Centos7搭建私有yum源与docker images仓库
系统使用的是centos7-Minimal-2009
磁盘300G，根目录分大点
另外挂载了一个200G的磁盘作为docker images的存储
如果只需要搭建私有yum源，上半部分就可以了
私有yum源--yum repo
设置hostname
hostnamectl set-hostname mirrors.your-domain.com
安装net-tool
yum install -y net-tools
我的网络拓扑是nat 加 内网环境
所以静态路由需要配置，不需要就跳过此段
查看路由表
ip route show
添加内网静态路由（重启失效）
ip route add 10.0.0.0/8 via 10.101.2.1 dev ens224
ip route add 172.16.0.0/16 via 10.101.2.1 dev ens224
添加内网静态路由（永久）
cat << EOF > /etc/sysconfig/network-scripts/route-ens224
10.0.0.8/8 via 10.101.2.1 dev ens224
172.16.0.0/16 via 10.101.2.1 dev ens224
EOF
service network restart
关闭selinux、关闭firewall
sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config
setenforce 0
systemctl stop firewalld.service
systemctl disable firewalld.service
安装apache，设置启动
yum install -y httpd
systemctl start httpd.service
systemctl enable httpd.service
试一下apache页面
http://mirrors.your-domain.com
更换默认repo为阿里云
mkdir -p /etc/yum.repos.d/bak/
mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/bak/
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum clean all
yum makecache
可以看一下现在的repo
yum repolist
安装同步工具、repo制作工具
yum install -y yum-utils createrepo wget
创建目录
mkdir -p /var/www/html/repo/centos/7
### base仓同步并创建repo数据
reposync -r base -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/base
###extras仓库同步并创建repo数据
reposync -r extras -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/extras
###updates仓库并创建repo数据
reposync -r updates -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/updates
###epel仓库同步并创建repo数据
reposync -r epel -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/epel
###docker-ce仓库同步并创建repo数据
reposync -r docker-ce-stable -p /var/www/html/repo/centos/7
createrepo /var/www/html/repo/centos/7/docker-ce-stable
手动更新包和更新repodata命令（可选）
reposync -np /var/www/html/repo/centos/7/
createrepo --update /var/www/html/repo/centos/7/base
createrepo --update /var/www/html/repo/centos/7/extras
createrepo --update /var/www/html/repo/centos/7/updates
createrepo --update /var/www/html/repo/centos/7/epel
createrepo --update /var/www/html/repo/centos/7/docker-ce-stable
制作repo指向文件
cat << EOF > /var/www/html/repo/Centos-7.repo
#base仓库
[base]
name=Local CentOS-7 Base
baseurl=http://mirrors.your-domain.com/repo/centos/7/base
enabled=1
gpgcheck=0
# extras仓库
[extras]
name=Local CentOS-7 Extras
baseurl=http://mirrors.your-domain.com/repo/centos/7/extras
enabled=1
gpgcheck=0
# updates仓库
[updates]
name=Local CentOS-7 Updates
baseurl=http://mirrors.your-domain.com/repo/centos/7/updates
enabled=1
gpgcheck=0
# epel仓库
[epel]
name=Local Extra Packages for Enterprise Linux 7
baseurl=http://mirrors.your-domain.com/repo/centos/7/epel
enabled=1
gpgcheck=0
# docker-ce仓库
[docker-ce-stable]
name=Local docker Packages for Enterprise Linux 7
baseurl=http://mirrors.your-domain.com/repo/centos/7/docker-ce-stable
enabled=1
gpgcheck=0
EOF
设置自动同步
cat << EOF > /var/www/html/sync_yum.sh
#!/bin/bash
echo 'Updating Aliyum Source'
