debian12 创建本地harbor镜像库

前言

harbor是一个docker/podman镜像管理库，可用于存储私人镜像。现将本人在debian12系统搭建harbor镜像库的过程记录下来，留作后续参考。

可以参考github harbor项目给定的安装教程，很详细了:https://goharbor.io/docs/2.11.0/install-config/configure-https/

本篇博客着重参考了博客园另一位作者的文章私有镜像仓库harbor之手把手搭建步骤，在此基础上做了一些补充。

正文

harbor 镜像管理库依赖于docker环境，并且会使用 docker-compose 的方式启动，所以需要先安装docker以及docker-compose，然后从github下载harbor离线安装包安装。由于是个人学习实验使用，安装环境是本地的debian12，安装全程使用root用户。

harbor安装包使用github目前最新的版本：https://github.com/goharbor/harbor/releases/download/v2.9.5-rc1/harbor-offline-installer-v2.9.5-rc1.tgz

根据官网上的说法，harbor对于环境有一定要求：

- 硬件要求

The following table lists the minimum and recommended hardware configurations for deploying Harbor.

Resource	Minimum	Recommended
CPU	2 CPU	4 CPU
Mem	4 GB	8 GB
Disk	40 GB	160 GB

- 软件要求

The following table lists the software versions that must be installed on the target host.

Software	Version	Description
Docker Engine	Version 20.10.10-ce+ or higher	For installation instructions, see Docker Engine documentation
Docker Compose	docker-compose (v1.18.0+) or docker compose v2 (docker-compose-plugin)	For installation instructions, see Docker Compose documentation
OpenSSL	Latest is preferred	Used to generate certificate and keys for Harbor

- 网络端口要求

Harbor requires that the following ports be open on the target host.

Port	Protocol	Description
443	HTTPS	Harbor portal and core API accept HTTPS requests on this port. You can change this port in the configuration file.
4443	HTTPS	Connections to the Docker Content Trust service for Harbor. You can change this port in the configuration file.
80	HTTP	Harbor portal and core API accept HTTP requests on this port. You can change this port in the configuration file.

1. 安装docker

apt update
apt install docker.io
docker --version
# Docker version 20.10.24+dfsg1, build 297e128

配置docker镜像

cd /etc/docker/
touch daemon.json

编辑 daemon.json (如果这个不可用，需要自行寻找可用镜像源)

{
    "registry-mirrors": ["https://docker.nastool.de"]
}

测试docker镜像可用性 -- 可略过

docker search hello-world
# NAME                                   DESCRIPTION                                     # STARS     OFFICIAL   AUTOMATED
# hello-world                            Hello World! (an example of minimal Dockeriz…   2269      [OK]

docker pull hello-world
docker images |grep hello-world
# hello-world                     latest    d2c94e258dcb   14 months ago   13.3kB
docker run --rm --name=tst hello-world

# Hello from Docker!
# This message shows that your installation appears to be working correctly.
#
# To generate this message, Docker took the following steps:
#  1. The Docker client contacted the Docker daemon.
#  2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
#     (amd64)
#  3. The Docker daemon created a new container from that image which runs the
#     executable that produces the output you are currently reading.
#  4. The Docker daemon streamed that output to the Docker client, which sent it to your terminal.

