Question

我目前正在尝试将nexus设置为docker镜像的私有注册表，并且能够通过nexus存储库进行登录，推送，拉取和搜索。

目前，如果在nexus托管存储库中不可用，我们仍然无法从docker中提取图像。我们面临的错误范围为blob unknown到manifest unknown。

[root@server1446 ~]$ docker pull server908.int.org.com:6666/centos
Using default tag: latest
Trying to pull repository server908.int.org.com:6666/centos ...
manifest unknown: manifest unknown

尝试以下参考[Setup-Docker-Private-Registry-in-Nexus-Repository-OSS-3.0.0] [1]

[1]：https://github.com/TerrenceMiao/nexus/wiki/Setup-Docker-Private-Registry-in-Nexus-Repository-OSS-3.0.0使用docker（group）设置docker（代理）和docker（托管）repo但会抛出blob unknown to registry错误。

docker（hosted）配置了http端口4444＆amp; docker（group）的http端口为5555，我们在nginx配置中使用了如下所示，但似乎都没有工作。

server {

    listen 6666;
    server_name server908.int.org.com;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/orgnexus.crt;
    ssl_certificate_key /etc/ssl/certs/orgnexus.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    client_max_body_size 1G;
    chunked_transfer_encoding on;

   location / {

      access_log              /var/log/nginx/docker.log;
      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto "https";
      proxy_pass              http://server908.int.org.com:5555;
      proxy_read_timeout      90;

    }

我们在“ / etc / sysconfig / docker ”文件中对以下条目进行了评论。

http_proxy=http://x.x.x.x:3128 https_proxy=http://x.x.x.x:3128

Answer 1

以下是我的配置，使其正常工作。

server {

    proxy_send_timeout 120;
    proxy_read_timeout 300;
    proxy_buffering    off;
    tcp_nodelay        on;

    server_tokens off;
    client_max_body_size 1G;

    listen 80;
    server_name box.company.net;
    location / {
          rewrite ^(.*) https://box.company.net$1 301;
    }
}

server {

    listen 443;
    server_name box.company.net;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/ssl.crt;
    ssl_certificate_key /etc/ssl/certs/ssl.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;

    location / {

      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto "https";
      proxy_pass              http://box.company.net:8081;
      proxy_read_timeout      90;

    }
}

# correlates to your nexus http connector
server {

    listen 6666;
    server_name box.company.net;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/ssl.crt;
    ssl_certificate_key /etc/ssl/certs/ssl.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    client_max_body_size 1G;
    chunked_transfer_encoding on;

    location / {

      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;

        if ($request_method !~* GET) {
                proxy_pass              http://box.company.net:4444;
        }
        if ($request_method = GET) {
                proxy_pass              http://box.company.net:5555;
        }
      proxy_read_timeout      90;
    }
}

使用＆＃34; / etc / default / docker＆＃34;在下面的条目中添加档案。

http_proxy=http://x.x.x.x:3128
https_proxy=http://x.x.x.x:3128

重新启动Nginx。

执行登录

[test@server ~]$ docker login -u admin -p admin123 box.company.net:6666
Login Succeeded

登录后输入文件名＆＃34; config.json＆＃34;将在＆＃34; .docker＆＃34;下创建目录

[test@server ~]$ cat ~/.docker/config.json
{
        "auths": {
                "box.company.net:6666": {
                        "auth": "YWRtaW46YWRtaW4xMjM="
                }
        }
}

搜索docker hub中可用的图像。

[test@server ~]$ docker search box.company.net:6666/ubuntu
INDEX      NAME                                                                               DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
company.net   box.company.net:6666/ubuntu                                                 Ubuntu is a Debian-based Linux operating s...   6186      [OK]

通过nexus代理从docker hub中提取图像。

[test@server ~]$ docker pull box.company.net:6666/ubuntu
Using default tag: latest
Trying to pull repository box.company.net:6666/ubuntu ...
sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4: Pulling from box.company.net:6666/ubuntu

75c416ea735c: Pull complete
c6ff40b6d658: Pull complete
a7050fc1f338: Pull complete
f0ffb5cf6ba9: Pull complete
be232718519c: Pull complete
Digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4
Status: Downloaded newer image for box.company.net:6666/ubuntu:latest

标记拉出的图像

docker tag box.company.net:6666/ubuntu:latest box.company.net:6666/ubuntu:1

推送到NexusHostedRepo（端口：4444）

[test@server ~]$ docker push box.company.net:6666/ubuntu:1
The push refers to a repository [box.company.net:6666/ubuntu]
0566c118947e: Pushed
6f9cf951edf5: Pushed
182d2a55830d: Pushed
latest: digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4 size: 1357

从Nexus Repo拉出（这应该比从码头工具中心拉出来快）

[test@server ~]$ docker pull box.company.net:6666/ubuntu:1
Trying to pull repository box.company.net:6666/ubuntu ...
sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4: Pulling from server908.int.org.com:6666/ubuntu

75c416ea735c: Pull complete
c6ff40b6d658: Pull complete
a7050fc1f338: Pull complete
Digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4
Status: Downloaded newer image for box.company.net:6666/ubuntu:1

----------------------------------------------- ---------------------------------

还要确保在Nexus SSL证书部分中添加代理服务器证书。

keytool -J-Dhttps.proxyHost=<proxy_hostname> -J-Dhttps.proxyPort=<proxy_port> -printcert -rfc -sslserver <remote_host_name:remote_ssl_port>

将proxy_hostname和proxy_port替换为管理下配置了Nexus的HTTP代理服务器 - ＆gt;服务器。将remote_host_name:remote_ssl_port替换为具有认证问题的远程主机和端口之一。如果端口是默认端口443，则可以省略端口。对于docker，它将为registry-1.docker.io:443

您应该看到上述命令至少打印了两个条目。获取打印的最后一个证书内容并将其完全复制到剪贴板。这应该是您的代理服务器证书，添加到证书链的末尾。

复制的证书内容应以----- BEGIN CERTIFICATE -----开头，以----- END CERTIFICATE -----结束。

然后在Nexus用户界面中，转到管理 - ＆gt; SSL证书并单击添加...，然后选择粘贴PEM。将证书内容粘贴到打开的对话框中。

单击“加载证书”。在下一个窗口中验证证书内容。验证列出的颁发者详细信息是否来自您的代理服务器证书。如果您满意，请单击“添加证书”。

希望这有帮助。

docker pull manifest未知的blob错误

1 个答案:

----------------------------------------------- ---------------------------------