- A+
所属分类：linux技术
前言
harbor是一个docker/podman镜像管理库，可用于存储私人镜像。现将本人在debian12系统搭建harbor镜像库的过程记录下来，留作后续参考。
可以参考github harbor项目给定的安装教程，很详细了:https://goharbor.io/docs/2.11.0/install-config/configure-https/
本篇博客着重参考了博客园另一位作者的文章 私有镜像仓库harbor之手把手搭建步骤，在此基础上做了一些补充。
正文
harbor 镜像管理库依赖于docker环境，并且会使用 docker-compose 的方式启动，所以需要先安装docker以及docker-compose，然后从github下载harbor离线安装包安装。由于是个人学习实验使用，安装环境是本地的debian12，安装全程使用root用户。
harbor安装包使用github目前最新的版本：https://github.com/goharbor/harbor/releases/download/v2.9.5-rc1/harbor-offline-installer-v2.9.5-rc1.tgz
根据官网上的说法，harbor对于环境有一定要求：
- 硬件要求
The following table lists the minimum and recommended hardware configurations for deploying Harbor.
| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 2 CPU | 4 CPU |
| Mem | 4 GB | 8 GB |
| Disk | 40 GB | 160 GB |
- 软件要求
The following table lists the software versions that must be installed on the target host.
| Software | Version | Description |
|---|---|---|
| Docker Engine | Version 20.10.10-ce+ or higher | For installation instructions, see Docker Engine documentation |
| Docker Compose | docker-compose (v1.18.0+) or docker compose v2 (docker-compose-plugin) | For installation instructions, see Docker Compose documentation |
| OpenSSL | Latest is preferred | Used to generate certificate and keys for Harbor |
- 网络端口要求
Harbor requires that the following ports be open on the target host.
| Port | Protocol | Description |
|---|---|---|
| 443 | HTTPS | Harbor portal and core API accept HTTPS requests on this port. You can change this port in the configuration file. |
| 4443 | HTTPS | Connections to the Docker Content Trust service for Harbor. You can change this port in the configuration file. |
| 80 | HTTP | Harbor portal and core API accept HTTP requests on this port. You can change this port in the configuration file. |
1. 安装docker
apt update apt install docker.io docker --version # Docker version 20.10.24+dfsg1, build 297e128 配置docker镜像
cd /etc/docker/ touch daemon.json 编辑 daemon.json (如果这个不可用，需要自行寻找可用镜像源)
{ "registry-mirrors": ["https://docker.nastool.de"] } 测试docker镜像可用性 -- 可略过
docker search hello-world # NAME DESCRIPTION # STARS OFFICIAL AUTOMATED # hello-world Hello World! (an example of minimal Dockeriz… 2269 [OK] docker pull hello-world docker images |grep hello-world # hello-world latest d2c94e258dcb 14 months ago 13.3kB docker run --rm --name=tst hello-world # Hello from Docker! # This message shows that your installation appears to be working correctly. # # To generate this message, Docker took the following steps: # 1. The Docker client contacted the Docker daemon. # 2. The Docker daemon pulled the "hello-world" image from the Docker Hub. # (amd64) # 3. The Docker daemon created a new container from that image which runs the # executable that produces the output you are currently reading. # 4. The Docker daemon streamed that output to the Docker client, which sent it to your terminal. # To try something more ambitious, you can run an Ubuntu container with: # $ docker run -it ubuntu bash # Share images, automate workflows, and more with a free Docker ID: # https://hub.docker.com/ # For more examples and ideas, visit: # https://docs.docker.com/get-started/ 2. 安装docker-complose