# To try something more ambitious, you can run an Ubuntu container with:
#  $ docker run -it ubuntu bash

# Share images, automate workflows, and more with a free Docker ID:
#  https://hub.docker.com/

# For more examples and ideas, visit:
#  https://docs.docker.com/get-started/

2. 安装docker-complose

apt install docker-compose
# docker-compose version 1.29.2, build unknown

3. 下载harbor安装包

从github下载安装包，安装包比较大(621M)，需要想办法下载。

# 比如下载到/root/harbor/目录
mkdir -p /root/harbor
cd /root/harbor

# 可以用aria2c下载
# apt install aria2c

# 从这个页面找到最新安装包或最适合的版本 https://github.com/goharbor/harbor/releases

# 下面的链接是我用浏览器点击下载后获取到的下载链接，应该会变，需要实时获取

aria2c "https://objects.githubusercontent.com/github-production-release-asset-2e65be/50613991/8905e864-0824-4b9c-87c1-44a9e0b4db4f?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240630%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240630T170549Z&X-Amz-Expires=300&X-Amz-Signature=484b6cdee5c9f515d800c41cbf3253d918b470b9d9401db224d2a1cfd36fc021&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=50613991&response-content-disposition=attachment%3B%20filename%3Dharbor-offline-installer-v2.9.5-rc1.tgz&response-content-type=application%2Foctet-stream"

4. 解压缩 & 创建文件夹

cd /root/harbor
tar -zxvf ./harbor-offline-installer-v2.9.5-rc1.tgz -C /opt
cd /opt/harbor/
mkdir -p /opt/harbor/certs
mkdir -p /opt/harbor/data

5. 准备证书

harbor 安装时内部使用了nginx, 从浏览器访问网页需要用到证书（https 单向认证）
更详细介绍可以参考：https://goharbor.io/docs/2.11.0/install-config/configure-https/

cd /opt/harbor/certs

# 我把官网的制作证书的过程写到了shell中
touch mkcerts.sh

mkcerts.sh

#!/bin/bash
# 你想要配置的域名 -- 需要按需修改
domain=brian-harbor
# 域名全称
host=${domain}.com
# 证书私钥 (docker-compose启动时)需要的证书私钥
key=${host}.key
# 证书申请文件 - 用于申请证书
csr=${host}.csr
# harbor (docker-compose启动时)需要的证书
crt=${host}.crt
# docker 需要配置的证书，基于crt生成
cert=${host}.cert
# 部署harbor的主机名称 -- 需要按需修改
ip=192.168.1.9


# ca 证书
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=MyPersonal Root CA" \
 -key ca.key \
 -out ca.crt

# cert 域名证书
openssl genrsa -out ${key} 4096
openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=${host}" \
    -key ${key} \
    -out ${csr}

cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=${host}
DNS.2=${domain}
DNS.3=${ip}
EOF

openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in ${csr} \
    -out ${crt}

openssl x509 -inform PEM -in ${crt} -out ${cert}

# 制作证书
chmod +x mkcerts.sh
./mkcerts.sh
ls
# brian-harbor.com.cert  brian-harbor.com.crt  brian-harbor.com.csr  brian-harbor.com.key  ca.crt  ca.key  ca.srl  mkcerts.sh  v3.ext

6. 准备环境

如果用的本地服务器，没有域名，需要用修改/etc/hosts的方式添加域名解析地址

vim /etc/hosts
# 添加一行
192.168.1.9 brian-harbor.com

给docker.service添加步骤5生成的证书，否则可能造成docker login时报错证书未识别

cd /etc/docker
mkdir -p /etc/docker/certs.d
# 下面的域名文件夹要换成你自己的
mkdir -p /etc/docker/certs.d/brian-harbor.com/
# 这个未详细测试
mkdir -p /etc/docker/certs.d/192.168.1.9/

# 将步骤5生成的证书放入上方新建的子文件夹
cp /opt/harbor/certs/brian-harbor.com.cert /etc/docker/certs.d/brian-harbor.com/
cp /opt/harbor/certs/brian-harbor.com.key /etc/docker/certs.d/brian-harbor.com/
cp /opt/harbor/certs/ca.crt /etc/docker/certs.d/brian-harbor.com/

#  将/etc/docker/certs.d/brian-harbor.com/内容 复制给 /etc/docker/certs.d/192.168.1.9/ 一份
cp /etc/docker/certs.d/brian-harbor.com/* /etc/docker/certs.d/192.168.1.9/

