云原生高级 docker到harbor的流程实践

一.部署docker1.配置软件仓库并安装docker-ce用阿里云源$ cat /etc/yum.repos.d/docker.repo EOF [docker] name docker baseurl https://mirrors.aliyun.com/docker-ce/linux/rhel/9.8/x86_64/stable/ gpgcheck 0 EOF $ dnf makecache $ dnf remove podman -y $ dnf install docker-ce -y2.配置docker服务与内核参数# dockerd 开启 iptables $ vim /lib/systemd/system/docker.service ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue # 加载 br_netfilter 模块 $ echo br_netfilter /etc/modules-load.d/docker_mod.conf $ modprobe -a br_netfilter # 开启桥接与转发 $ cat /etc/sysctl.d/docker.conf EOF net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 EOF $ sysctl --system $ systemctl enable --now docker二.docker的常规使用方法1.配置docker加速器$ cat /etc/docker/daemon.json EOF { registry-mirrors: [https://docker.1ms.run] } EOF $ systemctl restart docker $ docker info Registry Mirrors: https://docker.1ms.run/2.镜像与容器常用命令镜像docker images # 查看镜像 docker search nginx # 搜索镜像 docker pull nginx # 下载镜像 docker pull busybox Using default tag: latest latest: Pulling from library/busybox 37bb94b0940b: Pull complete 46500c34ad0c: Download complete Digest: sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e Status: Downloaded newer image for busybox:latest docker.io/library/busybox:latest docker history busybox:latest # 查看构建历史 docker save -o busybox-latest.tar busybox:latest docker load -i busybox-latest.tar # 导入 docker rmi busybox:latest # 删除容器docker run -d --name web nginx:1.26 # 后台运行 docker run -it --name busybox busybox:latest # 交互运行 docker ps # 运行中的容器 docker ps -a # 所有容器 docker start busybox # 启动已停止容器 docker attach busybox # 进入容器ctrlpq 退出且不停止 docker inspect busybox # 查看容器信息 docker exec busybox touch /root/haha # 非交互执行 docker exec -it web /bin/bash # 交互执行 docker stop busybox # 停止 docker kill busybox # 强制停止 docker rm -f busybox # 删除3.容器内外复制数据# 宿主机 - 容器 $ docker cp index.html webserver:/usr/share/nginx/html # 容器 - 宿主机 $ docker cp webserver:/usr/share/nginx/html/index.html /mnt4.提交容器更改容器内修改默认随容器删除而丢失用 commit 保存为新镜像$ docker commit webserver nginx-lee:v1三.容器镜像构建1.熟悉镜像构建用到的参数$ mkdir docker cd docker/ $ echo test test $ vim Dockerfile FROM busybox:latest LABEL Createrlee # 镜像元信息 COPY test /root # 只复制不解压缩 ADD lee /root # 可自动解压缩 ENV NAMEtest # 环境变量 RUN [/bin/sh,-c, touch /root/$NAME] EXPOSE 8080 # 声明端口 VOLUME /mnt # 匿名卷 WORKDIR /mnt # 工作目录 CMD [/bin/sh, -c, /bin/echo $NAME] # 可被命令行覆盖 ENTRYPOINT echo $NAME # 不可覆盖命令行参数作为其参数构建$ docker build -t test:v1 .2.利用debian13构建nginx镜像# 导入 debian13 基础镜像 $ docker load -i debian-latest.tar # 准备源码包 $ wget https://nginx.org/download/nginx-1.30.4.tar.gzDockerfileFROM debian:latest ADD nginx-1.30.4.tar.gz /mnt WORKDIR /mnt/nginx-1.30.4 RUN apt update apt install -y ca-certificates apt install -y build-essential libpcre2-dev zlib1g zlib1g-dev libssl-dev libgd-dev libxml2-dev libxslt-dev ./configure --with-http_ssl_module --with-http_stub_status_module make make install EXPOSE 80 VOLUME [/usr/local/nginx/html] CMD [/usr/local/nginx/sbin/nginx, -g, daemon off;]构建$ docker build -t nginx-debian:v1 .