zoukankan      html  css  js  c++  java

  • docker 查询或获取私有仓库(registry)中的镜像（基于Bearer的验证）

    1. Harbor中Bearer认证条件下API测试

    Harbor默认安装时，采用Bearer认证。下面我们来测试一下Harbore-registry如下三个API，并借以了解Bearer认证的大体流程：

    Method  Path          EntityDescription
    GET /v2/ Base API版本检测
    GET /v2//tags/list Tags 列出镜像标签
    GET /v2//manifests/ Manifest 拉取一个镜像的MANIFEST
    GET /v2/_catalog Base 查询一个仓库中的镜像

    首先我们测试一下/v2:

    # curl -ikL -X GET http://192.168.69.128/v2
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 09 Apr 2018 09:09:26 GMT
Content-Type: text/html
Content-Length: 178
Location: http://192.168.69.128/v2/
Connection: keep-alive

HTTP/1.1 401 Unauthorized
Server: nginx
Date: Mon, 09 Apr 2018 09:09:26 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 87
Connection: keep-alive
Docker-Distribution-Api-Version: registry/2.0
Set-Cookie: beegosessionID=f7c73dc9e006a967b95c514014ac49c1; Path=/; HttpOnly
Www-Authenticate: Bearer realm="http://192.168.69.128/service/token",service="harbor-registry"

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]}

    我们发现提示Unauthorized。通过查看相关文档及上面的错误提示，我们应该先获取token，然后再进行访问。

    1.1 查询当前registry API版本号

    1) 获取token

    # curl -ikL -X GET -u admin:Harbor12345 http://192.168.69.128/service/token?account=admin&service=harbor-registry
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 09:22:53 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 1100
Connection: keep-alive
Set-Cookie: beegosessionID=946e433f64d7b3f6f25f1c194de1573b; Path=/; HttpOnly

{
  "token": "_ThyL4OfJUCg",
  "expires_in": 1800,
  "issued_at": "2018-04-09T09:22:53Z"
}

    注意上面为了显示，我们对token字段进行了适当的裁剪。

    2) 查询API版本号

    [root@localhost test]# curl -ikL -X GET -H "Content-Type: application/json" -H "Authorization: Bearer _ThyL4OfJUCg" http://192.168.69.128/v2
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 09 Apr 2018 09:27:01 GMT
Content-Type: text/html
Content-Length: 178
Location: http://192.168.69.128/v2/
Connection: keep-alive

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 09:27:01 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 2
Connection: keep-alive
Docker-Distribution-Api-Version: registry/2.0
Set-Cookie: beegosessionID=192d5078479411d2c59fa4318b31a3ea; Path=/; HttpOnly

    可以看到上面返回200 OK，表明当前所用registry API确实为v2版本。(注意上面Bearer后面为完整的token值，这里进行了适当裁剪)

    1.2 查询一个仓库中的镜像

    # curl -ikL -X GET http://192.168.69.128/v2/_catalog
HTTP/1.1 401 Unauthorized
Server: nginx
Date: Mon, 09 Apr 2018 09:31:43 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 145
Connection: keep-alive
Docker-Distribution-Api-Version: registry/2.0
Set-Cookie: beegosessionID=7456246aef9ca966c37848f3232f16f8; Path=/; HttpOnly
Www-Authenticate: Bearer realm="http://192.168.69.128/service/token",service="harbor-registry",scope="registry:catalog:*"

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}

    这里我们看到提示Unauthorized错误。因此下面我们要获取相应token，然后再访问。

    1) 获取token

    # curl -ikL -X GET -u admin:Harbor12345 http://192.168.69.128/service/token?account=admin&service=harbor-registry&scope=registry:catalog:*
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 09:33:52 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 1166
Connection: keep-alive
Set-Cookie: beegosessionID=648fd5a5ec4f06389d45c02f7f5971b4; Path=/; HttpOnly

{
  "token": "A7yfEdUBYD3bDhLM",
  "expires_in": 1800,
  "issued_at": "2018-04-09T09:33:52Z"

    注意上面为了显示，我们对token字段进行了适当的裁剪。

    2） 查询仓库中的镜像

    # curl -ikL -X GET -H "Content-Type: application/json" -H "Authorization: Bearer LA7yfEdUBYD3bDhLM" http://192.168.69.128/v2/_catalog
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 09:36:35 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 34
Connection: keep-alive
Docker-Distribution-Api-Version: registry/2.0
Set-Cookie: beegosessionID=1b84e760ab0234045f06680e56e28818; Path=/; HttpOnly

{"repositories":["library/redis"]}

    上面我们看到返回仓库中的镜像有library/redis。(注意上面Bearer后面为完整的token值，这里进行了适当裁剪)

    1.3 查看镜像标签

    # curl -ikL -X GET http://192.168.69.128/v2/library/redis/tags/list
HTTP/1.1 401 Unauthorized
Server: nginx
Date: Mon, 09 Apr 2018 09:41:32 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 156
Connection: keep-alive
Docker-Distribution-Api-Version: registry/2.0
Set-Cookie: beegosessionID=c3054d54b29b37572ae507b7a39341a7; Path=/; HttpOnly
Www-Authenticate: Bearer realm="http://192.168.69.128/service/token",service="harbor-registry",scope="repository:library/redis:pull"

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"library/redis","Action":"pull"}]}]}

    1) 获取token

    # curl -ikL -X GET -u admin:Harbor12345 http://192.168.69.128/service/token?account=admin&service=harbor-registry&scope=repository:library/redis:pull
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 09:42:37 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 1196
Connection: keep-alive
Set-Cookie: beegosessionID=2fb20f4b6188c6c5aaafcffe2408bc88; Path=/; HttpOnly

