Public Repository

Last pushed: 10 months ago
Short Description
Baidu BOS storage driver 基于官方 Docker Registry 源码,结合百度云 Go 语言SDK,提供了一个针对百度云 BOS 的 Storage Driver。
Full Description

基于百度云 BOS 搭建私有 Docker Registry

Docker Registry 作为 Docker 的核心组件之一负责了镜像的存储以及分发。用户只需要使用 Docker 的客户端就可以直接和 Registry 进行交互,下载和上传镜像。

百度对象存储 BOS (Baidu Object Storage) 提供稳定、安全、高效以及高扩展存储服务。

Baidu BOS storage driver 基于官方 Docker Registry 源码,结合百度云 Go 语言SDK:https://github.com/guoyao/baidubce-sdk-go.git,通过实现 storagedriver.StorageDriver 接口,提供了一个针对百度云 BOS 的 Storage Driver。

准备工作

部署私有 Docker Registry

  • 为 Registry 相关的配置新建一个单独的目录

    mkdir registry && cd registry
    
  • 在当前目录下新建我们的账户密码(最简单的账户验证方式)

    mkdir auth
    htpasswd -Bbn admin 123456 > auth/htpasswd
    
  • 启动 Registry

    docker run -d \
               -v `pwd`/auth:/auth:ro \
               -e REGISTRY_AUTH=htpasswd \
               -e REGISTRY_AUTH_HTPASSWD_REALM=basic-realm \
               -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
               -e REGISTRY_STORAGE=bos \
               -e REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK \
               -e REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK \
               -e REGISTRY_STORAGE_BOS_REGION=bj \
               -e REGISTRY_STORAGE_BOS_BUCKET=registry-test \
               -p 5000:5000 \
               --restart=always \
               guoyao/registry:0.6.0
    

    详细的 BOS STORAGE 的配置文档在这里: https://github.com/guoyao/distribution/blob/release/0.6/docs/storage-drivers/bos.md

  • 操作镜像

    Login

    docker login localhost:5000
    

    根据命令行提示输入之前设置的用户名:admin,密码:123456;登录成功会提示:Login Succeeded

    Push

    首先通过 Dockerfile 生成一个镜像,或者修改一个已有镜像的 tag,比如:localhost:5000/busybox

    docker push localhost:5000/busybox
    

    推送成功后就可以在百度云 BOS 控制台查看到这个镜像了

    Pull

    docker pull localhost:5000/busybox
    

上述方式只能通过 localhost 来 push 和 pull 镜像,如果想通过公网 域名IP,需要配置 --insecure-registry xxx.xxx.xxx.xxx 到 Docker Deamon 的启动参数中,并重启 Docker Deamon,否则会报错:

Error response from daemon: Get https://xxx.xxx.xxx.xxx:5000/v1/users/: http: server gave HTTP response to HTTPS client

通过域名访问 & 配置https证书

如果不希望配置 --insecure-registry 参数,你需要购买一个独立的域名(假设为 myregistrydomain.com),并且申请该域名的 https 证书,将证书 xxx.crt 和 xxx.key 文件放在当前 certs 子目录下,然后在启动 Registry 时,配置证书:

docker run -d \
           -v `pwd`/auth:/auth:ro \
           -e REGISTRY_AUTH=htpasswd \
           -e REGISTRY_AUTH_HTPASSWD_REALM=basic-realm \
           -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
           -v `pwd`/certs:/certs:ro \
           -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/xxx.crt \
           -e REGISTRY_HTTP_TLS_KEY=/certs/xxx.key \
           -e REGISTRY_STORAGE=bos \
           -e REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK \
           -e REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK \
           -e REGISTRY_STORAGE_BOS_REGION=bj \
           -e REGISTRY_STORAGE_BOS_BUCKET=registry-test \
           -p 443:5000 \
           --restart=always \
           guoyao/registry:0.6.0

既然已经使用 https 证书了,我们把对外暴露的端口换成 443 端口,然后就可以直接通过域名来操作镜像了:

docker login myregistrydomain.com
docker push myregistrydomain.com/busybox
docker pull myregistrydomain.com/busybox

更多关于部署 Registry 的内容,可以参考官方文档:https://docs.docker.com/registry/deploying/

配置 Nginx 代理访问

因为要启动多个容器,这里我们使用 docker-compose 来做容器编排,首先安装 docker-compose(需要使用 root 用户来安装),安装方式如下:

curl -L https://github.com/docker/compose/releases/download/1.10.1/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose

chmod +x /usr/local/bin/docker-compose
  • 创建 nginx 主配置文件
cat > auth/nginx.conf << 'EOF'
events {
    worker_connections  1024;
}

http {

  upstream docker-registry {
    server registry:5000;
  }

  ## Set a variable to help us decide if we need to add the
  ## 'Docker-Distribution-Api-Version' header.
  ## The registry always sets this header.
  ## In the case of nginx performing auth, the header will be unset
  ## since nginx is auth-ing before proxying.
  map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
    '' 'registry/2.0';
  }

  server {
    listen 443 ssl;
    server_name myregistrydomain.com;

    # SSL
    ssl_certificate /certs/xxx.crt;
    ssl_certificate_key /certs/xxx.key;

    # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    # disable any limits to avoid HTTP 413 for large image uploads
    client_max_body_size 0;

    # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
    chunked_transfer_encoding on;

    location /v2/ {
      # Do not allow connections from docker 1.5 and earlier
      # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
      if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
        return 404;
      }

      # To add basic authentication to v2 use auth_basic setting.
      auth_basic "Registry realm";
      auth_basic_user_file /etc/nginx/conf.d/htpasswd;

      ## If $docker_distribution_api_version is empty, the header will not be added.
      ## See the map directive above where this variable is defined.
      add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;

      proxy_pass                          http://docker-registry;
      proxy_set_header  Host              $http_host;   # required for docker client's sake
      proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
      proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header  X-Forwarded-Proto $scheme;
      proxy_read_timeout                  900;
    }
  }
}
EOF
  • 创建 docker-compose.yml 文件
nginx:
  image: nginx:1.9
  ports:
    - 443:443
  links:
    - registry:registry
  volumes:
    - ./auth:/etc/nginx/conf.d:ro
    - ./auth/nginx.conf:/etc/nginx/nginx.conf:ro
    - ./certs:/certs:ro

registry:
  image: guoyao/registry:0.6.0
  environment:
    - REGISTRY_STORAGE=bos
    - REGISTRY_STORAGE_BOS_ACCESSKEYID=Your_AK
    - REGISTRY_STORAGE_BOS_ACCESSKEYSECRET=Your_SK
    - REGISTRY_STORAGE_BOS_REGION=bj
    - REGISTRY_STORAGE_BOS_BUCKET=registry-test
  • 启动容器
docker-compose up -d

更多关于配置 Nginx 代理访问 Registry 的内容,可以参考官方文档:https://docs.docker.com/registry/recipes/nginx/

Docker Pull Command
Owner
guoyao