Linux之Docker 添加用户认证
私有仓库的TLS加密

以上仓库使用明文的方式，并且没有认证。存在较大的安全隐患，下面介绍使用TLS加密以及用户认证。

为docker仓库添加证书加密功能

docker远程主机访问私有仓库，默认必须使用TLS加密

1 生成证书

[root@toto6 ~]# mkdir -p certs
[root@toto6 ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/toto.com.key -x509 -days 365 -out certs/toto.com.crt
Generating a 4096 bit RSA private key
…++
…++
writing new private key to ‘certs/toto.com.key’
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:shaanxi
Locality Name (eg, city) [Default City]:xi’an
Organization Name (eg, company) [Default Company Ltd]:westos
Organizational Unit Name (eg, section) []:docker
Common Name (eg, your name or your server’s hostname) []:toto.com
Email Address []:root@toto.com
[root@toto6 ~]# ls certs/
toto.com.crt toto.com.key # 成功生成证书
1

2、重新启动registry容器：
需要先删除之前开启的容器“

[root@toto6 ~]# docker rm -f registry
registry

重新加密开启容器：

root@toto6 ~]# docker run -d ##-d：打入后台

–restart=always > --name registry \
-v “$(pwd)”/certs:/certs

-v：手动指定数据卷的挂载

-e REGISTRY_HTTP_ADDR=0.0.0.0:443 ##-e：编辑registry的参数；监听443端口
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/toto.com.crt ##使用证书为生成的证书
-e REGISTRY_HTTP_TLS_KEY=/certs/toto,com.key ##使用的私钥
-p 443:443 ##端口映射
registry:2 ##仓库名

查看容器运行情况以及端口开启情况：

[root@toto6 ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d3063593b314 registry:2 “/entrypoint.sh /etc…” 33 seconds ago Up 31 seconds 0.0.0.0:443->443/tcp, 5000/tcp registry
[root@toto6 ~]# netstat -antlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 656/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 778/master
tcp 0 0 172.25.13.160:22 172.25.13.250:59964 ESTABLISHED 20132/sshd: root@pt
tcp6 0 0 :::22 :: LISTEN 656/sshd
tcp6 0 0 ::1:25 :: LISTEN 778/master
tcp6 0 0 :::443 :: LISTEN 21555/docker-proxy
1

到次registry服务端的TLS加密已经设置好了，但是diocker客户端需要连接这个仓库，也就需要相同的证书才能进行访问。

docker客户端的设置。

设置docker客户端的证书

[root@toto6 ~]# mkdir -p /etc/docker/certs.d/toto.com # 创建该目录，名称和证书域名一致
[root@toto6 ~]# cd /etc/docker/certs.d/toto.com
[root@toto6 toto.com]# cp /root/certs/toto.com.crt ca.crt # 将生成的证书拷贝到该目录中ca.crt
[root@toto6 toto.com]# ls
ca.crt

证书域名解析的更改

[root@toto6 toto.com]# vim /etc/hosts
172.25.13.160 toto6 toto.com
1
2
3 验证部署是否成功

修改本地镜像标签为固定格式：域名/进行名称

[root@toto6 toto.com]# docker tag nginx:v4 toto.com/nginx
1
上传镜像：

[root@toto6 toto.com]# docker push toto.com/nginx
The push refers to repository [toto.com/nginx]
49cb414524e0: Pushed
668afdbd4462: Pushed

latest: digest: sha256:a3e3cbec11f49a4fdebedf975fadbe6dc8cd9e26835fc3018353d7d7f3bdf93b size: 739

作者：若无其事的苹果
来源：CSDN
原文：https://blog.csdn.net/qq_36016375/article/details/96048239
版权声明：本文为博主原创文章，转载请附上博文链接！