1、harbor介绍
Docker容器应用的开发和运行离不开可靠的镜像管理，虽然docker官方提供了公共的镜像仓库（Docker Hub），但是从安全和效率等方面考虑，部署我们私有环境内的Registry也是非常必要的。Harbor是由VMware公司开源的企业级的Docker Registry管理项目，它包括权限管理（RBAC）、LDAP、日志审核、界面管理、自我注册、镜像复制和中文支持等功能。
2、安装配置
环境配置：
docker: 19.03.12
docker-compose: 1.26.2
Harbor: v1.8.0
注意：Harbor的所有服务组件都是在Docker中部署，所以官方安装使用Docker-compose快速部署，所以我们需要安装Docker、Docker-compose。由于Harbor是基于Docker Registry V2版本，所以就要求Docker版本不小于1.10.0，Docker-compose版本不小于1.6.0。
3、docker安装
1、安装一些必要的系统工具
yum install -y yum-utils device-mapper-persistent-data lvm2
2、添加docker镜像源
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
3、安装docker-ce
yum -y install docker-ce
4、启动docker服务
systemctl start docker.server
补充：
# 守护进程重启
> sudo systemctl daemon-reload
# 重启docker服务
> sudo systemctl restart docker
# 关闭docker
> sudo systemctl stop docker
4、docker-compose安装
> curl -L https://github.com/docker/compose/releases/download/1.26.2/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
> chmod +x /usr/local/bin/docker-compose
> docker-compose version
5、Harbor私有仓库安装
1、下载Harbor安装文件
从 github harbor 官网 release 页面下载指定版本的安装包。
# 在线安装包
> wget https://github.com/vmware/harbor/releases/download/v1.8.0/harbor-online-installer-v1.8.0.tgz
> tar xvf harbor-online-installer-v1.8.0.tgz
# 离线安装包
> wget https://github.com/vmware/harbor/releases/download/v1.8.0/harbor-offline-installer-v1.8.0.tgz
> tar xvf harbor-offline-installer-v1.8.0.tgz
如果服务器的网络带宽不行的话，建议使用离线安装，提前下载完上传到服务器
2、配置Harbor
进入harbor目录，打开harbor.yml进行配置
# Configuration file of Harbor
# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
# hostname设置访问地址，可以使用ip、域名，不可以设置为127.0.0.1或localhost
hostname: xx.xx.xx.xx
# http related config
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 80
# https related config
#https:
# # https port for harbor, default is 443
# port: 443
# # The path of cert and key files for nginx
# certificate: /root/harbor/data/yaduo.pem
# private_key: /root/harbor/data/yaduo.key
# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433
# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: Harbor12345
# Harbor DB configuration
database:
# The password for the root user of Harbor DB. Change this before any production use.
password: only1234
# The default data volume
data_volume: /data
# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
# # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
# # of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate.
# ca_bundle:
# # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
# # for more info about this configuration please refer https://docs.docker.com/registry/configuration/
# filesystem:
# maxthreads: 100
# # set disable to true when you want to disable registry redirect
# redirect:
# disabled: false
# Clair configuration
clair:
# The interval of clair updaters, the unit is hour, set to 0 to disable the updaters.
updaters_interval: 12
# Config http proxy for Clair, e.g. http://my.proxy.com:3128
# Clair doesn't need to connect to harbor internal components via http proxy.
http_proxy:
https_proxy:
no_proxy: 127.0.0.1,localhost,core,registry
jobservice:
# Maximum number of job workers in job service
max_job_workers: 10
chart:
# Change the value of absolute_url to enabled can enable absolute url in chart
absolute_url: disabled
# Log configurations
log:
