DEV Community: Zheng Zengtao

Building an Images Repository - Harbor

Zheng Zengtao — Sun, 19 Nov 2023 13:53:59 +0000

Harbor is designed for storing container images and is generally deployed in an intranet environment to provide image services for containers running within the intranet.

Harbor is open source and can be found on GitHub at: https://github.com/goharbor/harbor

Step 1: Testing Environment

For testing purposes, set up a new virtual machine with CentOS 7.9 and make some modifications to the test environment:

Disable the firewall, install iptables, and temporarily disable it:

systemctl stop firewalld
systemctl disable firewalld
yum install iptables-services -y
systemctl stop iptables
systemctl disable iptables
iptables -F

Disable SELinux:

setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

Synchronize system time:

ntpdata cn.pool.ntp.org
crontab -e

Insert the following entry to synchronize every hour:

* */1 * * * /usr/sbin/ntpdate cn.pool.ntp.org

Install common components:

yum install -y yum-utils device-mapper-persistent-data lvm2 wget net-tools nfs-utils lrzsz gcc gcc-c++ make cmake libxml2-devel openssl-devel curl curl-devel unzip sudo ntp libaio-devel vim ncurses-devel autoconf automake zlib-devel python-devel epel-release openssh-server socat ipvsadm conntrack

Set up the repository:

yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

Enable system forwarding:

echo "net.bridge.bridge-nf-call-ip6tables = 1" >> /etc/sysctl.conf
echo "net.bridge.bridge-nf-call-iptables = 1" >> /etc/sysctl.conf
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p

Step 2: Install Docker and Download Docker Compose

Install the latest version of Docker:

yum install -y docker-ce

Enable Docker:

systemctl enable docker --now

Download Docker Compose:

wget https://github.com/docker/compose/releases/download/v2.23.1/docker-compose-linux-x86_64
mv docker-compose-linux-x86_64 /usr/bin/docker-compose
chmod +x /usr/bin/docker-compose

Step 3: Create Certificates

During the certificate creation process, ensure consistency in country code and city code. The hostname must match the local machine.

mkdir /data/ssl -p
cd /data/ssl/
openssl genrsa -out ca.key 3072
openssl req -new -x509 -days 3650 -key ca.key -out ca.pem
openssl genrsa -out harbor.key 3072
openssl req -new -key harbor.key -out harbor.csr
openssl x509 -req -in harbor.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out harbor.pem -days 3650

Step 4: Download and Install Harbor

Create a directory:

mkdir /data/install
cd /data/install

Download and extract files:

wget https://github.com/goharbor/harbor/releases/download/v2.3.0-rc3/harbor-offline-installer-v2.3.0-rc3.tgz
tar zxvf harbor-offline-installer-v2.3.0-rc3.tgz -C /data/install

Modify the configuration file:

cp /data/install/harbor/harbor.yml.tmpl /data/install/harbor/harbor.yml
vim /data/install/harbor/harbor.yml

Modify the hostname, certificate, and private_key to actual values:

hostname: harbor # Adjust as needed

certificate: /data/ssl/harbor.pem
private_key: /data/ssl/harbor.key

Install Harbor:

/data/install/harbor/install.sh

Step 5: Web User Management on the Client

Access the IP or domain of this host to open the login page. Initial admin account information:
Username: admin
Password: Harbor12345

Step 6: Configure Docker on the Client

Modify /etc/docker/daemon.json:

vim /etc/docker/daemon.json

Add the following field in the client machine's /etc/docker/daemon.json:

"insecure-registries": "192.168.xxx.xxx", "hostname"

Restart the Docker service:

systemctl daemon-reload
systemctl restart docker

Step 7: Testing

Upload Test: Tag the image on the local machine in the format: ip/project_name/image_name

docker tag tomcat:latest 192.168.xxx.xxx/test/tomcat:v1
docker push 192.168.xxx.xxx/test/tomcat:v1

Download Test:

docker pull 192.168.xxx.xxx/test/tomcat:v1

Building a Private Repository

Zheng Zengtao — Sun, 19 Nov 2023 13:50:55 +0000

In the architecture of cloud services, multiple network planes are generally deployed, and the management plane is usually in the intranet environment, accessible through a jump server or VPN technology. This brings significant inconvenience to the installation, upgrade, or system upgrade of applications for the infrastructure of the server. Today, I will introduce a simple method to build a self-built Linux private repository.

Before we begin, you need to prepare a virtual host with dual network cards, or a physical host will work as well. The host should run the Linux operating system; here, we'll use CentOS 7.9 as an example. If you are using a Debian-based Linux system, just replace the commands with apt commands; the principle is exactly the same.

Once the system is installed, connect one network card to the external network and another to the intranet, complete the relevant configurations and tests. Now let's officially start building the private repository.

Step 1: Install and Configure Nginx

Install Nginx

sudo yum install -y nginx

This is a basic operation, and installing Nginx may require additional steps, such as installing the EPEL repository. If you encounter any issues installing Nginx, please search online for related tutorials.

Configure Nginx

Configuring Nginx is straightforward. Just add three lines under the server section:

vim /etc/nginx/nginx.conf

    server {
        autoindex on;    # Add this line
        autoindex_exact_size on;    # Add this line
        autoindex_localtime on;    # Add this line
        listen       80;    # Listening port

Then restart Nginx:

sudo systemctl restart nginx

Step 2: Create a Directory for Sync

This directory is configured in the /etc/nginx/nginx.conf file from the previous step. Here, we create it in the default working directory of Nginx:

mkdir -p /usr/share/nginx/html/rsync/

Step 3: Download Sources

You can download applications individually or synchronize downloads in batches.

Download a Single Application

As an example, let's download haproxy:

mkdir -p /usr/share/nginx/html/rsync/haproxy
sudo yum -y install --downloadonly --downloaddir=/usr/share/nginx/html/rsync/haproxy/ haproxy

Note: This method downloads only applications that have not been installed on the local machine before. If you try to download an application that has been previously installed, such as nginx, you will get nothing.

Batch Download

Here we use the EPEL repository as an example:

mkdir -p /usr/share/nginx/html/rsync/epel/7/x86_64/
rsync -vrt --bwlimit=3000 --exclude=debug/ rsync://rsync.mirrors.ustc.edu.cn/epel/7/x86_64/ /usr/share/nginx/html/rsync/epel/7/x86_64/

Create an Index

When creating the index for the first time, install createrepo:

sudo yum install -y createrepo

Create the index; you need to use this command every time you update the content.

createrepo /usr/share/nginx/html/rsync/

Usage

After these steps, the sync source is successfully installed. On the intranet host, modify the repo file's baseurl:

baseurl = http://xxx.xxx.xxx.xxx/rsync

Alternatively, transfer it to the relevant host and install using the following command:

sudo yum install -y http://xxx.xxx.xxx.xxx/rsync/haproxy/haproxy-1.5.18-9.el7_9.1.x86_64.rpm