私有仓库的TLS加密
以上仓库使用明文的方式，并且没有认证。存在较大的安全隐患，下面介绍使用TLS加密以及用户认证。
为docker仓库添加证书加密功能
docker远程主机访问私有仓库，默认必须使用TLS加密
1 生成证书
[root@toto6 ~]# mkdir -p certs
[root@toto6 ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/toto.com.key -x509 -days 365 -out certs/toto.com.crt
Generating a 4096 bit RSA private key
…++
…++
writing new private key to ‘certs/toto.com.key’
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:shaanxi
Locality Name (eg, city) [Default City]:xi’an
Organization Name (eg, company) [Default Company Ltd]:westos
Organizational Unit Name (eg, section) []:docker
Common Name (eg, your name or your server’s hostname) []:toto.com
Email Address []:[email protected]
[root@toto6 ~]# ls certs/
toto.com.crt toto.com.key # 成功生成证书
1
2、重新启动registry容器：
需要先删除之前开启的容器“
[root@toto6 ~]# docker rm -f registry
registry
1
2
重新加密开启容器：
root@toto6 ~]# docker run -d \ ##-d：打入后台
查看容器运行情况以及端口开启情况：
[root@toto6 ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d3063593b314 registry:2 “/entrypoint.sh /etc…” 33 seconds ago Up 31 seconds 0.0.0.0:443->443/tcp, 5000/tcp registry
[root@toto6 ~]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 656/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 778/master
tcp 0 0 172.25.13.160:22 172.25.13.250:59964 ESTABLISHED 20132/sshd: root@pt
tcp6 0 0 :::22 ::😗 LISTEN 656/sshd
tcp6 0 0 ::1:25 ::😗 LISTEN 778/master
tcp6 0 0 :::443 ::😗 LISTEN 21555/docker-proxy
1
到次registry服务端的TLS加密已经设置好了，但是diocker客户端需要连接这个仓库，也就需要相同的证书才能进行访问。
docker客户端的设置。
设置docker客户端的证书
[root@toto6 ~]# mkdir -p /etc/docker/certs.d/toto.com # 创建该目录，名称和证书域名一致
[root@toto6 ~]# cd /etc/docker/certs.d/toto.com
[root@toto6 toto.com]# cp /root/certs/toto.com.crt ca.crt # 将生成的证书拷贝到该目录中ca.crt
[root@toto6 toto.com]# ls
ca.crt
1
2
3
4
5
证书域名解析的更改
[root@toto6 toto.com]# vim /etc/hosts
172.25.13.160 toto6 toto.com
1
2
3 验证部署是否成功
修改本地镜像标签为固定格式：域名/进行名称
[root@toto6 toto.com]# docker tag nginx:v4 toto.com/nginx
1
上传镜像：
[root@toto6 toto.com]# docker push toto.com/nginx
The push refers to repository [toto.com/nginx]
49cb414524e0: Pushed
668afdbd4462: Pushed
latest: digest: sha256:a3e3cbec11f49a4fdebedf975fadbe6dc8cd9e26835fc3018353d7d7f3bdf93b size: 739