# 最终效果
.
├── certs.d
│   ├── 192.168.1.9
│   │   ├── brian-harbor.com.cert
│   │   ├── brian-harbor.com.key
│   │   └── ca.crt
│   └── brian-harbor.com
│       ├── brian-harbor.com.cert
│       ├── brian-harbor.com.key
│       └── ca.crt
├── daemon.json
└── key.json

重启docker服务

systemctl restart docker

7. 配置harbor配置文件

cd /opt/harbor/
cp harbor.yml.tmpl harbor.yml

修改 harbor.yml (如果端口号80/443已经被其他服务占用，需要修改成其他的)

# ......
# 改成你自己的域名
hostname: brian-harbor.com

# ......

http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 80

# https related config
https:
  # https port for harbor, default is 443
  port: 443
  # The path of cert and key files for nginx
  certificate: /opt/harbor/certs/brian-harbor.com.crt
  private_key: /opt/harbor/certs/brian-harbor.com.key

# ......

# admin用户对应的用户名
harbor_admin_password: Harbor12345

# The default data volume
data_volume: /opt/harbor/data

安装harbor

cd /opt/harbor
./prepare
./install.sh
# 如果运行过程报错找不到/hostfs/opt/certs/xxx ，需要核对下/opt/certs/xxx 是否存在，然后再去检查harbor.yml

# 安装完毕，发现docker启动了很多容器
docker-compose ps

 Name                     Command                  State                                          Ports
------------------------------------------------------------------------------------------------------------------------------------------------
harbor-core         /harbor/entrypoint.sh            Up (healthy)
harbor-db           /docker-entrypoint.sh 13 14      Up (healthy)
harbor-jobservice   /harbor/entrypoint.sh            Up (healthy)
harbor-log          /bin/sh -c /usr/local/bin/ ...   Up (healthy)   127.0.0.1:1514->10514/tcp
harbor-portal       nginx -g daemon off;             Up (healthy)
nginx               nginx -g daemon off;             Up (healthy)   0.0.0.0:80->8080/tcp,:::80->8080/tcp, 0.0.0.0:443->8443/tcp,:::443->8443/tcp
redis               redis-server /etc/redis.conf     Up (healthy)
registry            /home/harbor/entrypoint.sh       Up (healthy)
registryctl         /home/harbor/start.sh            Up (healthy)

# 停止并删除容器和卷 docker-compose down -v
# 启动容器 docker-compose up -d
# 重启 docker-compose restart
# 查看状态 docker-compose ps

打开浏览器，访问 https://192.168.1.9, 浏览器会提示证书不可信，选择跳过。

输入admin/Harbor12345进入

8. 设备登陆测试

harbor本机登陆

docker login -u admin brian-harbor.com
# WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
# Configure a credential helper to remove this warning. See
# https://docs.docker.com/engine/reference/commandline/login/#credentials-store

# Login Succeeded

另一台设备登陆

# 准备另一台设备，我用了一个ubuntu22虚拟机 + podman，podman 和 docker指令几乎一摸一样，以下的指令可以将podman换成docker使用

# 修改/etc/hosts
192.168.1.9 brian-harbor.com

# 登陆测试，我这里很奇怪，可能强制要求信任对方域名ca，需要指定ca证书路径，否则会报错
# 需要将 6. 准备环境 中做出来的ca.crt 拷贝到这个虚拟机中，我放在了 /root/harbor/ca.crt

podman login -u admin brian-harbor.com
Password: 
Error: authenticating creds for "brian-harbor.com": pinging container registry brian-harbor.com: Get "https://brian-harbor.com/v2/": x509: certificate signed by unknown authority

# 需要指定ca文件夹路径
podman login --cert-dir /root/harbor/ -u admin brian-harbor.com
Login Succeeded!

# push 镜像
podman push brian-harbor.com/library/redis:latest --cert-dir /home/brian/harbor/

# 带上 --cert-dir 还是很别扭的，这个问题还要进一步研究更好的解决方式
# 估计需要配置本机的可信任ca