50cf\u6570\u636e\u7684\u76ee\u5f55\u3002
\ncerts\uff1a\u5b58\u653e TLS \u8bc1\u4e66\u7684\u76ee\u5f55\u3002
\nauth\uff1a\u5b58\u653e\u7528\u6237\u8ba4\u8bc1\u6587\u4ef6\u7684\u76ee\u5f55\u3002
\n5. \u542f\u52a8 Registry \u670d\u52a1
\n\u5728 docker-compose.yml \u6587\u4ef6\u6240\u5728\u76ee\u5f55\u8fd0\u884c\uff1a<\/p>\n
\n6. \u914d\u7f6e Docker \u5ba2\u6237\u7aef
\n\u4fe1\u4efb\u81ea\u7b7e\u540d\u8bc1\u4e66
\n\u5c06 domain.crt \u590d\u5236\u5230 Docker \u5ba2\u6237\u7aef\u7684\u8bc1\u4e66\u76ee\u5f55\uff1a<\/p>\n
\nsudo mkdir -p \/etc\/docker\/certs.d\/
\nsudo cp domain.crt \/etc\/docker\/certs.d\/
\nsudo systemctl restart docker
\nWindows\uff1a
\n\u5c06 domain.crt \u590d\u5236\u5230 C:\\ProgramData\\docker\\certs.d\\
\n\u767b\u5f55 Registry
\ndocker login
\n\u8f93\u5165\u7528\u6237\u540d\u548c\u5bc6\u7801\u540e\uff0c\u5373\u53ef\u767b\u5f55\u3002<\/p>\n
\n\u6807\u8bb0\u955c\u50cf
\ndocker tag my-image
\n\u63a8\u9001\u955c\u50cf
\ndocker push
\n\u62c9\u53d6\u955c\u50cf
\ndocker pull
\n8. \u9a8c\u8bc1\u90e8\u7f72
\n\u67e5\u770b\u955c\u50cf\u76ee\u5f55
\n\u4f7f\u7528 API \u67e5\u770b\u955c\u50cf\u5217\u8868\uff1a<\/p>\n
\n\u67e5\u770b\u65e5\u5fd7
\n\u67e5\u770b Registry \u5bb9\u5668\u65e5\u5fd7\uff1a<\/p>\n
\n9. \u53ef\u9009\uff1a\u90e8\u7f72 Web UI \u5de5\u5177
\n\u90e8\u7f72 Docker Registry UI \u63d0\u4f9b\u56fe\u5f62\u5316\u7ba1\u7406\u754c\u9762\uff1a<\/p>\n
\n -p 8080:80 \\
\n -e REGISTRY_URL=https:\/\/
\n -e REGISTRY_TITLE=”\u79c1\u6709\u4ed3\u5e93” \\
\n –name registry-ui \\
\n joxit\/docker-registry-ui:static
\n\u8bbf\u95ee http:\/\/
\n\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4\uff0c\u4f60\u53ef\u4ee5\u6210\u529f\u90e8\u7f72\u4e00\u4e2a\u5177\u5907\u7528\u6237\u7ba1\u7406\u548c TLS \u52a0\u5bc6\u529f\u80fd\u7684\u79c1\u6709 Docker Registry\uff0c\u5e76\u901a\u8fc7 docker login \u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u3002<\/p>\n