访问Nginx后面的Docker Hub
我尝试通过nginx代理访问Docker Hub。
以下是我的nginx代理配置。
server {
listen 800 ssl;
ssl on;
server_name nginx2 ;
client_max_body_size 0;
ssl_protocols SSLv3 SSLv2 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_certificate ssl/cert.pem;
ssl_certificate_key ssl/cert.key;
location / {
proxy_pass https://{dockerhub_host};
proxy_ssl_server_name on;
proxy_set_header Host $http_host; # Required for Docker client sake
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Scheme $scheme;
}
}
我在配置中的registry-1.docker.io处尝试了hub.docker.com和{dockerhub_host}。
现在我尝试使用以下命令登录Docker Hub。
docker login localhost:800
抛出以下错误：
来自守护程序的错误响应：登录尝试
http://localhost:800/v2/ failed with status: 400 Bad Request
以下是nginx代理的日志：
proxy_1 | 2018/06/12 22:24:42 [error] 5#5: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://34.232.188.57:80/v2/", host: "localhost:800"
proxy_1 | 2018/06/12 22:24:42 [warn] 5#5: *1 upstream server temporarily disabled while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://34.232.188.57:80/v2/", host: "localhost:800"
proxy_1 | 2018/06/12 22:24:42 [error] 5#5: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://52.3.45.201:80/v2/", host: "localhost:800"
proxy_1 | 2018/06/12 22:24:42 [warn] 5#5: *1 upstream server temporarily disabled while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://52.3.45.201:80/v2/", host: "localhost:800"
proxy_1 | 2018/06/12 22:24:42 [error] 5#5: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://54.209.102.157:80/v2/", host: "localhost:800"
proxy_1 | 2018/06/12 22:24:42 [warn] 5#5: *1 upstream server temporarily disabled while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://54.209.102.157:80/v2/", host: "localhost:800"
proxy_1 | 172.21.0.1 - - [12/Jun/2018:22:24:42 +0000] "GET /v2/ HTTP/1.1" 502 173 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 2018/06/12 22:24:42 [error] 5#5: *5 no live upstreams while connecting to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://docker_host/v2/", host: "localhost:800"
proxy_1 | 172.21.0.1 - - [12/Jun/2018:22:24:42 +0000] "GET /v2/ HTTP/1.1" 502 173 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 172.21.0.1 - - [12/Jun/2018:22:24:42 +0000] "GET /v2/ HTTP/1.1" 400 271 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 172.21.0.1 - - [12/Jun/2018:22:24:42 +0000] "GET /v2/ HTTP/1.1" 400 271 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
起初，我认为当我访问端口80时会抛出错误。因此，我已将端口明确设置为443，
>proxy_pass https://hub.docker.com:443
>proxy_pass https://registry-1.docker.io:443
现在尝试登录命令。我仍然看到同样的错误。以下是nginx代理的日志：
proxy_1 | 172.21.0.1 - - [12/Jun/2018:22:33:09 +0000] "GET /v2/ HTTP/1.1" 503 119 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 172.21.0.1 - - [12/Jun/2018:22:33:09 +0000] "GET /v2/ HTTP/1.1" 503 119 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 172.21.0.1 - - [12/Jun/2018:22:33:09 +0000] "GET /v2/ HTTP/1.1" 400 271 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 172.21.0.1 - - [12/Jun/2018:22:33:09 +0000] "GET /v2/ HTTP/1.1" 400 271 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
docker version
Client:
Version: 18.03.1-ce
API version: 1.37
Go version: go1.9.5
Git commit: 9ee9f40
Built: Thu Apr 26 07:13:02 2018
OS/Arch: darwin/amd64
Experimental: false
Orchestrator: swarm
Server:
Engine:
Version: 18.03.1-ce
API version: 1.37 (minimum version 1.12)
Go version: go1.9.5
Git commit: 9ee9f40
Built: Thu Apr 26 07:22:38 2018
OS/Arch: linux/amd64
Experimental: true
docker info
Containers: 2
Running: 2
Paused: 0
Stopped: 0
Images: 44
Server Version: 18.03.1-ce
