debian12 创建本地harbor镜像库

后港水半咸淡

前言

harbor是一个docker/podman镜像管理库，可用于存储私人镜像。现将本人在debian12系统搭建harbor镜像库的过程记录下来，留作后续参考。
可以参考github harbor项目给定的安装教程，很详细了:https://goharbor.io/docs/2.11.0/install-config/configure-https/
本篇博客着重参考了博客园另一位作者的文章 私有镜像仓库harbor之手把手搭建步骤，在此基础上做了一些补充。
正文

harbor 镜像管理库依赖于docker环境，并且会使用 docker-compose 的方式启动，所以需要先安装docker以及docker-compose，然后从github下载harbor离线安装包安装。由于是个人学习实验使用，安装环境是本地的debian12，安装全程使用root用户。
harbor安装包使用github目前最新的版本：https://github.com/goharbor/harbor/releases/download/v2.9.5-rc1/harbor-offline-installer-v2.9.5-rc1.tgz
根据官网上的说法，harbor对于环境有一定要求：
- 硬件要求

The following table lists the minimum and recommended hardware configurations for deploying Harbor.
ResourceMinimumRecommendedCPU2 CPU4 CPUMem4 GB8 GBDisk40 GB160 GB- 软件要求

The following table lists the software versions that must be installed on the target host.
SoftwareVersionDescriptionDocker EngineVersion 20.10.10-ce+ or higherFor installation instructions, see Docker Engine documentationDocker Composedocker-compose (v1.18.0+) or docker compose v2 (docker-compose-plugin)For installation instructions, see Docker Compose documentationOpenSSLLatest is preferredUsed to generate certificate and keys for Harbor- 网络端口要求

Harbor requires that the following ports be open on the target host.
PortProtocolDescription443HTTPSHarbor portal and core API accept HTTPS requests on this port. You can change this port in the configuration file.4443HTTPSConnections to the Docker Content Trust service for Harbor. You can change this port in the configuration file.80HTTPHarbor portal and core API accept HTTP requests on this port. You can change this port in the configuration file.1. 安装docker

1. apt update
2. apt install docker.io
3. docker --version
4. # Docker version 20.10.24+dfsg1, build 297e128

复制代码

配置docker镜像

1. cd /etc/docker/
2. touch daemon.json

复制代码

编辑 daemon.json (如果这个不可用，需要自行寻找可用镜像源)

1. {
2.     "registry-mirrors": ["https://docker.nastool.de"]
3. }

复制代码

测试docker镜像可用性 -- 可略过

1. docker search hello-world
2. # NAME                                   DESCRIPTION                                     # STARS     OFFICIAL   AUTOMATED
3. # hello-world                            Hello World! (an example of minimal Dockeriz…   2269      [OK]
5. docker pull hello-world
6. docker images |grep hello-world
7. # hello-world                     latest    d2c94e258dcb   14 months ago   13.3kB
8. docker run --rm --name=tst hello-world
10. # Hello from Docker!
11. # This message shows that your installation appears to be working correctly.
12. #
13. # To generate this message, Docker took the following steps:
14. #  1. The Docker client contacted the Docker daemon.
15. #  2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
16. #     (amd64)
17. #  3. The Docker daemon created a new container from that image which runs the
18. #     executable that produces the output you are currently reading.
19. #  4. The Docker daemon streamed that output to the Docker client, which sent it to your terminal.
21. # To try something more ambitious, you can run an Ubuntu container with:
22. #  $ docker run -it ubuntu bash
24. # Share images, automate workflows, and more with a free Docker ID:
25. #  https://hub.docker.com/
27. # For more examples and ideas, visit:
28. #  https://docs.docker.com/get-started/

