本地调试环境,docker registry不需要使用https,规避复杂操作。
docker registry默认使用https,在私有镜像源操作会提示以下错误:
vm01@root:~$ docker push 172.16.16.3:5000/alpine:v1.0
The push refers to repository [172.16.16.3:5000/alpine]
Get https://172.16.16.3:5000/v2/: http: server gave HTTP response to HTTPS client
在docker的daemon.json文件内,新增私有镜像源信息(在K8S被所有节点进行此操作)
vm01@shenzhen:~$ cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://834kie09.mirror.aliyuncs.com"],
"insecure-registry": ["172.16.16.3:5000"]
}
在docker的docker.service文件内,新增私有镜像源信息(在K8S被所有节点进行此操作)
vm01@root:~$ cat /lib/systemd/system/docker.service
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
BindsTo=containerd.service
After=network-online.target firewalld.service containerd.service
Wants=network-online.target
Requires=docker.socket
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --insecure-registry 172.16.16.3:5000
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always
# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
# Both the old, and new location are accepted by systemd 229 and up, so using the old location
# to make them work for either version of systemd.
StartLimitBurst=3
# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
# this option work for either version of systemd.
StartLimitInterval=60s
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
# Comment TasksMax if your systemd version does not support it.
# Only systemd 226 and above support this option.
TasksMax=infinity
# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes
# kill only the docker process, not all processes in the cgroup
KillMode=process
[Install]
WantedBy=multi-user.target
重启各个节点的docker服务,加载新的配置文件
systemctl daemon-reload
systemctl restart docker
在节点验证私有源的push和pull操作
docker push 172.16.16.3:5000/nginx_ss:v1.2
docker pull 172.16.16.3:5000/nginx_ss:v1.2