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 773c489c9c1b21a6d78b5c538cd395416ec50f88
runc version: 4fc53a81fb7c994640722ac585fa9ca548971871
init version: 949e6fa
Security Options:
seccomp
Profile: default
Kernel Version: 4.9.87-linuxkit-aufs
Operating System: Docker for Mac
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 1.952GiB
Name: linuxkit-025000000001
ID: OCVQ:XRBF:3H7P:PB3A:YQUH:FU2O:6BVB:BMHR:G7HX:UK63:SDKU:NPVI
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): true
File Descriptors: 39
Goroutines: 63
System Time: 2018-06-13T23:16:57.569645612Z
EventsListeners: 3
HTTP Proxy: docker.for.mac.http.internal:3128
HTTPS Proxy: docker.for.mac.http.internal:3129
Registry: https://index.docker.io/v1/
Labels:
Experimental: true
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
更新
我在Tarun的解决方案的帮助下获得了登录功能。我现在尝试将图像拉/推送到hub.docker.com网站，但没有运气。
> docker push localhost:800/nadella/hello-world
Error:
The push refers to repository [localhost:800/nadella/helloworld]
2b8cbd0846c5: Pushing [==================================================>] 3.584kB
unauthorized: authentication required
日志：
proxy_1 | 172.21.0.1 - - [14/Jun/2018:04:57:26 +0000] "POST /v2/nadella/helloworld/blobs/uploads/ HTTP/1.1" 202 0 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 172.21.0.1 - - [14/Jun/2018:05:00:09 +0000] "GET /v2/ HTTP/1.1" 401 87 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 172.21.0.1 - - [14/Jun/2018:05:00:10 +0000] "HEAD /v2/nadella/helloworld/blobs/sha256:9bb5a5d4561a5511fa7f80718617e67cf2ed2e6cdcd02e31be111a8d0ac4d6b7 HTTP/1.1" 404 0 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 172.21.0.1 - - [14/Jun/2018:05:00:11 +0000] "POST /v2/nadella/helloworld/blobs/uploads/?from=helloworld&mount=sha256%3A9bb5a5d4561a5511fa7f80718617e67cf2ed2e6cdcd02e31be111a8d0ac4d6b7 HTTP/1.1" 401 307 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
proxy_1 | 172.21.0.1 - - [14/Jun/2018:05:00:11 +0000] "POST /v2/nadella/helloworld/blobs/uploads/ HTTP/1.1" 202 0 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
我看了~/.docker/config.json
{
"auths": {
"localhost:800": {}
},
"HttpHeaders": {
"User-Agent": "Docker-Client/18.03.1-ce (darwin)"
},
"credsStore": "osxkeychain"
}
我甚至将“https://index.docker.io/v1/”：{}添加到配置文件中并进行了检查。但它没有用。
2 个答案:
答案 0 :(得分：1)
您唯一需要的是
location / {
proxy_pass https://registry-1.docker.io:443;
}
不需要发送剩余的标题，因为当你自己的服务时你会这样做。然后它工作
更新1
您需要使用以下配置来传递带有请求的授权标头
location / {
client_max_body_size 1024M;
proxy_pass https://registry-1.docker.io:443;
proxy_set_header Authorization $http_authorization;
proxy_pass_header Authorization;
proxy_redirect https://registry-1.docker.io $scheme://$http_host;
}
一旦你这样做，它就像一个魅力。
答案 1 :(得分：0)
我不知道或理解您尝试通过反向代理服务hub.docker.com的原因，但是，关于您的配置：
有几个错误：
首先，您缺少虚拟主机侦听端口的 ssl 参数，如official documentation中所示：
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate www.example.com.crt;
ssl_certificate_key www.example.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
...
}
然后，您将虚拟主机定义为＆＃34; nginx2 ＆＃34;，但使用＆＃34; localhost ＆＃34;在命令上。这可能仍然有效，因为它是唯一的虚拟主机，你在同一台机器上运行它并可能作为默认操作，但是，它是错误的。
如果您想以这种方式使用本地主机或IP地址 server_name ，或者更好的是，为 nginx2 设置DNS strong>在您的本地网络中（如果您想要快速解决方法，也可以将名称添加到 / etc / hosts 文件中。）
相关问题
最新问题
- 我写了这段代码，但我无法理解我的错误
- 我无法从一个代码实例的列表中删除 None 值，但我可以在另一个实例中。为什么它适用于一个细分市场而不适用于另一个细分市场？
- 是否有可能使 loadstring 不可能等于打印？卢阿
- java中的random.expovariate()
- Appscript 通过会议在 Google 日历中发送电子邮件和创建活动
- 为什么我的 Onclick 箭头功能在 React 中不起作用？
- 在此代码中是否有使用“this”的替代方法？
- 在 SQL Server 和 PostgreSQL 上查询，我如何从第一个表获得第二个表的可视化
- 每千个数字得到
- 更新了城市边界 KML 文件的来源？