Public | Automated Build

Last pushed: 2 years ago
Short Description
Short description is empty for this repo.
Full Description

docker-nginx-auth-registry

通过nginx对私有仓库的安全认证

1.在宿主机上用htpasswd生成用户名和密码,作为nginx basic auth 的用户名和密码
htpasswd -b -c -d docker-registry.htpasswd kiss test

2.在宿主机上做好https自签名证书(参见https://medium.com/@deeeet/building-private-docker-registry-with-basic-authentication-with-self-signed-certificate-using-it-e6329085e612)
echo 01 > ca.srl

openssl genrsa -des3 -out ca-key.pem 2048

openssl req -new -x509 -days 365 -key ca-key.pem -out ca.pem

openssl genrsa -des3 -out server-key.pem 2048

openssl req -subj /CN=lightningli.co -new -key server-key.pem -out server.csr

openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca-key.pem -out server-cert.pem

We should remove the passphrase from server key:

openssl rsa -in server-key.pem -out server-key.pem

3.用nginx容器中配好https服务
cp docker-registry.htpasswd /etc/nginx/

cp server-cert.pem /etc/ssl/certs/docker-registry

cp server-key.pem /etc/ssl/private/docker-registry

4.编写nginx配置文件(参见 https://github.com/docker/docker-registry/tree/master/contrib/nginx)

cp nginx.conf /etc/nginx

cp nginx.default /etc/nginx/sites-enabled/default

5.将ca证书导入docker宿主机

cat ca.pem >> /etc/ssl/certs/ca-certificates.crt

service docker restart

6.测试

docker run -d --name registry -p 5000:5000 registry

docker run -d --name lknginx --hostname lightningli.co -p 443:443 --link registry:registry
lightningli0504/docker-nginx-auth-registry

docker tag scratch lightningli.co/scratch

记得修改/etc/hosts 添加:
127.0.0.1 lightningli.co

docker login -u kiss -p test lightningli.co

docker push lightningli.co/scratch

Docker Pull Command
Owner
lightningli0504