企业级Docker本地镜像仓库完整指南：Registry与Harbor离线部署全解#

1
# 拉取官方镜像
2
docker pull registry:2
3

4
# 创建数据持久化目录
5
sudo mkdir -p /opt/registry/data
6

7
# 启动容器
8
docker run -d \
9
  -p 5000:5000 \
10
  --name registry \
11
  --restart=always \
12
  -v /opt/registry/data:/var/lib/registry \
13
  registry:2
14

15
# 验证部署
16
curl http://localhost:5000/v2/_catalog
17
# 输出：{"repositories":[]}

1
# 创建完整目录结构
2
sudo mkdir -p /opt/registry/{auth,certs,data}
3

4
# 生成包含IP SAN的自签名证书（解决Docker证书验证问题）
21 collapsed lines
5
sudo tee /opt/registry/certs/openssl.cnf <<-'EOF'
6
[req]
7
default_bits = 4096
8
distinguished_name = req_distinguished_name
9
x509_extensions = v3_req
10
prompt = no
11

12
[req_distinguished_name]
13
C = CN
14
ST = Guangdong
15
L = Foshan
16
O = My Company
17
OU = IT Department
18
CN = 192.168.1.100
19

20
[v3_req]
21
subjectAltName = @alt_names
22
extendedKeyUsage = serverAuth
23
keyUsage = digitalSignature, keyEncipherment
24

25
[alt_names]
26
IP.1 = 192.168.1.100
27
DNS.1 = registry.mycompany.com
28
EOF
29

30
sudo openssl req -x509 -nodes -days 3650 \
31
  -config /opt/registry/certs/openssl.cnf \
32
  -keyout /opt/registry/certs/registry.key \
33
  -out /opt/registry/certs/registry.crt
34

35
# 生成身份认证文件 (默认账号：admin)
36
sudo htpasswd -Bc /opt/registry/auth/htpasswd admin
37

38
# 启动安全加固后的Registry
39
docker run -d \
40
  -p 5000:5000 \
41
  --name registry \
42
  --restart=always \
43
  -v /opt/registry/data:/var/lib/registry \
44
  -v /opt/registry/auth:/auth \
45
  -v /opt/registry/certs:/certs \
46
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \
47
  -e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \
48
  -e REGISTRY_AUTH=htpasswd \
49
  -e REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm" \
50
  -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
51
  -e REGISTRY_STORAGE_DELETE_ENABLED=true \
52
  registry:2

1
# 在所有客户端上配置证书信任
2
sudo mkdir -p /etc/docker/certs.d/192.168.1.100:5000
3
sudo scp user@192.168.1.100:/opt/registry/certs/registry.crt /etc/docker/certs.d/192.168.1.100:5000/ca.crt
4
sudo systemctl restart docker
5

6
# 登录仓库
7
docker login 192.168.1.100:5000
8

9
# 推送镜像
10
docker tag nginx:alpine 192.168.1.100:5000/nginx:alpine
11
docker push 192.168.1.100:5000/nginx:alpine
12

13
# 拉取镜像
14
docker pull 192.168.1.100:5000/nginx:alpine

1
# 停止服务
2
docker stop registry
3

4
# 预览垃圾回收效果
5
docker run --rm \
6
  -v /opt/registry/data:/var/lib/registry \
7
  registry:2 \
8
  garbage-collect --dry-run /etc/docker/registry/config.yml
9

10
# 执行实际垃圾回收
11
docker run --rm \
12
  -v /opt/registry/data:/var/lib/registry \
13
  registry:2 \
14
  garbage-collect /etc/docker/registry/config.yml
15

16
# 重启服务
17
docker start registry

1
# 本文以v2.11.0版本为例
2
wget https://github.com/goharbor/harbor/releases/download/v2.11.0/harbor-offline-installer-v2.11.0.tgz
3

4
# 解压安装包
5
tar xzf harbor-offline-installer-v2.11.0.tgz
6
cd harbor

1
cp harbor.yml.tmpl harbor.yml

1
sudo mkdir -p /opt/harbor/certs
2
sudo cp /opt/registry/certs/registry.crt /opt/harbor/certs/
3
sudo cp /opt/registry/certs/registry.key /opt/harbor/certs/

1
# 运行安装脚本，启用所有常用组件
2
sudo ./install.sh --with-trivy --with-notary --with-chartmuseum
3

4
# 安装完成后，Harbor会自动启动
5
# 查看所有组件状态
6
docker compose ps

1
# 在所有客户端上配置证书信任
2
sudo mkdir -p /etc/docker/certs.d/192.168.1.100
3
sudo scp user@192.168.1.100:/opt/harbor/certs/registry.crt /etc/docker/certs.d/192.168.1.100/ca.crt
4
sudo systemctl restart docker
5

6
# 登录Harbor仓库
7
docker login 192.168.1.100
8

9
# 创建项目
10
# 在Web界面中创建一个名为"myproject"的项目
11

12
# 推送镜像
13
docker tag nginx:alpine 192.168.1.100/myproject/nginx:alpine
14
docker push 192.168.1.100/myproject/nginx:alpine
15

16
# 拉取镜像
17
docker pull 192.168.1.100/myproject/nginx:alpine

1
# 备份数据库
2
docker exec harbor-db pg_dump -U postgres harbor > harbor-backup.sql
3

4
# 备份数据目录
5
tar czf harbor-data-backup.tar.gz /opt/harbor/data
6

7
# 备份配置文件
8
tar czf harbor-config-backup.tar.gz /opt/harbor/harbor.yml