nginx - docker pull list 未知 blob 错误

Question

我目前正在尝试将 nexus 设置为 docker 镜像的私有(private)注册表，并且已经能够登录、推送、拉取、搜索 nexus 存储库。

目前，如果 Nexus 托管存储库中没有可用的镜像，我们只能从 docker 中提取镜像。我们面临的错误范围从 blobknown 到 manifestknown。

[root@server1446 ~]$ docker pull server908.int.org.com:6666/centos
Using default tag: latest
Trying to pull repository server908.int.org.com:6666/centos ...
manifest unknown: manifest unknown

尝试以下引用[Setup-Docker-Private-Registry-in-Nexus-Repository-OSS-3.0.0][1]

[1]:https://github.com/TerrenceMiao/nexus/wiki/Setup-Docker-Private-Registry-in-Nexus-Repository-OSS-3.0.0使用 docker(group) 设置 docker(proxy) 和 docker(hosted) 存储库，但会抛出 blobknown toregistry 错误。

docker(hosted) 配置了 http 端口 4444，docker(group) 配置了 http 端口 5555，我们在 nginx 配置中使用了相同的配置，如下所示，但似乎都不起作用。

server {

    listen 6666;
    server_name server908.int.org.com;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/orgnexus.crt;
    ssl_certificate_key /etc/ssl/certs/orgnexus.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    client_max_body_size 1G;
    chunked_transfer_encoding on;

   location / {

      access_log              /var/log/nginx/docker.log;
      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto "https";
      proxy_pass              http://server908.int.org.com:5555;
      proxy_read_timeout      90;

    }

我们在“/etc/sysconfig/docker”文件中对以下条目进行了注释。

http_proxy=http://x.x.x.x:3128
https_proxy=http://x.x.x.x:3128

Answer 1

以下是我的配置，使其正常工作。

server {

    proxy_send_timeout 120;
    proxy_read_timeout 300;
    proxy_buffering    off;
    tcp_nodelay        on;

    server_tokens off;
    client_max_body_size 1G;

    listen 80;
    server_name box.company.net;
    location / {
          rewrite ^(.*) https://box.company.net$1 301;
    }
}

server {

    listen 443;
    server_name box.company.net;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/ssl.crt;
    ssl_certificate_key /etc/ssl/certs/ssl.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;

    location / {

      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto "https";
      proxy_pass              http://box.company.net:8081;
      proxy_read_timeout      90;

    }
}

# correlates to your nexus http connector
server {

    listen 6666;
    server_name box.company.net;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/ssl.crt;
    ssl_certificate_key /etc/ssl/certs/ssl.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    client_max_body_size 1G;
    chunked_transfer_encoding on;

    location / {

      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;

        if ($request_method !~* GET) {
                proxy_pass              http://box.company.net:4444;
        }
        if ($request_method = GET) {
                proxy_pass              http://box.company.net:5555;
        }
      proxy_read_timeout      90;
    }
}

用“/etc/default/docker”文件注释了下面的条目。

http_proxy=http://x.x.x.x:3128
https_proxy=http://x.x.x.x:3128

重新启动 Nginx。

执行登录

[test@server ~]$ docker login -u admin -p admin123 box.company.net:6666
Login Succeeded

登录后，将在“.docker”目录下创建一个名为“config.json”的文件

[test@server ~]$ cat ~/.docker/config.json
{
        "auths": {
                "box.company.net:6666": {
                        "auth": "YWRtaW46YWRtaW4xMjM="
                }
        }
}

搜索 docker hub 中可用的镜像。

[test@server ~]$ docker search box.company.net:6666/ubuntu
INDEX      NAME                                                                               DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
company.net   box.company.net:6666/ubuntu                                                 Ubuntu is a Debian-based Linux operating s...   6186      [OK] 

通过 Nexus 代理从 docker hub 拉取镜像。

[test@server ~]$ docker pull box.company.net:6666/ubuntu
Using default tag: latest
Trying to pull repository box.company.net:6666/ubuntu ...
sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4: Pulling from box.company.net:6666/ubuntu

75c416ea735c: Pull complete
c6ff40b6d658: Pull complete
a7050fc1f338: Pull complete
f0ffb5cf6ba9: Pull complete
be232718519c: Pull complete
Digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4
Status: Downloaded newer image for box.company.net:6666/ubuntu:latest

标记拉取的图像

docker tag box.company.net:6666/ubuntu:latest box.company.net:6666/ubuntu:1

推送到 NexusHostedRepo(端口:4444)

[test@server ~]$ docker push box.company.net:6666/ubuntu:1
The push refers to a repository [box.company.net:6666/ubuntu]
0566c118947e: Pushed
6f9cf951edf5: Pushed
182d2a55830d: Pushed
latest: digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4 size: 1357

从 Nexus Repo 拉取(这应该比从 docker hub 拉取快)

[test@server ~]$ docker pull box.company.net:6666/ubuntu:1
Trying to pull repository box.company.net:6666/ubuntu ...
sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4: Pulling from server908.int.org.com:6666/ubuntu

75c416ea735c: Pull complete
c6ff40b6d658: Pull complete
a7050fc1f338: Pull complete
Digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4
Status: Downloaded newer image for box.company.net:6666/ubuntu:1

------------------------------------------------------------ ---------------------------------

另请确保在 Nexus SSL 证书部分添加代理服务器证书。

keytool -J-Dhttps.proxyHost=<proxy_hostname> -J-Dhttps.proxyPort=<proxy_port> -printcert -rfc -sslserver <remote_host_name:remote_ssl_port>

将 proxy_hostname 和 proxy_port 替换为 Nexus 在管理 -> 服务器下配置的 HTTP 代理服务器。将 remote_host_name:remote_ssl_port 替换为存在认证问题的远程主机和端口之一。如果端口是默认的 443，则可以省略该端口。对于 docker，它将是 registry-1.docker.io:443

您应该看到以上命令至少打印了两个条目。获取最后打印的证书内容并将其完全复制到剪贴板。这应该是您的代理服务器的证书，添加到证书链的末尾。

复制的证书内容应以-----BEGIN CERTIFICATE-----开头，并以-----END CERTIFICATE-----结束。

然后在 Nexus UI 中，转到“管理”->“SSL 证书”，然后单击“添加...”并选择“粘贴 PEM”。将证书内容粘贴到打开的对话框中。

单击“加载证书”。在下一个窗口中验证证书内容。验证列出的颁发者详细信息是否来自您的代理服务器证书。如果您满意，请单击“添加证书”。

<小时/>

希望这有帮助。