前往小程序,Get更优阅读体验!
立即前往
首页
学习
活动
专区
工具
TVP
发布
社区首页 >专栏 >K8S学习笔记之docker registry使用http非https

K8S学习笔记之docker registry使用http非https

作者头像
Jetpropelledsnake21
发布2022-09-27 19:12:52
6630
发布2022-09-27 19:12:52
举报
文章被收录于专栏:JetpropelledSnakeJetpropelledSnake

0x00 概述

本地调试环境,docker registry不需要使用https,规避复杂操作。

0x01 默认https传输问题

docker registry默认使用https,在私有镜像源操作会提示以下错误:

代码语言:javascript
复制
vm01@root:~$ docker push 172.16.16.3:5000/alpine:v1.0
The push refers to repository [172.16.16.3:5000/alpine]
Get https://172.16.16.3:5000/v2/: http: server gave HTTP response to HTTPS client

0x02 修改docker registory配置 

在docker的daemon.json文件内,新增私有镜像源信息(在K8S被所有节点进行此操作)

代码语言:javascript
复制
vm01@shenzhen:~$ cat /etc/docker/daemon.json 
{
  "registry-mirrors": ["https://834kie09.mirror.aliyuncs.com"],
  "insecure-registry": ["172.16.16.3:5000"]
}

0x03 修改docker.service配置

在docker的docker.service文件内,新增私有镜像源信息(在K8S被所有节点进行此操作)

代码语言:javascript
复制
vm01@root:~$ cat /lib/systemd/system/docker.service
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
BindsTo=containerd.service
After=network-online.target firewalld.service containerd.service
Wants=network-online.target
Requires=docker.socket

[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --insecure-registry 172.16.16.3:5000
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always

# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
# Both the old, and new location are accepted by systemd 229 and up, so using the old location
# to make them work for either version of systemd.
StartLimitBurst=3

# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
# this option work for either version of systemd.
StartLimitInterval=60s

# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity

# Comment TasksMax if your systemd version does not support it.
# Only systemd 226 and above support this option.
TasksMax=infinity

# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes

# kill only the docker process, not all processes in the cgroup
KillMode=process

[Install]
WantedBy=multi-user.target

0x04 重启docker服务

重启各个节点的docker服务,加载新的配置文件

代码语言:javascript
复制
systemctl daemon-reload
systemctl restart docker

在节点验证私有源的push和pull操作

代码语言:javascript
复制
docker push 172.16.16.3:5000/nginx_ss:v1.2
docker pull   172.16.16.3:5000/nginx_ss:v1.2
本文参与 腾讯云自媒体分享计划,分享自作者个人站点/博客。
原始发表:2022-08-29,如有侵权请联系 cloudcommunity@tencent.com 删除

本文分享自 作者个人站点/博客 前往查看

如有侵权,请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体分享计划  ,欢迎热爱写作的你一起参与!

评论
登录后参与评论
0 条评论
热度
最新
推荐阅读
目录
  • 0x00 概述
  • 0x01 默认https传输问题
  • 0x02 修改docker registory配置 
  • 0x03 修改docker.service配置
  • 0x04 重启docker服务
相关产品与服务
容器镜像服务
容器镜像服务(Tencent Container Registry,TCR)为您提供安全独享、高性能的容器镜像托管分发服务。您可同时在全球多个地域创建独享实例,以实现容器镜像的就近拉取,降低拉取时间,节约带宽成本。TCR 提供细颗粒度的权限管理及访问控制,保障您的数据安全。
领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档