apt install docker-compose # docker-compose version 1.29.2, build unknown 3. 下载harbor安装包
从github下载安装包，安装包比较大(621M)，需要想办法下载。
# 比如下载到/root/harbor/目录 mkdir -p /root/harbor cd /root/harbor # 可以用aria2c下载 # apt install aria2c # 从这个页面找到最新安装包或最适合的版本 https://github.com/goharbor/harbor/releases # 下面的链接是我用浏览器点击下载后获取到的下载链接，应该会变，需要实时获取 aria2c "https://objects.githubusercontent.com/github-production-release-asset-2e65be/50613991/8905e864-0824-4b9c-87c1-44a9e0b4db4f?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240630%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240630T170549Z&X-Amz-Expires=300&X-Amz-Signature=484b6cdee5c9f515d800c41cbf3253d918b470b9d9401db224d2a1cfd36fc021&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=50613991&response-content-disposition=attachment%3B%20filename%3Dharbor-offline-installer-v2.9.5-rc1.tgz&response-content-type=application%2Foctet-stream" 4. 解压缩 & 创建文件夹
cd /root/harbor tar -zxvf ./harbor-offline-installer-v2.9.5-rc1.tgz -C /opt cd /opt/harbor/ mkdir -p /opt/harbor/certs mkdir -p /opt/harbor/data 5. 准备证书
harbor 安装时内部使用了nginx, 从浏览器访问网页需要用到证书（https 单向认证）
更详细介绍可以参考：https://goharbor.io/docs/2.11.0/install-config/configure-https/
cd /opt/harbor/certs # 我把官网的制作证书的过程写到了shell中 touch mkcerts.sh mkcerts.sh
#!/bin/bash # 你想要配置的域名 -- 需要按需修改 domain=brian-harbor # 域名全称 host=${domain}.com # 证书私钥 (docker-compose启动时)需要的证书私钥 key=${host}.key # 证书申请文件 - 用于申请证书 csr=${host}.csr # harbor (docker-compose启动时)需要的证书 crt=${host}.crt # docker 需要配置的证书，基于crt生成 cert=${host}.cert # 部署harbor的主机名称 -- 需要按需修改 ip=192.168.1.9 # ca 证书 openssl genrsa -out ca.key 4096 openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=MyPersonal Root CA" -key ca.key -out ca.crt # cert 域名证书 openssl genrsa -out ${key} 4096 openssl req -sha512 -new -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=${host}" -key ${key} -out ${csr} cat > v3.ext <<-EOF authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1=${host} DNS.2=${domain} DNS.3=${ip} EOF openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in ${csr} -out ${crt} openssl x509 -inform PEM -in ${crt} -out ${cert} # 制作证书 chmod +x mkcerts.sh ./mkcerts.sh ls # brian-harbor.com.cert brian-harbor.com.crt brian-harbor.com.csr brian-harbor.com.key ca.crt ca.key ca.srl mkcerts.sh v3.ext 6. 准备环境
如果用的本地服务器，没有域名，需要用修改/etc/hosts的方式添加域名解析地址
vim /etc/hosts # 添加一行 192.168.1.9 brian-harbor.com 给docker.service添加步骤5生成的证书，否则可能造成docker login时报错证书未识别
cd /etc/docker mkdir -p /etc/docker/certs.d # 下面的域名文件夹要换成你自己的 mkdir -p /etc/docker/certs.d/brian-harbor.com/ # 这个未详细测试 mkdir -p /etc/docker/certs.d/192.168.1.9/ # 将步骤5生成的证书放入上方新建的子文件夹 cp /opt/harbor/certs/brian-harbor.com.cert /etc/docker/certs.d/brian-harbor.com/ cp /opt/harbor/certs/brian-harbor.com.key /etc/docker/certs.d/brian-harbor.com/ cp /opt/harbor/certs/ca.crt /etc/docker/certs.d/brian-harbor.com/ # 将/etc/docker/certs.d/brian-harbor.com/内容 复制给 /etc/docker/certs.d/192.168.1.9/ 一份 cp /etc/docker/certs.d/brian-harbor.com/* /etc/docker/certs.d/192.168.1.9/ # 最终效果 . ├── certs.d │ ├── 192.168.1.9 │ │ ├── brian-harbor.com.cert │ │ ├── brian-harbor.com.key │ │ └── ca.crt │ └── brian-harbor.com │ ├── brian-harbor.com.cert │ ├── brian-harbor.com.key │ └── ca.crt ├── daemon.json └── key.json 重启docker服务