# options are debug, info, warning, error, fatal
level: info
# Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
rotate_count: 50
# Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
# If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
# are all valid.
rotate_size: 200M
# The directory on your host that store log
location: /var/log/harbor
#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 1.8.0
# Uncomment external_database if using external database. Currently only support POSTGRES.
# Four databases are needed to be create first by users for Harbor core, Clair, Notary server
# and Notary signer. And the tables will be generated automatically when Harbor starting up.
# NOTE: external_database is unable to custom attributes individually, you must do them in block.
# external_database:
# harbor:
# host: harbor_db_host
# port: harbor_db_port
# db_name: harbor_db_name
# username: harbor_db_username
# password: harbor_db_password
# ssl_mode: disable
# clair:
# host: clair_db_host
# port: clair_db_port
# db_name: clair_db_name
# username: clair_db_username
# password: clair_db_password
# ssl_mode: disable
# notary_signer:
# host: notary_signer_db_host
# port: notary_signer_db_port
# db_name: notary_signer_db_name
# username: notary_signer_db_username
# password: notary_signer_db_password
# ssl_mode: disable
# notary_server:
# host: notary_server_db_host
# port: notary_server_db_port
# db_name: notary_server_db_name
# username: notary_server_db_username
# password: notary_server_db_password
# ssl_mode: disable
# Uncomment external_redis if using external Redis server
# external_redis:
# host: redis
# port: 6379
# password:
# # db_index 0 is for core, it's unchangeable
# registry_db_index: 1
# jobservice_db_index: 2
# chartmuseum_db_index: 3
# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
# ca_file: /path/to/ca
3、启动Harbor
- 启动
修改完配置文件后，在的当前目录执行./install.sh，Harbor服务就会根据当期目录下的docker-compose.yml开始下载依赖的镜像，检测并按照顺序依次启动各镜像
- Harbor依赖的镜像及启动服务如下：
############################################## docker images ###################################
goharbor/chartmuseum-photon v0.8.1-v1.8.0 60a4caf66227 14 months ago 113MB
goharbor/harbor-migrator v1.8.0 765880263e76 14 months ago 361MB
goharbor/redis-photon v1.8.0 66d7402d2770 14 months ago 103MB
goharbor/clair-photon v2.0.8-v1.8.0 7570a336afd5 14 months ago 164MB
goharbor/notary-server-photon v0.6.1-v1.8.0 e8552306a936 14 months ago 135MB
goharbor/notary-signer-photon v0.6.1-v1.8.0 9736ac6c508e 14 months ago 132MB
goharbor/harbor-registryctl v1.8.0 0ca3e2b624f5 14 months ago 96.2MB
goharbor/registry-photon v2.7.1-patch-2819-v1.8.0 1e7d99ccba24 14 months ago 81.3MB
goharbor/nginx-photon v1.8.0 4a4b48b32ae4 14 months ago 36MB
goharbor/harbor-log v1.8.0 e718bdc405a3 14 months ago 81.5MB
goharbor/harbor-jobservice v1.8.0 d47940dd883f 14 months ago 118MB
goharbor/harbor-core v1.8.0 b07a1a4be17f 14 months ago 135MB
goharbor/harbor-portal v1.8.0 76298a1ef089 14 months ago 42.9MB
goharbor/harbor-db v1.8.0 d1e0b3df3e95 14 months ago 140MB
goharbor/prepare v1.8.0 769ca785dab0 14 months ago 139MB
############################################### docker-compose ps####################################
Name Command State Ports
---------------------------------------------------------------------------------------------
harbor-core /harbor/start.sh Up (healthy)
harbor-db /entrypoint.sh postgres Up (healthy) 5432/tcp
harbor-jobservice /harbor/start.sh Up
harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp
harbor-portal nginx -g daemon off; Up (healthy) 80/tcp
nginx nginx -g daemon off; Up (healthy) 0.0.0.0:80->80/tcp
redis docker-entrypoint.sh redis ... Up 6379/tcp
registry /entrypoint.sh /etc/regist ... Up (healthy) 5000/tcp
registryctl /harbor/start.sh Up (healthy)
启动完成后就可以访问刚刚在配置文件中设置的hostname。默认是80端口，如果端口占用，我们可以去修改harbor.yml文件中，对应服务的端口映射。
默认账号密码：admin，Harbor12345
