私有仓库部署

Docker Registry 可部署私有镜像仓库，下面介绍部署与配置方法。

快速部署

Bash

# 最简部署
docker run -d \
  -p 5000:5000 \
  --name registry \
  registry:2

持久化存储

Bash

# 挂载数据目录
docker run -d \
  -p 5000:5000 \
  --name registry \
  -v /data/registry:/var/lib/registry \
  registry:2

认证配置

基本认证

Bash

# 创建密码文件
mkdir auth
docker run --rm \
  --entrypoint htpasswd \
  httpd:2 -Bbn admin password123 > auth/htpasswd

# 启动带认证的仓库
docker run -d \
  -p 5000:5000 \
  --name registry \
  -v /data/registry:/var/lib/registry \
  -v $(pwd)/auth:/auth \
  -e "REGISTRY_AUTH=htpasswd" \
  -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
  -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" \
  registry:2

登录使用

Bash

# 登录
docker login localhost:5000
Username: admin
Password: password123

# 推送镜像
docker tag nginx:latest localhost:5000/nginx:latest
docker push localhost:5000/nginx:latest

# 拉取镜像
docker pull localhost:5000/nginx:latest

TLS 配置

Bash

# 生成自签名证书
mkdir certs
openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout certs/tls.key \
  -out certs/tls.crt \
  -subj "/CN=localhost"

# 启动带 TLS 的仓库
docker run -d \
  -p 5000:5000 \
  --name registry \
  -v /data/registry:/var/lib/registry \
  -v $(pwd)/certs:/certs \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/tls.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/tls.key \
  registry:2

客户端配置

Bash

# 复制证书到客户端
sudo mkdir -p /etc/docker/certs.d/localhost:5000
sudo cp certs/tls.crt /etc/docker/certs.d/localhost:5000/ca.crt

# 重启 Docker
sudo systemctl restart docker

完整部署

YAML

# docker-compose.yml
version: '3.8'

services:
  registry:
    image: registry:2
    ports:
      - "5000:5000"
    volumes:
      - /data/registry:/var/lib/registry
      - ./auth:/auth
      - ./certs:/certs
    environment:
      REGISTRY_AUTH: htpasswd
      REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/tls.crt
      REGISTRY_HTTP_TLS_KEY: /certs/tls.key
    restart: unless-stopped

管理镜像

Bash

# 列出仓库
curl -u admin:password123 https://localhost:5000/v2/_catalog

# 列出标签
curl -u admin:password123 https://localhost:5000/v2/nginx/tags/list

# 删除镜像（需启用删除功能）
curl -u admin:password123 -X DELETE \
  https://localhost:5000/v2/nginx/manifests/sha256:abc123

要点总结

docker run -d -p 5000:5000 registry:2 快速部署
数据目录挂载 /var/lib/registry 实现持久化
使用 htpasswd 配置基本认证，TLS 加密传输
客户端需安装证书才能访问 HTTPS 仓库
docker login/push/pull 与 Docker Hub 操作相同