systemctl restart docker 7. 配置harbor配置文件
cd /opt/harbor/ cp harbor.yml.tmpl harbor.yml 修改 harbor.yml (如果端口号80/443已经被其他服务占用，需要修改成其他的)
# ...... # 改成你自己的域名 hostname: brian-harbor.com # ...... http: # port for http, default is 80. If https enabled, this port will redirect to https port port: 80 # https related config https: # https port for harbor, default is 443 port: 443 # The path of cert and key files for nginx certificate: /opt/harbor/certs/brian-harbor.com.crt private_key: /opt/harbor/certs/brian-harbor.com.key # ...... # admin用户对应的用户名 harbor_admin_password: Harbor12345 # The default data volume data_volume: /opt/harbor/data 安装harbor
cd /opt/harbor ./prepare ./install.sh # 如果运行过程报错找不到/hostfs/opt/certs/xxx ，需要核对下/opt/certs/xxx 是否存在，然后再去检查harbor.yml # 安装完毕，发现docker启动了很多容器 docker-compose ps Name Command State Ports ------------------------------------------------------------------------------------------------------------------------------------------------ harbor-core /harbor/entrypoint.sh Up (healthy) harbor-db /docker-entrypoint.sh 13 14 Up (healthy) harbor-jobservice /harbor/entrypoint.sh Up (healthy) harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp harbor-portal nginx -g daemon off; Up (healthy) nginx nginx -g daemon off; Up (healthy) 0.0.0.0:80->8080/tcp,:::80->8080/tcp, 0.0.0.0:443->8443/tcp,:::443->8443/tcp redis redis-server /etc/redis.conf Up (healthy) registry /home/harbor/entrypoint.sh Up (healthy) registryctl /home/harbor/start.sh Up (healthy) # 停止并删除容器和卷 docker-compose down -v # 启动容器 docker-compose up -d # 重启 docker-compose restart # 查看状态 docker-compose ps 打开浏览器，访问 https://192.168.1.9, 浏览器会提示证书不可信，选择跳过。
输入admin/Harbor12345进入
8. 设备登陆测试
- harbor本机登陆
docker login -u admin brian-harbor.com # WARNING! Your password will be stored unencrypted in /root/.docker/config.json. # Configure a credential helper to remove this warning. See # https://docs.docker.com/engine/reference/commandline/login/#credentials-store # Login Succeeded - 另一台设备登陆
# 准备另一台设备，我用了一个ubuntu22虚拟机 + podman，podman 和 docker指令几乎一摸一样，以下的指令可以将podman换成docker使用 # 修改/etc/hosts 192.168.1.9 brian-harbor.com # 登陆测试，我这里很奇怪，可能强制要求信任对方域名ca，需要指定ca证书路径，否则会报错 # 需要将 6. 准备环境 中做出来的ca.crt 拷贝到这个虚拟机中，我放在了 /root/harbor/ca.crt podman login -u admin brian-harbor.com Password: Error: authenticating creds for "brian-harbor.com": pinging container registry brian-harbor.com: Get "https://brian-harbor.com/v2/": x509: certificate signed by unknown authority # 需要指定ca文件夹路径 podman login --cert-dir /root/harbor/ -u admin brian-harbor.com Login Succeeded! # push 镜像 podman push brian-harbor.com/library/redis:latest --cert-dir /home/brian/harbor/ # 带上 --cert-dir 还是很别扭的，这个问题还要进一步研究更好的解决方式 # 估计需要配置本机的可信任ca 参考文章
[1]. 私有镜像仓库harbor之手把手搭建步骤
[2]. https://goharbor.io/docs/2.11.0/install-config/configure-https/
