{"path":"913268","ref":"harbor安装.md","title":"harbor安装","content":"## Harbor 简介\nDocker容器应用的开发和运行离不开可靠的镜像管理，虽然Docker官方也提供了公共的镜像仓库，但是从安全和效率等方面考虑，部署我们私有环境内的Registry也是非常必要的。Harbor是由VMware公司开源的企业级的Docker Registry管理项目，它包括权限管理(RBAC)、LDAP、日志审核、管理界面、自我注册、镜像复制和中文支持等功能。\n
\n## 一、 安装环境准备\n注意：Harbor的所有服务组件都是在Docker中部署的，所以官方安装使用Docker-compose快速部署，所以我们需要安装Docker、Docker-compose。由于Harbor是基于Docker Registry V2版本，所以就要求Docker版本不小于1.10.0，Docker-compose版本不小于1.6.0。\n
\n## 二、安装Harbor\n~~~\nmkdir \/data\/\ncd \/data\/\nwget https:\/\/storage.googleapis.com\/harbor-releases\/release-1.6.0\/harbor-offline-installer-v1.6.0.tgz\ntar xvzf harbor-offline-installer-v1.6.0.tgz\ncd harbor\nvi harbor.cfg\nhostname = 192.168.186.129 \/\/自行更改为服务器内部ip\n.\/install.sh\n~~~\n\n若需要修改配置\n\n~~~\ndocker-compose down -v\nvim harbor.cfg\nprepare\ndocker-compose up -d\n~~~\n\n重启\n\n~~~\ndocker-compose stop\ndocker-compose start\n~~~\n\n
\n\n## 三、 登录harbor\n地址：`http:\/\/192.168.186.129` \n用户名：`admin` \n密码：`Harbor12345`\n
\n## 四、测试推送\n1.admin登录\n\n~~~\n$ docker login 192.168.186.129\nUsername: admin\nPassword:\nLogin Succeeded\n~~~\n\n2.给镜像打tag\n\n~~~\n$ docker tag nginx 192.168.186.129\/blade\/nginx:latest\n$ docker images\nREPOSITORY TAG IMAGE ID CREATED SIZE\nnginx latest 958a7ae9e569 1 weeks ago 109 MB\n192.168.186.129\/blade\/nginx latest 958a7ae9e569 1 weeks ago 109 MB\n~~~\n\n3.push到仓库\n\n~~~\n$ docker push 192.168.186.129\/blade\/nginx\nThe push refers to a repository [192.168.186.129\/blade\/nginx]\na552ca691e49: Pushed\n7487bf0353a7: Pushed\n8781ec54ba04: Pushed\nlatest: digest: sha256:41ad9967ea448d7c2b203c699b429abe1ed5af331cd92533900c6d77490e0268 size: 948\n~~~\n\n
\n\n## 五、开放2375端口\n注意：在外网开放有安全风险，只推荐在内网对外开放 \n`vi \/lib\/systemd\/system\/docker.service` \n在\\[Service\\]节点下方增加\n\n~~~\nExecStart=\nExecStart=\/usr\/bin\/dockerd -H tcp:\/\/0.0.0.0:2375 -H unix:\/\/var\/run\/docker.sock\n~~~\n\n~~~\nsystemctl daemon-reload\nsystemctl restart docker\ndocker-compose stop\ndocker-compose start\nfirewall-cmd --add-port=2375\/tcp --permanent\nservice firewalld restart\n~~~\n\n
\n\n## 六、maven配置\n~~~\n\n com.spotify<\/pluginGroup> \n<\/pluginGroups>\n\n\n 192.168.186.129<\/id>\n admin<\/username>\n Harbor12345<\/password>\n \n smallchill@163.com<\/email>\n <\/configuration>\n<\/server>\n~~~\n\n
\n\n## 七、FAQ\n1.配置并启动Harbor之后，本地执行登录操作，报错：\n\n~~~\ndocker login 192.168.186.129\nUsername: admin\nPassword:\nError response from daemon: Get https:\/\/192.168.186.129\/v1\/users\/: dial tcp 192.168.186.129:443: getsockopt: connection refused\n~~~\n\n这是因为docker1.3.2版本开始默认docker registry使用的是https，我们设置Harbor默认http方式，所以当执行用docker login、pull、push等命令操作非https的docker regsitry的时就会报错。 \n解决办法：配置`\/etc\/docker\/daemon.json`\n\n~~~\n[root@localhost harbor]# vi \/etc\/docker\/daemon.json \n{\n \"registry-mirrors\": [\"https:\/\/3dse7md.mirror.aliyuncs.com\"]\n}\n~~~\n\n将其修改为：\n\n~~~\n{\n \"registry-mirrors\": [\"https:\/\/3dse7md.mirror.aliyuncs.com\"],\n \"insecure-registries\":[\"192.168.186.129\"]\n}\n~~~\n\n重启\n\n~~~\n[root@localhost harbor]# systemctl daemon-reload && systemctl restart docker\n~~~\n\n2.使用非admin账户执行docker pull命令时，报错\n\n~~~\n$ docker pull 192.168.186.129\/blade\/nginx:latest\nError response from daemon: repository 192.168.186.129\/blade\/nginx not found: does not exist or no pull access\n~~~\n\n这是原因可能有，一是Harbor仓库上blade\/nginx确实不存在，二是项目未设置公开的时候，该账户未执行docker login 192.168.186.129登录操作，三是该账户对192.168.186.129\/blade项目没有权限，需要在该项目下增加blade成员，并选择角色。\n\n3.如果需要修改Harbor的配置文件harbor.cfg，因为Harbor是基于docker-compose服务编排的，我们可以使用docker-compose命令重启Harbor。不修改配置文件，重启Harbor命令：docker-compose start | stop | restart\n\n~~~\n\/\/停止Harbor\n$ docker-compose down -v\nStopping nginx ... done\nStopping harbor-jobservice ... done\n......\nRemoving harbor-log ... done\nRemoving network harbor_harbor\n\n\/\/启动Harbor\n$ docker-compose up -d\nCreating network \"harbor_harbor\" with the default driver\nCreating harbor-log ... \n......\nCreating nginx\nCreating harbor-jobservice ... done\n~~~\n\n\n\n\n\n"}