docker register2 HTTPS加认证

安装openssl
yum install -y openssl

创建证书目录
mkdir -p /opt/certs
mkdir-p /opt/auth

生成证书
openssl req -newkey rsa:4096 -nodes -sha256 -keyout /opt/certs/registry.akin.com.key -x509 -days 3650 -out /opt/certs/registry.akin.com.crt

生成密码
docker run --rm -it httpd htpasswd -Bbn akin akin123 >/opt/auth/htpasswd

运行register2
docker run -d \
  -p 5000:5000 \
  --restart=always \
  --name registry \
  -v /opt/auth:/auth \
  -e "REGISTRY_AUTH=htpasswd" \
  -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
  -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
  -v /opt/certs:/certs \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.akin.com.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/registry.akin.com.key \
  registry:2
=======================
-d：表示容器后台运行
-p：端口映射 --restart=always：可以理解为开机启动。开机：就是启动docker客户端拉。
--name registry：给容器取一个名字，方便识别和记忆 -v:挂在本地文件到容器中。命令格式：hostdir:cdir[:rw|ro] 主机目录:容器目录[:读写权限]
-v pwd/auth:/auth：挂在本地的密码文件夹
-v pwd/certs:/certs：挂在本地的ssl证书文件夹
-e:设置环境变量参数
-e REGISTRY_AUTH：验证方式
-e REGISTRY_AUTH_HTPASSWD_REALM：验证域名
-e REGISTRY_AUTH_HTPASSWD_PATH：密码文件路径
-e REGISTRY_HTTP_TLS_CERTIFICATE：ssl证书文件路径
-e REGISTRY_HTTP_TLS_KEY：ssl证书文件路径

添加hosts
10.1.103.251  register.akin.com

登录
docker login register.akin.com:5000
Username: akin
Password: 
Error response from daemon: Get "http s:// reg ister.akin.com:5000/v2/": x509: certificate is not valid for any names, but wanted to match registe r.aki n.com

复制证书
mkdir -p /etc/docker/certs.d/register.akin.com:5000
cp /certs/registry.com.crt /etc/docker/certs.d/register.akin.com\:5000

添加到daemon.json
vim /etc/docker/daemon.json
{
??"insecure-registries":["register.akin.com:5000"],
?? "registry-mirrors": ["http s:// registr y.docker-cn.com"]
}

[root@k8s-node1 ~]# docker login register.akin.com:5000
Username: akin
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
http s:// docs.docker .com/engine/reference/commandline/login/#credentials-store

Login Succeeded

打TAG，推送
docker tag nginx register.akin.com:5000/nginx:1.15
docker push register.akin.com:5000/nginx:1.15

UI:( konradkleine/docker-registry-frontend:v2)
运行：
docker run -d \
    -p 9011:80 \
    -e ENV_DOCKER_REGISTRY_HOST=registry.akin.com \
    -e ENV_DOCKER_REGISTRY_PORT=5000 \
    -e ENV_DOCKER_REGISTRY_USE_SSL=1 \
    konradkleine/docker-registry-frontend:v2

http :// 10.1.103.251:9011/