需要先安裝 docker-ce和docker-compose
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum update
yum install -y docker-ce
yum install -y epel-release
yum install -y docker-compose
安裝文檔: https://github.com/goharbor/harbor/blob/master/docs/installation_guide.md
下載安裝包: https://github.com/goharbor/harbor/releases
我選擇的是 v1.8.1 的離線安裝包
下載
wget https://storage.googleapis.com/harbor-releases/release-1.8.0/harbor-offline-installer-v1.8.1.tgz
解壓
tar zxvf harbor-offline-installer-v1.8.1.tgz
cd harbor
修改配置文件harbor.yml,出于測試目的我只修改了hostname激涤，如果要啟用https或提高安全性荣暮，需要修改其他選項(xiàng)春宣。
# hostname設(shè)置訪問地址既峡，可以使用ip预茄、域名隔显，不可以設(shè)置為127.0.0.1或localhost
hostname = 172.16.61.11
# 訪問協(xié)議，默認(rèn)是http蜻直，也可以設(shè)置https盯质，如果設(shè)置https袁串，則nginx ssl需要設(shè)置on
ui_url_protocol = http
# mysql數(shù)據(jù)庫root用戶默認(rèn)密碼root123，實(shí)際使用時(shí)修改下
db_password = 123456
max_job_workers = 3
customize_crt = on
ssl_cert = /data/cert/server.crt
ssl_cert_key = /data/cert/server.key
secretkey_path = /data
admiral_url = NA
# 郵件設(shè)置呼巷，發(fā)送重置密碼郵件時(shí)使用
email_identity =
email_server = smtp.mydomain.com
email_server_port = 25
email_username = sample_admin@mydomain.com
email_password = abc
email_from = admin <sample_admin@mydomain.com>
email_ssl = false
# 啟動Harbor后囱修，管理員UI登錄的密碼，默認(rèn)是Harbor12345
harbor_admin_password = 123456
# 認(rèn)證方式王悍，這里支持多種認(rèn)證方式破镰，如LADP、本次存儲压储、數(shù)據(jù)庫認(rèn)證鲜漩。默認(rèn)是db_auth，mysql數(shù)據(jù)庫認(rèn)證
auth_mode = db_auth
# LDAP認(rèn)證時(shí)配置項(xiàng)
ldap_url = ldaps://ldap.mydomain.com
#ldap_searchdn = uid=searchuser,ou=people,dc=mydomain,dc=com
#ldap_search_pwd = password
ldap_basedn = ou=people,dc=mydomain,dc=com
#ldap_filter = (objectClass=person)
ldap_uid = uid
ldap_scope = 3
ldap_timeout = 5
# 是否開啟自注冊
self_registration = on
# token有效時(shí)間集惋，默認(rèn)30分鐘
token_expiration = 30
# 用戶創(chuàng)建項(xiàng)目權(quán)限控制宇整，默認(rèn)是everyone（所有人），也可以設(shè)置為adminonly（只能管理員）
project_creation_restriction = everyone
verify_remote_cert = on
docker 默認(rèn)是按 https 請求的芋膘，由于我搭的私有庫是 http 的，所以需要修改 docker 配置霸饲，將信任的庫的地址寫上
修改文件 /etc/docker/daemon.json
{
"insecure-registries": [
"你的ip或域名"
]
}
重啟一下docker
systemctl restart docker
安裝:
./install.sh
制作鏡像
將 busybox制作成一個(gè)私有鏡像
docker pull busybox
docker tag busybox ip地址/library/mybusybox:0.0.1
上傳
先登陸私有庫
docker login ip地址
PUSH
docker push ip地址/library/mybusybox:0.0.1
ps：如果大量使用還是要用https
配置https方法(測試使用自簽名證書)
[官方教程]https://github.com/goharbor/harbor/blob/master/docs/configure_https.md
創(chuàng)建存放證書的目錄
mkdir -p /opt/harbor_cert/
cd /opt/harbor_cert/
生成根證書
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=TW/ST=Taipei/L=Taipei/O=example/OU=Personal/CN=10.129.194.209" -key ca.key -out ca.crt
生成服務(wù)器證書
openssl genrsa -out 10.129.194.209.key 4096
openssl req -sha512 -new -subj "/C=TW/ST=Taipei/L=Taipei/O=example/OU=Personal/CN=10.129.194.209" -key 10.129.194.209.key -out 10.129.194.209.csr
echo subjectAltName = IP:10.129.194.209 > extfile.cnf
openssl x509 -req -sha512 -days 3650 -CA ca.crt -CAkey ca.key -CAcreateserial -extfile extfile.cnf -in 10.129.194.209.csr -out 10.129.194.209.crt
openssl x509 -inform PEM -in 10.129.194.209.crt -out 10.129.194.209.cert
配置 HTTPS 配置
編輯harbor.yaml
https:
# # https port for harbor, default is 443
port: 443
# # The path of cert and key files for nginx
certificate: /opt/harbor_cert/10.129.194.209.crt
private_key: /opt/harbor_cert/10.129.194.209.key
暫停
docker-compose down -v
./prepare # 生成配置文件为朋，根據(jù) harbor.yml 配置生成docker-compose文件。
docker-compose up -d # 后臺啟動
docker客戶端機(jī)器上操作
cp yourdomain.com.cert /etc/docker/certs.d/yourdomain.com/
cp yourdomain.com.key /etc/docker/certs.d/yourdomain.com/
cp ca.crt /etc/docker/certs.d/yourdomain.com/
The following illustrates a configuration with custom certificates:
/etc/docker/certs.d/
└── yourdomain.com:port
├── yourdomain.com.cert <-- Server certificate signed by CA
├── yourdomain.com.key <-- Server key signed by CA
└── ca.crt <-- Certificate authority that signed the registry certificate
登錄一下試試
[參考連接]https://blog.csdn.net/min19900718/article/details/87920254