exec > /var/log/sync_yumrepo.log
reposync -np /var/www/html/repo/centos/7/
if [ $? -eq 0 ];then
createrepo --update /var/www/html/repo/centos/7/base
createrepo --update /var/www/html/repo/centos/7/extras
createrepo --update /var/www/html/repo/centos/7/updates
createrepo --update /var/www/html/repo/centos/7/epel
createrepo --update /var/www/html/repo/centos/7/docker-ce-stable
echo "SUCESS: aliyum_yum update successful"
else
echo "ERROR: aliyum_yum update failed"
fi
EOF
chmod +x /var/www/html/sync_yum.sh
每周一凌晨1点同步
crontab -e
0 1 * * 1 /bin/bash /var/www/html/sync_yum.sh
创建使用说明页面
cat << EOF > /var/www/html/index.html
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>CentOS repo与docker registry镜像</title>
<script>document.createElement("myHero")</script>
<style>
myHero {
display: block;
background-color: #ddd;
padding: 10px;
font-size: 20px;
}
</style>
</head>
<body>
<h1>简介</h1>
<hr>
<p>CentOS，是基于 Red Hat Linux 提供的可自由使用源代码的企业级 Linux 发行版本，是一个稳定，可预测，可管理和可复制的免费企业级计算平台。</p>
<p>站点功能:</p>
<p>1.Centos yum repo</p>
<p>2.Docker images registry</p>
<hr>
<br>
<br>
<h1>一、CentOS 7 配置内部YUM源</h1>
<br>
<h2>1、备份</h2>
<myHero>mkdir -p /etc/yum.repos.d/bak/</myHero>
<myHero>mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/bak/</myHero>
<br>
<h2>2、下载新的 CentOS-Base.repo 到 /etc/yum.repos.d/ </h2>
<myHero>curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.your-domain.com/repo/Centos-7.repo</myHero>
<br>
<h2>3、生成缓存</h2>
<myHero>yum makecache</myHero>
<br>
<h2>4、运行 yum repolist 可查看已经生成缓存</h2>
<br>
<br>
<hr>
<h1>二、使用docker images registry仓库</h1>
<br>
<h2>1、下载ssl证书</h2>
<myHero>mkdir -p /etc/docker/certs.d/mirrors.your-domain.com</myHero>
<myHero>wget -O /etc/docker/certs.d/mirrors.your-domain.com/ca.crt http://mirrors.your-domain.com/ca.crt</myHero>
<br>
<h2>2、测试返回 </h2>
<myHero>curl -Ik https://mirrors.your-domain.com</myHero>
HTTP/1.1 200 OK</myHero>
<br>
Cache-Control: no-cache</myHero>
<br>
<h2>3、镜像拉取测试（可选）</h2>
<myHero>docker pull mirrors.your-domain.com/library/ubuntu </myHero>
<br>
<h2>4、使用（以ceph为例）</h2>
<br>
<myHero>docker pull mirrors.your-domain.com/ceph/daemon:latest-mimic </myHero>
<br>
<br>
</body>
</html>
EOF
访问
http://mirrors.your-domain.com
其他机器使用私有源
mkdir -p /etc/yum.repos.d/bak/
mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/bak/
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.your-domain.com/repo/Centos-7.repo
yum makecache
yum update
私有源部分结束
docker images registry --images本地仓
添加一个专用磁盘sdb，200G，作为docker images存储
pvcreate /dev/sdb
vgcreate registry_vg /dev/sdb
lvcreate -L 198G -n registry_data registry_vg
mkfs.xfs /dev/mapper/registry_vg-registry_data
mkdir -p /var/lib/docker/volumes/registry/_data/docker
查一下registry_vg-registry_data的UUID
blkid
[root@mirrors ~]# blkid
/dev/mapper/centos-root: UUID="ff7c3399-c44d-49dc-9e98-570b00bcd84a" TYPE="xfs"
/dev/sda2: UUID="IuHCZp-JMfJ-f8bi-16x2-2NAx-yd4k-bcusvV" TYPE="LVM2_member"
