راه‌اندازی رجیستری خصوصی Docker با HTTPS و Nginx

VM رجیستری

sudo python3 - <<'PY'
import os
for name in ('fullchain.pem','privkey.pem'):
    f='/srv/academy-registry/tls/'+name
    fd=os.open(f,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
    os.close(fd)
PY
sudo nano '/srv/academy-registry/tls/fullchain.pem' '/srv/academy-registry/tls/privkey.pem'
sudo chmod 0644 '/srv/academy-registry/tls/fullchain.pem'

VM رجیستری

sudo openssl x509 -in '/srv/academy-registry/tls/fullchain.pem' -noout -checkhost 'registry.example.net'
sudo openssl x509 -in '/srv/academy-registry/tls/fullchain.pem' -noout -checkend 604800
sudo python3 - <<'PY'
import subprocess
base='/srv/academy-registry/tls/'
a=subprocess.check_output(['openssl','x509','-in',base+'fullchain.pem','-pubkey','-noout'])
b=subprocess.check_output(['openssl','pkey','-in',base+'privkey.pem','-pubout'])
assert a==b, 'Certificate and private key do not match'
print('Public-key match: OK')
PY

VM رجیستری

set -eu
sudo test ! -e '/etc/nginx/conf.d/academy-registry.conf'
sudo test ! -L '/etc/nginx/conf.d/academy-registry.conf'
sudo python3 - <<'PY'
import os,stat
from pathlib import Path
src=Path('/srv/academy-registry/config/nginx.conf')
assert stat.S_ISREG(src.lstat().st_mode) and src.stat().st_uid==0
fd=os.open('/etc/nginx/conf.d/academy-registry.conf',os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o644)
with os.fdopen(fd,'wb') as out: out.write(src.read_bytes())
os.chmod('/etc/nginx/conf.d/academy-registry.conf',0o644)
PY
if sudo nginx -t; then
  sudo systemctl reload nginx
else
  sudo mv '/etc/nginx/conf.d/academy-registry.conf' '/srv/academy-registry/recovery/failed-nginx.conf'
  exit 1
fi
curl --silent --show-error --dump-header - --output /dev/null 'https://registry.example.net/v2/'

کلاینت لینوکسی

set -eu
command -v docker-credential-pass
pass ls >/dev/null
python3 - <<'PY'
import json, os
from pathlib import Path
p=Path.home()/'.config'/'academy-registry-client'
assert not p.is_symlink() and not p.exists(), 'Choose a fresh client directory'
p.parent.mkdir(mode=0o700,exist_ok=True)
assert not p.parent.is_symlink()
p.mkdir(mode=0o700)
f=p/'config.json'
with f.open('x',encoding='utf-8') as out:
    json.dump({'credHelpers':{'registry.example.net':'pass'}},out)
os.chmod(f,0o600)
print('Only helper routing written; no password in JSON')
PY
docker --config "$HOME/.config/academy-registry-client" login 'registry.example.net' --username 'academy-publisher'

کلاینت لینوکسی

set -eu
test ! -e "$HOME/academy-registry-image"
mkdir -m 0700 "$HOME/academy-registry-image"
printf 'WIUNIX Academy registry pilot\n' > "$HOME/academy-registry-image/marker.txt"
printf 'FROM scratch\nCOPY marker.txt /marker.txt\n' > "$HOME/academy-registry-image/Dockerfile"
docker --config "$HOME/.config/academy-registry-client" build \
  --tag 'registry.example.net/academy/academy-registry:pilot' "$HOME/academy-registry-image"
docker --config "$HOME/.config/academy-registry-client" push 'registry.example.net/academy/academy-registry:pilot'

کلاینت لینوکسی

docker --config "$HOME/.config/academy-registry-client" pull 'registry.example.net/academy/academy-registry:pilot'
docker image inspect 'registry.example.net/academy/academy-registry:pilot' --format '{{json .RepoDigests}}'