复制代码

2. 安装docker-complose

1. apt install docker-compose
2. # docker-compose version 1.29.2, build unknown

复制代码

3. 下载harbor安装包

从github下载安装包，安装包比较大(621M)，需要想办法下载。

1. # 比如下载到/root/harbor/目录
2. mkdir -p /root/harbor
3. cd /root/harbor
5. # 可以用aria2c下载
6. # apt install aria2c
8. # 从这个页面找到最新安装包或最适合的版本 https://github.com/goharbor/harbor/releases
10. # 下面的链接是我用浏览器点击下载后获取到的下载链接，应该会变，需要实时获取
12. aria2c "https://objects.githubusercontent.com/github-production-release-asset-2e65be/50613991/8905e864-0824-4b9c-87c1-44a9e0b4db4f?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240630%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240630T170549Z&X-Amz-Expires=300&X-Amz-Signature=484b6cdee5c9f515d800c41cbf3253d918b470b9d9401db224d2a1cfd36fc021&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=50613991&response-content-disposition=attachment%3B%20filename%3Dharbor-offline-installer-v2.9.5-rc1.tgz&response-content-type=application%2Foctet-stream"

复制代码

4. 解压缩 & 创建文件夹

1. cd /root/harbor
2. tar -zxvf ./harbor-offline-installer-v2.9.5-rc1.tgz -C /opt
3. cd /opt/harbor/
4. mkdir -p /opt/harbor/certs
5. mkdir -p /opt/harbor/data

复制代码

5. 准备证书

harbor 安装时内部使用了nginx, 从浏览器访问网页需要用到证书（https 单向认证）
更详细介绍可以参考：https://goharbor.io/docs/2.11.0/install-config/configure-https/

1. cd /opt/harbor/certs
3. # 我把官网的制作证书的过程写到了shell中
4. touch mkcerts.sh

复制代码

mkcerts.sh

1. #!/bin/bash
2. # 你想要配置的域名 -- 需要按需修改
3. domain=brian-harbor
4. # 域名全称
5. host=${domain}.com
6. # 证书私钥 (docker-compose启动时)需要的证书私钥
7. key=${host}.key
8. # 证书申请文件 - 用于申请证书
9. csr=${host}.csr
10. # harbor (docker-compose启动时)需要的证书
11. crt=${host}.crt
12. # docker 需要配置的证书，基于crt生成
13. cert=${host}.cert
14. # 部署harbor的主机名称 -- 需要按需修改
15. ip=192.168.1.9
18. # ca 证书
19. openssl genrsa -out ca.key 4096
20. openssl req -x509 -new -nodes -sha512 -days 3650 \
21. -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=MyPersonal Root CA" \
22. -key ca.key \
23. -out ca.crt
25. # cert 域名证书
26. openssl genrsa -out ${key} 4096
27. openssl req -sha512 -new \
28.     -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=${host}" \
29.     -key ${key} \
30.     -out ${csr}
32. cat > v3.ext <<-EOF
33. authorityKeyIdentifier=keyid,issuer
34. basicConstraints=CA:FALSE
35. keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
36. extendedKeyUsage = serverAuth
37. subjectAltName = @alt_names
39. [alt_names]
40. DNS.1=${host}
41. DNS.2=${domain}
42. DNS.3=${ip}
43. EOF
45. openssl x509 -req -sha512 -days 3650 \
46.     -extfile v3.ext \
47.     -CA ca.crt -CAkey ca.key -CAcreateserial \
48.     -in ${csr} \
49.     -out ${crt}
51. openssl x509 -inform PEM -in ${crt} -out ${cert}

复制代码

打开浏览器，访问 https://192.168.1.9, 浏览器会提示证书不可信，选择跳过。

输入admin/Harbor12345进入

8. 设备登陆测试

• harbor本机登陆
  

1. # 制作证书
2. chmod +x mkcerts.sh
3. ./mkcerts.sh
4. ls
5. # brian-harbor.com.cert  brian-harbor.com.crt  brian-harbor.com.csr  brian-harbor.com.key  ca.crt  ca.key  ca.srl  mkcerts.sh  v3.ext

复制代码

• 另一台设备登陆
  

1. vim /etc/hosts
2. # 添加一行
3. 192.168.1.9 brian-harbor.com

复制代码

参考文章

[1]. 私有镜像仓库harbor之手把手搭建步骤
[2]. https://goharbor.io/docs/2.11.0/install-config/configure-https/

来源:https://www.cnblogs.com/brian-sun/p/18277288
免责声明：由于采集信息均来自互联网，如果侵犯了您的权益，请联系我们【E-Mail:cb@itdo.tech】 我们会及时删除侵权内容，谢谢合作！