/dev/sda1: UUID="4a5490c9-3203-4f96-8191-ad49d3183347" TYPE="xfs"
/dev/sdb: UUID="i3wvm3-op4P-v2qk-QLc1-Keww-69mG-zgA9SV" TYPE="LVM2_member"
/dev/mapper/centos-swap: UUID="dd5cdb94-fbeb-4f79-90bf-807fd4b0d581" TYPE="swap"
/dev/mapper/registry_vg-registry_data: UUID="21d493a8-7329-45e5-82f9-02e97066cdb0" TYPE="xfs"
/dev/mapper/centos-home: UUID="824c3751-2548-4cd2-9fdd-e0081a444a4e" TYPE="xfs"
在fstab的最后加一行，UUID替换成registry_vg-registry_data的
vi /etc/fstab
UUID=21d493a8-7329-45e5-82f9-02e97066cdb0 /var/lib/docker/volumes/registry/_data/docker xfs defaults 0 0
mount -a
加一个阿里的docker-ce源
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum makecache
安装docker，并启动
yum install docker-ce -y
systemctl start docker
systemctl enable docker
设置docker kolla.conf,我是用来部署openstack的
mkdir /etc/systemd/system/docker.service.d
tee /etc/systemd/system/docker.service.d/kolla.conf << 'EOF'
[Service]
MountFlags=shared
EOF
创建证书
yum install -y openssl
mkdir -p ~/certs && openssl req -newkey rsa:4096 -nodes -sha256 -keyout ~/certs/domain.key -x509 -days 365 -out ~/certs/domain.crt
一路回车，到Common Name这一步填:mirrors.your-domain.com
Generating a 4096 bit RSA private key
.......................................................................................++
......++
writing new private key to '/root/certs/domain.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:mirrors.your-domain.com
下载registry并获取配置
docker run -it --rm --entrypoint cat registry:2 /etc/docker/registry/config.yml > ~/config.yml
更改 config.yml 配置文件
version: 0.1
log:
fields:
service: registry
storage:
cache:
blobdescriptor: inmemory
filesystem:
rootdirectory: /var/lib/registry
http:
addr: :5000
headers:
X-Content-Type-Options: [nosniff]
tls:
certificate: /var/lib/registry/domain.crt
key: /var/lib/registry/domain.key
health:
storagedriver:
enabled: true
interval: 10s
threshold: 3
proxy:
remoteurl: https://p7a8ba4a.mirror.aliyuncs.com
其中，https://p7a8ba4a.mirror.aliyuncs.com 是我个人的阿里云docker加速地址
放置配置文件与证书
mkdir -p /var/lib/docker/volumes/registry/_data/
cp ~/certs/domain.* ~/config.yml /var/lib/docker/volumes/registry/_data/
mkdir -p /etc/docker/certs.d/dev.registry.io
cp ~/certs/domain.crt /etc/docker/certs.d/mirrors.your-domain.com/ca.crt
cp /etc/docker/certs.d/mirrors.your-domain.com/ca.crt /var/www/html/ca.crt
运行 registry container
systemctl restart docker
docker run -d --restart=always -p 443:5000 --name registry -v registry:/var/lib/registry registry:2 /var/lib/registry/config.yml
docker ps
CONTAINER ID IMAGECOMMAND CREATED STATUS PORTS NAMES
b12c05b4a54a registry:2 "/entrypoint.sh /var…" 9 hours ago Up 16 seconds 0.0.0.0:443->5000/tcp, :::443->5000/tcp registry
访问验证
curl -Ik https://mirrors.your-domain.com
HTTP/2 200
cache-control: no-cache
其他机器使用
先获取证书
mkdir -p /etc/docker/certs.d/mirrors.your-domain.com
wget -O /etc/docker/certs.d/mirrors.your-domain.com/ca.crt http://mirrors.your-domain.com/ca.crt
拉取方式（以ceph为例）
docker pull mirrors.your-domain.com/ceph/daemon:latest-mimic
