CentOs中docker 安裝私有倉庫，并通過https方式上傳鏡像
安裝倉庫registry, Tag為2
[weshzhu@weshzhu ~]$ docker pull registry:2
2: Pulling from library/registry
Digest: sha256:672d519d7fd7bbc7a448d17956ebeefe225d5eb27509d8dc5ce67ecb4a0bce54
Status: Image is up to date for registry:2
查看倉庫，此時先不啟動容器。
[zsd@greenvm-z16786v1 certs]$ docker images
REPOSITORY? ? ? ? ? ? TAG? ? ? ? ? ? ? ? IMAGE ID? ? ? ? ? ? CREATED? ? ? ? ? ? SIZE
registry? ? ? ? ? ? ? 2? ? ? ? ? ? ? ? ? d1fd7d86a825? ? ? ? 4 weeks ago? ? ? ? 33.3MB
通過OpenSSL工具生成自簽名的證書瑰煎，后面將用于對請求進行校驗
對于證書以及OpenSSL, 請移目那些證書相關的玩意兒
首先找到OpenSSL工具配置文件openssl.cnf，對于Centos,目錄在/etc/pki/tls/中
[weshzhu@weshzhu ~]$ cd /etc/pki/tls/
[weshzhu@weshzhu tls]$ ll
total 12
lrwxrwxrwx. 1 root root? ? 49 Jan 26 19:10 cert.pem -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
drwxr-xr-x. 2 root root? 193 Feb? 7 21:42 certs
drwxr-xr-x. 2 root root? ? 74 Jan 26 19:10 misc
-rw-r--r--. 1 root root 10955 Feb? 7 20:12 openssl.cnf
drwxr-xr-x. 2 root root? ? 6 Aug? 4? 2017 private
編輯openssl.cnf,在[v3_ca]下面添加：subjectAltName = IP:域名|IP地址
[ v3_ca ]
subjectAltName = IP:172.10.15.110
否則將會報錯：
x509: cannot validate certificate for because it doesn't contain any IP SANs
這是因為在證書中俗孝，要包含一些信息酒甸，比如國家、機構等等赋铝，好像訪問的私有倉庫ip或者域名必須要有插勤，否則不予通過，就會報上面的錯誤革骨。如果有讀者發(fā)現(xiàn)此處有錯誤农尖，請在下方提出。謝謝良哲！
修改完openssl配置文件后盛卡，可以生產(chǎn)私有證書，要記住生成證書的目錄筑凫，后面會用到滑沧。
[weshzhu@weshzhu certs]$ sudo openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout registry.key -out registry.crt
[sudo] password for weshzhu:
Generating a 2048 bit RSA private key
.................................................................................................................................................+++
.........................................................................................................................................................+++
writing new private key to 'registry.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:? ? ? #該處讓交互輸入國家并村、省等，可以直接Enter跳過
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:172.10.15.110? #該處輸入私有倉庫的ip地址或者域名
Email Address []:
可以看到在當前目錄中滓技，有*.crt 和 *.key文件
[weshzhu@weshzhu certs]$ ll
total 8
-rw-r--r--. 1 root root 1306 Feb? 8 15:04 registry.crt
-rw-r--r--. 1 root root 1704 Feb? 8 15:04 registry.key
將生成的私有證書追加到系統(tǒng)的證書管理文件中哩牍，否則后面push和login和pull時會報如下錯誤：
[root@greenvm-z16786v1 certs]# cat ./registry.crt >> /etc/pki/tls/certs/ca-bundle.crt
未cat到系統(tǒng)的crt文件中
[weshzhu@weshzhu ~]$ docker push 192.168.0.123/rabbitmq:3.7
The push refers to repository [192.168.0.123/rabbitmq]
Get https:///v2/: x509: certificate signed by unknown authority
重啟docker, 該步驟一定不要省略，否則有可能加載私鑰失敗 systemctl restart docker
啟動私有倉庫鏡像 registry 注意：在啟動時令漂，有參數(shù)需要配置
docker run -d -p 443:443 --name registry -v /deploy/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt -e REGISTRY_HTTP_TLS_KEY=/certs/registry.key registry:2
-d 后臺運行 -p 443:443 將容器的端口443映射到主機的443端口 --name 給容器起個名字 registry -v /deploy/certs:/certs 主機的目錄/deploy/certs映射到容器的/certs 膝昆，目的是將生成的私有證書映射到容器中 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt 指定TLS協(xié)議驗證的證書目錄：該目錄為容器的registry.crt所在的目錄 -e REGISTRY_HTTP_TLS_KEY=/certs/registry.key 指定TLS協(xié)議使用的key的目錄：該目錄為容器的registry.key所在的目錄
上面的步驟按順序操作完成后，可以嘗試docker push一個鏡像到私有倉庫中叠必。 查看docker安裝了哪些鏡像：
[zsd@greenvm-z16786v1 certs]$ docker images
REPOSITORY? ? ? ? ? ? TAG? ? ? ? ? ? ? ? IMAGE ID? ? ? ? ? ? CREATED? ? ? ? ? ? SIZE
registry? ? ? ? ? ? ? 2? ? ? ? ? ? ? ? ? d1fd7d86a825? ? ? ? 4 weeks ago? ? ? ? 33.3MB
nginx? ? ? ? ? ? ? ? latest? ? ? ? ? ? ? 3f8a4339aadd? ? ? ? 6 weeks ago? ? ? ? 108MB
將上傳的鏡像重新Tag一下：
docker tag nginx[:tag] [ipaddress]/nginx
#:tag 為鏡像的tag,如果該鏡像的tag為latest荚孵，則可以省略
#[ipaddress] 為私有倉庫的ip地址或域名，也就是上面步驟在openssl中添加的`subjectAltName = IP:172.10.15.110`地址或域名
查看鏡像挠唆，發(fā)現(xiàn)多了一個以ip地址為開頭的image
[zsd@greenvm-z16786v1 certs]$ docker images
REPOSITORY? ? ? ? ? ? TAG? ? ? ? ? ? ? ? IMAGE ID? ? ? ? ? ? CREATED? ? ? ? ? ? SIZE
registry? ? ? ? ? ? ? 2? ? ? ? ? ? ? ? ? d1fd7d86a825? ? ? ? 4 weeks ago? ? ? ? 33.3MB
192.168.0.181/nginx? latest? ? ? ? ? ? ? 3f8a4339aadd? ? ? ? 6 weeks ago? ? ? ? 108MB
nginx? ? ? ? ? ? ? ? latest? ? ? ? ? ? ? 3f8a4339aadd? ? ? ? 6 weeks ago? ? ? ? 108MB
此時push該帶ip地址的鏡像到私有倉庫中
[root@greenvm-z16786v1 certs]# docker push 172.28.8.124/nginx
The push refers to repository [172.28.8.124/nginx]
a103d141fc98: Pushed
73e2bd445514: Pushed
2ec5c0a4cb57: Pushing [===========================================>? ? ? ]? 48.2MB/55.26MB
[root@greenvm-z16786v1 certs]# docker push 172.28.8.124/nginx
The push refers to repository [172.28.8.124/nginx]
a103d141fc98: Pushed
73e2bd445514: Pushed
2ec5c0a4cb57: Pushed
latest: digest: sha256:926b086e1234b6ae9a11589c4cece66b267890d24d1da388c96dd8795b2ffcfb size: 948
