docker-harbor镜像仓库搭建

export VERSION="1.7.4"
export WORKDIR="/data/soft"
mkdir -p ${WORKDIR}
cd ${WORKDIR}
wget https://github.com/goharbor/harbor/archive/v${VERSION}.tar.gz
tar xf v${VERSION}.tar.gz && cd harbor-${VERSION}/make

# 离线安装包
wget https://storage.googleapis.com/harbor-releases/release-1.7.0/harbor-offline-installer-v${VERSION}.tgz
# 在线安装包
wget https://storage.googleapis.com/harbor-releases/release-1.7.0/harbor-online-installer-v${VERSION}.tgz

hostname = 172.16.198.133
ui_url_protocol = https
# https证书位置 需要根据实际情况修改
ssl_cert = /data/cert/172.16.198.133.crt
ssl_cert_key = /data/cert/172.16.198.133.key
# secretkey保存目录
secretkey_path = /data/harbor

# 邮件配置
email_identity =
email_server = smtp.mydomain.com
email_server_port = 25
email_username = sample_admin@mydomain.com
email_password = abc
email_from = admin <sample_admin@mydomain.com>
email_ssl = false
email_insecure = false
# 初始admin密码
harbor_admin_password = Harbor123456

# 是否禁止用户注册
self_registration = off
# 创建项目权限 everyone or adminonly
project_creation_restriction = adminonly

# 修改宿主机挂载目录位置
sed -i 's#- /data#- /data/harbor#' docker-compose*.yml
# 修改日志保存位置
sed -i 's#/var/log/harbor#./log#' docker-compose.yml
mkdir /data/harbor
mkdir log

export CERTDIR="/data/cert"
export CN_DOMAIN="172.16.198.133"
mkdir ${CERTDIR}

# 获得证书授权
openssl genrsa -out ca.key 4096

openssl req -x509 -new -nodes -sha512 -days 3650 \
  -subj "/C=TW/ST=Taipei/L=Taipei/O=example/OU=Personal/CN=${CN_DOMAIN}" \
  -key ${CERTDIR}/ca.key \
  -out ${CERTDIR}/ca.crt

# 获得服务器证书

## 创建自己的私钥 
openssl genrsa -out ${CERTDIR}/${CN_DOMAIN}.key 4096

## 生成证书签名请求
openssl req -sha512 -new \
  -subj "/C=TW/ST=Taipei/L=Taipei/O=example/OU=Personal/CN=${CN_DOMAIN}" \
  -key ${CERTDIR}/${CN_DOMAIN}.key \
  -out ${CERTDIR}/${CN_DOMAIN}.csr 

## 生成注册表主机的证书
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth 
subjectAltName = @alt_names

[alt_names]
DNS.1=yourdomain.com
DNS.2=yourdomain
DNS.3=hostname
EOF

openssl x509 -req -sha512 -days 3650 \
  -extfile v3.ext \
  -CA ca.crt -CAkey ca.key -CAcreateserial \
  -in ${CERTDIR}/${CN_DOMAIN}.csr \
  -out ${CERTDIR}/${CN_DOMAIN}.crt

# openssl req -x509 -new -nodes -key ${CERTDIR}/server.key -subj "/CN=${CN_DOMAIN}" -days 5000 -out ${CERTDIR}/server.crt

openssl x509 -inform PEM -in ${CERTDIR}/${CN_DOMAIN}.crt -out ${CERTDIR}/${CN_DOMAIN}.cert

mkdir -p /etc/docker/certs.d/${CN_DOMAIN}

scp ${CERTDIR}/${CN_DOMAIN}.cert root@harbor:/etc/docker/certs.d/${CN_DOMAIN}/
scp ${CERTDIR}/${CN_DOMAIN}.key root@harbor:/etc/docker/certs.d/${CN_DOMAIN}/
scp ${CERTDIR}/ca.crt root@harbor:/etc/docker/certs.d/${CN_DOMAIN}/

cat /etc/docker/daemon.json
 "insecure-registries": [
        "https://${CN_DOMAIN}"
    ],

systemctl restart docker
docker login ${CN_DOMAIN}

/usr/local/harbor/install.sh --with-notary --with-clair --with-chartmuseum

启动Harbor
# docker-compose start
停止Harbor
# docker-comose stop
重启Harbor
# docker-compose restart

root@ubuntu:~/harbor# docker-compose ps
       Name                     Command               State                                Ports
----------------------------------------------------------------------------
harbor-adminserver   /harbor/start.sh                 Up
harbor-core          /harbor/start.sh                 Up
harbor-db            /entrypoint.sh postgres          Up      5432/tcp
harbor-jobservice    /harbor/start.sh                 Up
harbor-log           /bin/sh -c /usr/local/bin/ ...   Up      127.0.0.1:1514->10514/tcp
harbor-portal        nginx -g daemon off;             Up      80/tcp
nginx                nginx -g daemon off;             Up      0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp, 0.0.0.0:80->80/tcp
redis                docker-entrypoint.sh redis ...   Up      6379/tcp
registry             /entrypoint.sh /etc/regist ...   Up      5000/tcp
registryctl          /harbor/start.sh                 Up

_version = 1.7.0
# 修改harbor地址
hostname = 172.16.198.133
# http or https
ui_url_protocol = https
# job_server中最大job节点数量
max_job_workers = 10
# 是否开启自定义证书
customize_crt = on
# https证书位置
ssl_cert = /data/cert/server.crt
ssl_cert_key = /data/cert/server.key
# secretkey保存目录
secretkey_path = /data/harbor
admiral_url = NA
# 日志相关
log_rotate_count = 50
log_rotate_size = 200M
# 代理相关
http_proxy =
https_proxy =
no_proxy = 127.0.0.1,localhost,core,registry
# 邮件配置
email_identity =
email_server = smtp.mydomain.com
email_server_port = 25
email_username = sample_admin@mydomain.com
email_password = abc
email_from = admin <sample_admin@mydomain.com>
email_ssl = false
email_insecure = false
# 初始admin密码
harbor_admin_password = Harbor123456
# 验证方式 db_auth or ldap_auth 
auth_mode = db_auth
# ldap配置
ldap_url = ldaps://ldap.mydomain.com
ldap_basedn = ou=people,dc=mydomain,dc=com
ldap_uid = uid
ldap_scope = 2
ldap_timeout = 5
ldap_verify_cert = true
ldap_group_basedn = ou=group,dc=mydomain,dc=com
ldap_group_filter = objectclass=group
ldap_group_gid = cn
ldap_group_scope = 2
# 是否禁止用户注册
self_registration = off
# token失效时间
token_expiration = 30
# 创建项目权限 everyone or adminonly
project_creation_restriction = adminonly
# 连接数据库配置
db_host = postgresql
db_password = root123
db_port = 5432
db_user = postgres
# 连接redis配置
redis_host = redis
redis_port = 6379
redis_password =
redis_db_index = 1,2,3
# clair_db配置
clair_db_host = postgresql
clair_db_password = root123
clair_db_port = 5432
clair_db_username = postgres
clair_db = postgres
clair_updaters_interval = 12
# uaa认证配置
uaa_endpoint = uaa.mydomain.org
uaa_clientid = id
uaa_clientsecret = secret
uaa_verify_cert = true
uaa_ca_cert = /path/to/ca.pem
# registry配置
registry_storage_provider_name = filesystem
registry_storage_provider_config =
registry_custom_ca_bundle =