四.安装 Harbor1.下载并解压 Harbor 离线包包放私有目录 /optcd /opt sudo wget https://github.com/goharbor/harbor/releases/download/v2.15.4/harbor-offline-installer-v2.15.4.tgz sudo tar xzf harbor-offline-installer-v2.15.4.tgz cd harbor2.配置 harbor.ymlsudo cp harbor.yml.tmpl harbor.yml sudo vim harbor.yml关键项hostname: 192.168.1.16 # hostname -I 查到的 IP别写 localhost http: port: 8080 # 避开端口冲突 # https: # 没证书就整段注释掉 # port: 443 # certificate: ... # private_key: ... harbor_admin_password: 你的密码 data_volume: /opt/harbor/data3.安装启动sudo ./prepare sudo ./install.sh sudo docker ps # 多个 goharbor/* 容器 healthy 即成功4.访问浏览器访问http://192.168.1.16:8080账号 admin密码为harbor_admin_password。报http: server gave HTTP response to HTTPS client Harbor 是 HTTP、Docker 默认走 HTTPS加 insecure-registries 即可。五.docker仓库使用手册1.构建简单仓库# 导入并运行 registry docker load -i registry-202608.tar docker run -d --name registry --restartalways -p 5000:8080 registry:latest推送前信任 HTTP 仓库vim /etc/docker/daemon.json { insecure-registries: [http://192.168.1.16:8080] } systemctl restart docker docker info # Insecure Registries 里能看到 192.168.1.16:8080上传 / 验证 / 跨节点下载docker tag nginx:1.27-alpine 192.168.1.16:8080/test/nginx:latest docker push 192.168.1.16:8080/test/nginx:latest curl http://192.168.1.16:8080/v2/_catalog # 第二节点同样配 insecure-registries 后 docker pull 192.168.1.16:8080/test/nginx2.仓库数据传输加密生成证书CN 和 SAN 写仓库域名mkdir certs openssl req -newkey rsa:4096 -nodes \ -keyout certs/test.org.key \ -addext subjectAltName DNS:reg.test.org \ -x509 -days 365 -out certs/test.org.crt启动加密仓库docker run -d --name registry --restartalways -p 443:443 \ -v /root/certs:/certs -v lib/registry \ -e REGISTRY_HTTP_ADDR0.0.0.0:443 \ -e REGISTRY_HTTP_TLS_CERTIFICATE/certs/test.org.crt \ -e REGISTRY_HTTP_TLS_KEY/certs/test.org.key \ registry客户端加载证书否则报x509: certificate signed by unknown authorityvim /etc/hosts 192.168.1.16 reg.test.org mkdir -p /etc/docker/certs.d/reg.test.org cp certs/test.org.crt /etc/docker/certs.d/reg.test.org/ca.crt systemctl restart docker docker tag busybox:latest reg.test.org/busybox:latest docker push reg.test.org/busybox:latest curl -k https://reg.test.org/v2/_catalog第二节点下载把certs.d目录 scp 过去、配 hosts、重启 docker再docker pull reg.test.org/busybox:latest。六.docker网络1.自定义网络 bridgedocker network ls # 查看现有网络 docker network create mynet1 # 默认自定义桥接 docker network create mynet2 --subnet 192.168.0.0/16 --gateway 192.168.0.100 # 指定网段网关 docker network inspect mynet2 # 查看网段与网关2.自定义桥接网络有解析功能默认 bridge 不提供解析容器重启后 IP 会变ping 容器名直接bad address。自定义网络可用容器名通信docker run -it --name test1 --networkmynet1 busybox:latest docker run -d --name test --networkmynet1 nginx:latest # test1 里 ping test # 能解析到对方 IPIP 变化后仍可通信