本地搭建https registry 仓库

1. 生成 SSL 证书

创建证书目录

mkdir -p ~/registry/certs
cd ~/registry/certs

生成自签名证书

openssl req -x509 -newkey rsa:4096 -days 365 -nodes
-keyout registry.key -out registry.crt
-subj “/C=CN/ST=Beijing/L=Beijing/O=MyCompany/CN=registry.mycompany.com”

cd ~/registry
openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/registry.key -x509 -days 3650 -out certs/registry.crt

2. 创建认证文件

创建用户认证

sudo yum install -y httpd-tools
mkdir -p ~/registry/auth
htpasswd -Bc ~/registry/auth/htpasswd myuser

3. 创建 Docker Registry 配置

mkdir -p ~/registry/data
cat > ~/registry/config.yml << EOF
version: 0.1
log:
  fields:
    service: registry
storage:
  delete:
    enabled: true
  cache:
    blobdescriptor: inmemory
  filesystem:
    rootdirectory: /var/lib/registry
http:
  addr: :5000
  headers:
    X-Content-Type-Options: [nosniff]
  tls:
    certificate: /certs/registry.crt
    key: /certs/registry.key
auth:
  htpasswd:
    realm: basic-realm
    path: /auth/htpasswd
EOF

4.解决权限问题

chmod -R 777 ~/registry

启动 Registry 容器

docker run -itd \
  --name registry \
  --restart=always \
  -p 5000:5000 \
  -v ~/registry/data:/var/lib/registry \
  -v ~/registry/certs:/certs \
  -v ~/registry/auth:/auth \
  -v ~/registry/config.yml:/etc/docker/registry/config.yml \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \
  registry:2

6.修改 /etc/hosts 文件

echo "127.0.0.1 registry.mycompany.com" | sudo tee -a /etc/hosts

7. 客户端配置信任证书

# 将证书复制到 Docker 信任目录
sudo mkdir -p /etc/docker/certs.d/registry.mycompany.com:5000
sudo cp ~/registry/certs/registry.crt /etc/docker/certs.d/registry.mycompany.com:5000/ca.crt

# 重启 Docker 服务
sudo systemctl restart docker

登录

docker login registry.mycompany.com:5000 --username myuser --password mypass

docker tag 127.0.0.1:5000/busybox registry.mycompany.com:5000/busybox
docker push registry.mycompany.com:5000/busybox
docker tag  k8s.gcr.io/pause:3.5 registry.mycompany.com:5000/pause:3.5
docker push registry.mycompany.com:5000/pause:3.5