Question

我知道在类似问题上已经发布了一些问题，但不幸的是我仍然无法使以下命令工作：

$ sudo docker run hello-world

无法找到图片＆＃39; hello-world：latest＆＃39;本地 docker：来自守护进程的错误响应：获取https://registry-1.docker.io/v2/：拨打tcp 52.54.216.153：443：getsockopt：连接被拒绝。请参阅＃docker run --help＆＃39;。

我在VirtualBox上使用CentOS7虚拟机，在系统级配置HTTP / HTTPS / FTP代理设置。此代理配置适用于Chrome和其他应用程序。

浏览此论坛后，我尝试通过以下方式为Docker应用程序创建显式代理设置：

创建一个〜{.docker / config.json文件，如https://docs.docker.com/network/proxy/所述，然后执行＆＃34; systemctl restart docker＆＃34;
创建/etc/systemd/system/docker.service.d/http-proxy.conf然后执行＆＃34; systemctl daemon-reload＆＃34;和＆＃34; systemctl重新启动docker＆＃34;

以下是我的虚拟机上的Docker版本：

$ sudo docker version

Client:
 Version:      18.03.1-ce
 API version:  1.37
 Go version:   go1.9.5
 Git commit:   9ee9f40
 Built:        Thu Apr 26 07:20:16 2018
 OS/Arch:      linux/amd64
 Experimental: false
 Orchestrator: swarm

Server:
 Engine:
  Version:      18.03.1-ce
  API version:  1.37 (minimum version 1.12)
  Go version:   go1.9.5
  Git commit:   9ee9f40
  Built:        Thu Apr 26 07:23:58 2018
  OS/Arch:      linux/amd64
  Experimental: false

$ curl -v https://registry-1.docker.io/v2/

* About to connect() to proxy XXX port 8012 (#0)
...
> 
< HTTP/1.1 200 Connection established
< 
* Proxy replied OK to CONNECT request
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*   subject: CN=*.docker.io
*   start date: Aug 02 00:00:00 2017 GMT
*   expire date: Sep 02 12:00:00 2018 GMT
*   common name: *.docker.io
*   issuer: CN=Amazon,OU=Server CA 1B,O=Amazon,C=US
> GET /v2/ HTTP/1.1
> User-Agent: curl/7.29.0
> Host: registry-1.docker.io
> Accept: */*
> 
< HTTP/1.1 401 Unauthorized
< Content-Type: application/json; charset=utf-8
< Docker-Distribution-Api-Version: registry/2.0
< Www-Authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io"
< Date: Fri, 08 Jun 2018 16:00:17 GMT
< Content-Length: 87
< Strict-Transport-Security: max-age=31536000
< 
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]}
* Connection #0 to host XXX left intact

$ curl -v https://54.152.209.167

   ...
   ...
< HTTP/1.1 200 Connection established
< 
* Proxy replied OK to CONNECT request
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
*   subject: CN=*.docker.io
*   start date: Aug 02 00:00:00 2017 GMT
*   expire date: Sep 02 12:00:00 2018 GMT
*   common name: *.docker.io
*   issuer: CN=Amazon,OU=Server CA 1B,O=Amazon,C=US
* NSS error -12276 (SSL_ERROR_BAD_CERT_DOMAIN)
* Unable to communicate securely with peer: requested domain name does not match the server's certificate.
* Closing connection 0
curl: (51) Unable to communicate securely with peer: requested domain name does not match the server's certificate.

Answer 1

如https://docs.docker.com/config/daemon/systemd/#httphttps-proxy中所述，以下命令解决了我的问题。它在博士，IMO中丢失了。

$ sudo mkdir -p /etc/systemd/system/docker.service.d

vi /etc/systemd/system/docker.service.d/http-proxy.conf 
[Service]
Environment="http://IP:PORT/"

vi /etc/systemd/system/docker.service.d/https-proxy.conf 
[Service]
Environment="http://IP:PORT/"

$ sudo systemctl daemon-reload
$ sudo systemctl restart docker
$ systemctl show --property=Environment docker
Environment=HTTP_PROXY=http://"http://IP:PORT/"

Centos7上的Docker：连接被拒绝

1 个答案: