docker解决Https问题

最新推荐文章于 2026-02-21 12:10:38 发布

原创最新推荐文章于 2026-02-21 12:10:38 发布 · 3.5k 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

dangcafe

收录于

容器微服务篇

本文介绍如何通过Nginx和HTTPS配置Docker私有仓库，包括安装Nginx、生成SSL证书、配置Nginx代理及镜像的推送与拉取过程。

安装nginx，制作https

[root@linux-node1 ~]# yum install nginx -y
[root@linux-node1 ~]# vim /etc/nginx/nginx.conf
…
    include /etc/nginx/conf.d/*.conf;
…

因为在配置文件中已经指定了目录，只有放在/etc/nginx/conf.d/*下面才会识别到

配置如下：

[root@linux-node1 conf.d]# cat docker.conf
upstream docker-registry {
 server 127.0.0.1:5000;
}
 
server {
listen 443;
server_name registry.abcdocker.com
ssl on;
ssl_certificate  /etc/ssl/nginx.crt;
ssl_certificate_key /etc/ssl/nginx.key;
proxy_set_header Host      $http_host;
proxy_set_header X-Real-IP $remote_addr;
client_max_body_size 0;
chunked_transfer_encoding on;
 
location / {
    auth_basic  "Docker";
    auth_basic_user_file    /etc/nginx/conf.d/docker-registry.htpasswd;
    proxy_pass http://docker-registry;
}
location /_ping {
        auth_basic off;
    proxy_pass http://docker-registry;
}
location /v1/_ping {
    auth_basic off;
    proxy_pass http://docker-registry;
}
}
[root@linux-node1 conf.d]#

我们需要生成一个证书，大家可以申请一个沃通或者腾讯的免费ssl

以下如果有的免费ssl就不需要设置

我们先设置一个根密钥，生产上直接使用沃通的免费ssl配置就可以了

---------------此步在生产可以不使用--------------------
[root@linux-node1 ~]# cd /etc/pki/CA/
[root@linux-node1 CA]# touch ./{serial,index.txt}
[root@linux-node1 CA]# echo "00" >serial 
[root@linux-node1 CA]# openssl genrsa -out private/cakey.pem 2048
Generating RSA private key, 2048 bit long modulus
.................................+++
............+++
e is 65537 (0x10001)
[root@linux-node1 CA]# openssl req -new -x509 -key private/cakey.pem -days 3650 -out cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:输入CN
State or Province Name (full name) []: 输入BeiJing
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:abcdocker
Organizational Unit Name (eg, section) []:docker
Common Name (eg, your name or your server's hostname) []:registry.abcdocker.com
Email Address []:cyh@abcdocker.com   
 
以上步骤是生成一个根证书
我们现在需要生产一个nginx的证书（生产可以直接使用运营商颁发的证书，不需要生成）
[root@linux-node1 CA]# cd /etc/ssl/
[root@linux-node1 ssl]# openssl genrsa -out nginx.key 2048
Generating RSA private key, 2048 bit long modulus
....+++
.........................................+++
e is 65537 (0x10001)
[root@linux-node1 ssl]# openssl req -new -key nginx.key -out nginx.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:abcdocker
Organizational Unit Name (eg, section) []:docker
Common Name (eg, your name or your server's hostname) []:registry.abcdocker.com
Email Address []:cyh@abcdocker.com
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
#最后2个直接回车
 
签发证书
 
[root@linux-node1 ssl]# openssl ca -in nginx.csr -days 365 -out nginx.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 0 (0x0)
        Validity
            Not Before: Oct 24 14:04:16 2016 GMT
            Not After : Oct 24 14:04:16 2017 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = BeiJing
            organizationName          = abcdocker
            organizationalUnitName    = docker
            commonName                = registry.abcdocker.com
            emailAddress              = cyh@abcdocker.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                29:04:19:D9:1A:C1:8C:1C:11:38:FF:75:85:1F:B2:BD:E1:1C:79:5C
            X509v3 Authority Key Identifier: 
                keyid:70:D7:95:49:C3:40:05:43:43:D4:07:AE:4D:AB:F2:D6:40:28:63:8D
 
Certificate is to be certified until Oct 24 14:04:16 2017 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n] y
CERTIFICATION CANCELED
 
因为我们设置的是自签证书，要让系统允许
[root@linux-node1 ~]# cat /etc/pki/CA/cacert.pem >> /etc/pki/tls/certs/ca-bundle.crt

我们创建一个用来验证的账号密码

[root@linux-node1 ~]# htpasswd -c /etc/nginx/conf.d/docker-registry.htpasswd abcdocker
New password: 
Re-type new password: 
Adding password for user abcdocker
 