{
  "token": "PZxiZYBNkaxp78fs",
  "expires_in": 1800,
  "issued_at": "2018-04-09T09:42:37Z"
}

    注意上面为了显示，我们对token字段进行了适当的裁剪。

    2) 查询镜像标签

    # curl -ikL -X GET -H "Content-Type: application/json" -H "Authorization: Bearer PZxiZYBNkaxp78fs" http://192.168.69.128/v2/library/redis/tags/list
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 09:44:25 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 43
Connection: keep-alive
Docker-Distribution-Api-Version: registry/2.0
Set-Cookie: beegosessionID=bae4b316f5ffe1f41df9ac45b51736fa; Path=/; HttpOnly

{"name":"library/redis","tags":["alpine"]}

    上面我们看到library/redis镜像的标签为alpine。(注意上面Bearer后面为完整的token值，这里进行了适当裁剪)

    1.4 获取镜像Manifest

    # curl -ikL -X GET  http://192.168.69.128/v2/library/redis/manifests/latest
HTTP/1.1 401 Unauthorized
Server: nginx
Date: Mon, 09 Apr 2018 09:48:41 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 156
Connection: keep-alive
Docker-Distribution-Api-Version: registry/2.0
Set-Cookie: beegosessionID=68be9fa8be88c2627f1c2a7b73aff7ab; Path=/; HttpOnly
Www-Authenticate: Bearer realm="http://192.168.69.128/service/token",service="harbor-registry",scope="repository:library/redis:pull"

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"library/redis","Action":"pull"}]}]}

    1) 获得token

    # curl -ikL -X GET -u admin:Harbor12345 http://192.168.69.128/service/token?account=admin&service=harbor-registry&scope=repository:library/redis:pull
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 09:49:51 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 1196
Connection: keep-alive
Set-Cookie: beegosessionID=ce243085ff01770bad8aa8751a9b4e7a; Path=/; HttpOnly

{
  "token": "DGYtO4VfXttRh_WNs",
  "expires_in": 1800,
  "issued_at": "2018-04-09T09:49:51Z"
}

    注意上面为了显示，我们对token字段进行了适当的裁剪。

    2) 获取镜像Manifest

    # curl -ikL -X GET -H "Accept: application/vnd.docker.distribution.manifest.v2+json" -H "Authorization: Bearer DGYtO4VfXttRh_WNs" http://192.168.69.128/v2/library/redis/manifests/alpine
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 Apr 2018 09:57:51 GMT
Content-Type: application/vnd.docker.distribution.manifest.v2+json
Content-Length: 1568
Connection: keep-alive
Docker-Content-Digest: sha256:9d017f829df3d0800f2a2582c710143767f6dda4df584b708260e73b1a1b6db3
Docker-Distribution-Api-Version: registry/2.0
Etag: "sha256:9d017f829df3d0800f2a2582c710143767f6dda4df584b708260e73b1a1b6db3"
Set-Cookie: beegosessionID=0bcee40b8b46feaffa29d024e32f8d5c; Path=/; HttpOnly

{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "config": {
      "mediaType": "application/vnd.docker.container.image.v1+json",
      "size": 5084,
      "digest": "sha256:c27f565859388a7a6b4666c7861d9a8cac3f6eec6a2fd296a39fd4895275344d"
   },
   "layers": [
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 2065537,
         "digest": "sha256:ff3a5c916c92643ff77519ffa742d3ec61b7f591b6b7504599d95a4a41134e28"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 1252,
         "digest": "sha256:aae70a2e60279ffae89150a59b81fe10d1d81f341ef6f31b9714ea6cc3418577"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 8554,
         "digest": "sha256:87c655da471c9a7d8f946ec7b04a6a72a98ae8c1734bddf4b950861b5638fe20"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 8497514,
         "digest": "sha256:6c09203c8aba31fcd20a3a434a3ee9b94fd7a0a2bc52e1f1cbfc4f1db053da08"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 98,
         "digest": "sha256:90b6d4891e7fceff0dad2e9dc885d06b932ab6095f34f72ddc774e93fe4258ab"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 402,
         "digest": "sha256:ffb22fabb597331e68f3edea917d3dba9cb8868d31dd6cf5b9330a9e3e1c8e4e"
      }
   ]
}

    上面我们获取到了library/redis:alpine镜像的manifests。(注意上面Bearer后面为完整的token值，这里进行了适当裁剪)



    [参考]

    1. Harbor FAQs

    2. Docker Registry v2 Bearer token specification

    3. The OAuth 2.0 Authorization Framework: Bearer Token Usage

    4. The OAuth 2.0 Authorization Framework
  • 相关阅读:
    为or、in平反——or、in到底能不能利用索引？
    【自然框架】稳定版beta1的Demo —— 四：角色管理。另外 在线演示 终于搞定了
    【自然框架】CMS之数据库设计
    【自然框架】——重开在线演示
    刘谦魔术的一个秘密 硬币穿越玻璃的那个。
    【自然框架】PowerDesigner 格式的元数据的表结构
    【自然框架】元数据的数据库结构的详细说明和示例（一）：项目描述部分
    程序员与项目经理
    Android 中文API （70） —— BluetoothDevice[蓝牙]
    Android API 中文 （50） —— SpinnerAdapter
  • 原文地址：https://www.cnblogs.com/zhangrui153169/p/13131587.html
Copyright © 2011-2022 走看看