docker private Registry 생성(개인 저장소)

DOCKER private Registry 생성

 

[certs 폴더에 개인키 생성]

# mkdir certs && cd certs && openssl genrsa -des3 -out server.key 2048

Generating RSA private key, 2048 bit long modulus

.............................................................+++

...................................+++

e is 65537 (0x10001)

Enter pass phrase for server.key:

Verifying - Enter pass phrase for server.key: <<비밀번호 입력>>

 

[인증 요청서 생성]

# openssl req -new -key server.key -out server.csr

Enter pass phrase for server.key:

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:kr

State or Province Name (full name) []:seoul

Locality Name (eg, city) [Default City]:city

Organization Name (eg, company) [Default Company Ltd]:<<회사명>>

Organizational Unit Name (eg, section) []:<<부서명>>

Common Name (eg, your name or your server's hostname) []:yucea

Email Address []:<<email>>

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:<<password>>

An optional company name []:<<company name>>

 

[개인키에서 패스워드 제거]

# cp server.key server.key.origin && openssl rsa -in server.key.origin -out server.key && rm server.key.origin

Enter pass phrase for server.key.origin:

writing RSA key

rm: remove 일반 파일 `server.key.origin'? y

 

[인증서 생성]

# openssl x509 -req -days 730 -in server.csr -signkey server.key -out server.crt

Signature ok

subject=/C=kr/ST=seoul/L=city/O=XX/OU=XXXX/CN=yucea/emailAddress=<<email>>

Getting Private key

 

[인증서 목록]

# ll

합계 12

-rw-r--r-- 1 root root 1257  1월 29 17:14 server.crt

-rw-r--r-- 1 root root 1086  1월 29 17:11 server.csr

-rw-r--r-- 1 root root 1675  1월 29 17:14 server.key

 

[Docker Private Registry 실행]

# docker run -d -p 5000:5000 --restart=always --name cms-registry \

  -v <<인증서경로>>:/certs \

  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/server.crt \

  -e REGISTRY_HTTP_TLS_KEY=/certs/server.key \

registry:latest

 

# docker run -d -p 5000:5000 --restart=always --name cms-registry \

  -v /home/npsadmin/certs:/certs \

  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/server.crt \

  -e REGISTRY_HTTP_TLS_KEY=/certs/server.key \

registry:latest

 

[docker registry 확인]

# docker ps -a

CONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS                   PORTS                    NAMES

735eaf5481ea        registry:latest        "/entrypoint.sh /e..."   11 days ago         Up 5 days                0.0.0.0:5000->5000/tcp   cms-registry

 

 

*쿠버네티스에서 docker 배포 할거라면 

[모든 worker서버에 insecure-registries 설정 추가]

# vi /etc/docker/daemon.json (파일 없었고 새로 생성함)

{

"insecure-registries" : ["192.168.0.141:5000"]

}

 

192.168.0.141 -> master server Ip 주소

 

-도커 재시작

# systemctl restart docker