#这个路径要跟nginx配置文件中的路径对应上
[root@linux-node1 ~]# systemctl start nginx

查看是否有443端口

[root@linux-node1 ~]# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      19995/mysqld        
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      14408/nginx: master 
tcp        0      0 0.0.0.0:4369            0.0.0.0:*               LISTEN      21574/epmd          
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1094/sshd           
tcp        0      0 0.0.0.0:15672           0.0.0.0:*               LISTEN      21557/beam          
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1372/master         
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      14408/nginx: master 
tcp        0      0 0.0.0.0:25672           0.0.0.0:*               LISTEN      21557/beam          
tcp6       0      0 :::80                   :::*                    LISTEN      14408/nginx: master 
tcp6       0      0 :::81                   :::*                    LISTEN      119979/docker-proxy 
tcp6       0      0 :::4369                 :::*                    LISTEN      21574/epmd          
tcp6       0      0 :::82                   :::*                    LISTEN      122045/docker-proxy 
tcp6       0      0 :::22                   :::*                    LISTEN      1094/sshd           
tcp6       0      0 ::1:25                  :::*                    LISTEN      1372/master         
tcp6       0      0 :::8282                 :::*                    LISTEN      7571/docker-proxy   
tcp6       0      0 :::5000                 :::*                    LISTEN      12308/docker-proxy  
tcp6       0      0 :::5672                 :::*                    LISTEN      21557/beam          
udp        0      0 0.0.0.0:123             0.0.0.0:*                           19389/chronyd       
udp        0      0 127.0.0.1:323           0.0.0.0:*                           19389/chronyd       
udp6       0      0 ::1:323                 :::*                                19389/chronyd

我们还需要做一个绑定，设置host解析

[root@linux-node1 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.56.11 linux-node1.abcdocker.com  registry.abcdocker.com
192.168.56.12 linux-node2.abcdocker.com

修改配置文件

[root@linux-node1 ~]# vim /etc/sysconfig/docker
# Modify these options if you want to change the way the docker daemon runs
 OPTIONS='--selinux-enabled --insecure-registry 192.168.56.11:5000'
测试

[root@linux-node1 ~]# docker push 192.168.56.11:5000/abcdocker/abcnginx:latest
The push refers to a repository [192.168.56.11:5000/abcdocker/abcnginx]
f69e85c4fed0: Pushed 
0aeb287b1ba9: Pushed 
latest: digest: sha256:516a0527d14f5f657a984c19c3e1a4cc90fff99cf065d5b1e56740fe5d8f0796 size: 719

小结：制作好nginx—ssl 后，docker基本上只需要三步

1、修改/etc/sysconfig/docker 配置文件，设置域名
2、构建镜像
[root@linux-node1 ~]# docker tag abcdocker/abcdocker:v1 192.168.56.11:5000/abcdocker/abc:latest
3、上传到仓库中
[root@linux-node1 ~]# docker push 192.168.56.11:5000/abcdocker/abc:latest

提示：如果使用的是域名此处的IP地址就是域名的地址

连接

首先我们修改配置文件，因为不是https,所以要修改配置文件，跟服务端修改的一样

设置hosts解析

然后我们使用docker pull即可

[root@linux-node2 ~]# docker images 
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
[root@linux-node2 ~]#  docker pull 192.168.56.11:5000/abcdocker/abc:latest
Trying to pull repository 192.168.56.11:5000/abcdocker/abc ... 
latest: Pulling from 192.168.56.11:5000/abcdocker/abc
8d30e94188e7: Pull complete 
9cc6fcb823f4: Pull complete 
Digest: sha256:516a0527d14f5f657a984c19c3e1a4cc90fff99cf065d5b1e56740fe5d8f0796
Status: Downloaded newer image for 192.168.56.11:5000/abcdocker/abc:latest

查看是否存在

[root@linux-node2 ~]# docker images 
REPOSITORY                         TAG                 IMAGE ID            CREATED             SIZE
192.168.56.11:5000/abcdocker/abc   latest              d1da04e088af        44 minutes ago      386.5 MB

创建容器

[root@linux-node2 ~]# docker run -d -it --name nginx1 -d -p 81:80 192.168.56.11:5000/abcdocker/abc
5086eafe42a7c82c8c1b2adaeaa223766348c7ec349c407d57868add9cd7a77e
[root@linux-node2 ~]# sh docker.sh nginx1
[root@5086eafe42a7 /]# ls
anaconda-post.log  bin  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

案例：按照我们上面的方法，制作一个nginx镜像并上传到docker仓库中，并运行容器启动nginx服务

[root@linux-node2 ~]# docker run -d  --name nginx -p 192.168.56.12:87:80 192.168.56.11:5000/abc 
477a9eda45b0262d2c914539698efc0eedc580d123fd25188c9c1f3205bfd445
[root@linux-node2 ~]# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1094/sshd           
tcp        0      0 192.168.56.12:87        0.0.0.0:*               LISTEN      25508/docker-proxy  
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1373/master         
tcp6       0      0 :::22                   :::*                    LISTEN      1094/sshd           
tcp6       0      0 ::1:25                  :::*                    LISTEN      1373/master