Harbor 是一个开源的企业级容器镜像仓库，用于存储、签名和扫描容器镜像。它提供基于角色的访问控制（RBAC）、镜像复制、漏洞扫描等功能，适用于 Kubernetes 和 Docker 环境。

一、Harbor 的安装与部署

环境准备

# 配置本地域名解析
vim /etc/hosts
192.168.88.240 harbor
# 上传Docker相关包并安装
dnf -y install docker/*.rpm
# Docker配置开机自启并启动
systemctl enable docker --now

# Harbor主机上传Harbor安装包
ls harbor-v2.9.2.tgz
harbor-v2.9.2.tgz

部署 Harbor

# 解压安装包，-C：指定解压目录
tar -xf harbor-v2.9.2.tgz -C /usr/local/
# 切换到Harbor安装目录
cd /usr/local/harbor/
# 加载Harbor的Docker镜像包
docker load -i harbor.v2.9.2.tar.gz
# 创建TLS证书存放目录
mkdir tls
# 生成2048位的RSA私钥文件
openssl genrsa -out tls/cert.key 2048
# 生成自签名证书（有效期10年）
openssl req -new -x509 -days 3652 -key tls/cert.key -out tls/cert.crt \
  -subj "/C=CN/ST=GD/L=GZ/O=xx/OU=xx/CN=harbor" \
  -addext "subjectAltName = IP:192.168.88.240"

# 拷贝模板文件并配置下列信息
cp harbor.yml.tmpl harbor.yml
vim harbor.yml
5  hostname: 192.168.88.240
8  # http:
10 #   port: 80
17   certificate: /usr/local/harbor/tls/cert.crt
18   private_key: /usr/local/harbor/tls/cert.key
36 harbor_admin_password: Harbor12345

# 初始化Harbor
/usr/local/harbor/prepare
# 启动Harbor
docker compose -f docker-compose.yml up -d
# 配置开机自启
echo "/usr/bin/docker compose -p harbor start" >> /etc/rc.d/rc.local
# 添加执行权限 
chmod +x /etc/rc.d/rc.local 

验证

docker compose ls -a
NAME                STATUS              CONFIG FILES
harbor              running(9)          /usr/local/harbor/docker-compose.yml
docker compose -p harbor ps
NAME                IMAGE                                COMMAND                  SERVICE       CREATED              STATUS                             PORTS
harbor-core         goharbor/harbor-core:v2.9.2          "/harbor/entrypoint.…"   core          About a minute ago   Up About a minute (healthy)        
harbor-db           goharbor/harbor-db:v2.9.2            "/docker-entrypoint.…"   postgresql    About a minute ago   Up About a minute (healthy)        
harbor-jobservice   goharbor/harbor-jobservice:v2.9.2    "/harbor/entrypoint.…"   jobservice    About a minute ago   Up 24 seconds (health: starting)   
harbor-log          goharbor/harbor-log:v2.9.2           "/bin/sh -c /usr/loc…"   log           About a minute ago   Up About a minute (healthy)        127.0.0.1:1514->10514/tcp
harbor-portal       goharbor/harbor-portal:v2.9.2        "nginx -g 'daemon of…"   portal        About a minute ago   Up About a minute (healthy)        
nginx               goharbor/nginx-photon:v2.9.2         "nginx -g 'daemon of…"   proxy         About a minute ago   Up About a minute (healthy)        0.0.0.0:80->8080/tcp, [::]:80->8080/tcp, 0.0.0.0:443->8443/tcp, [::]:443->8443/tcp
redis               goharbor/redis-photon:v2.9.2         "redis-server /etc/r…"   redis         About a minute ago   Up About a minute (healthy)        
registry            goharbor/registry-photon:v2.9.2      "/home/harbor/entryp…"   registry      About a minute ago   Up About a minute (healthy)        
registryctl         goharbor/harbor-registryctl:v2.9.2   "/home/harbor/start.…"   registryctl   About a minute ago   Up About a minute (healthy)

二、Harbor 的管理与使用

• 登录Harbor控制台：https://192.168.88.240
• 用户名、密码：admin | Harbor12345
  
• 当前仓库下只有默认的library项目
  

用户管理

创建用户

1. 点击系统管理下的用户管理，再点击创建用户，输入必填信息后，点击确认即可创建
2. 点击右上角退出登录后，测试新建的用户能否登录系统
3. 登录成功后如下所示：
   

项目管理

新建项目

• 点击新建项目，填写名称、设置访问级别：公开和私有
  
• 新建两个项目：private、public
  

客户端认证

# test主机配置Harbor仓库地址
vim /etc/docker/daemon.json 
{
    "registry-mirrors": ["https://harbor:443" ],
    "insecure-registries": ["harbor:443"]
}
# 重启Docker
systemctl restart docker

# 测试登陆认证
docker login harbor:443
Username: test
Password: Harbor12345
WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/

Login Succeeded
# 查看登录后生成的认证文件
cat /root/.docker/config.json 
{
        "auths": {
                "harbor:443": {
                        "auth": "dGVzdDpIYXJib3IxMjM0NQ=="
                }
        }
}

docker logout harbor:443
Removing login credentials for harbor:443
# 退出登录后会清空文件中的用户信息
cat /root/.docker/config.json 
{
        "auths": {}
}

镜像的上传与下载

推送镜像

# test主机推送镜像到Harbor仓库
docker tag myos:nginx harbor:443/public/myos:nginx
docker tag myos:php-fpm harbor:443/private/myos:php-fpm
# 推送失败：需进行登录认证
docker push harbor:443/public/myos:nginx
docker push harbor:443/private/myos:php-fpm
# 使用test用户登录
docker login harbor:443
# 登录成功后即可推送
docker push harbor:443/public/myos:nginx 
docker push harbor:443/private/myos:php-fpm 

进入 Harbor 控制台查看镜像推送情况

拉取镜像

# 清理test主机中的所有镜像，若删除不了，则添加-f选项：强制删除
docker rmi $(docker images -aq)
# 退出登录后，拉取镜像
docker logout harbor:443
docker pull harbor:443/public/myos:nginx
# 私有项目下的镜像拉取失败：需进行登录认证
docker pull harbor:443/private/myos:php-fpm
Error response from daemon: unauthorized: unauthorized to access repository: private/myos, action: pull: unauthorized to access repository: private/myos, action: pull

docker login harbor:443                       # 使用test用户登录仓库
docker pull harbor:443/private/myos:php-fpm   # 拉取成功
# 上传镜像到test主机并加载镜像
docker load -i rocky9.tar.xz
# 查看镜像列表
docker images
REPOSITORY                TAG       IMAGE ID       CREATED         SIZE
harbor:443/private/myos   php-fpm   128095ffa5fa   25 hours ago    285MB
harbor:443/public/myos    nginx     1ff946172d86   2 days ago      264MB
rockylinux                9         bc587475a294   11 months ago   170MB

# 向library项目推送镜像
docker tag rockylinux:9 harbor:443/library/rockylinux:9
# 推送失败，当前登录的用户无library项目的权限
docker push harbor:443/library/rockylinux:9

# 使用超级管理员帐号进入Harbor控制台中
# 将当前用户添加到library项目中并授予足够的权限即可推送
docker push harbor:443/library/rockylinux:9