Docker 仓库管理
Docker Hub 的登录与推送、私有仓库的搭建与认证。
Key Points镜像地址格式是 仓库地址/命名空间/名字:tag；不写仓库地址时默认 Docker Hub。
镜像名怎么读
Text
registry.example.com/team/myapp:1.0
└──────┬───────────┘ └─┬─┘ └─┬─┘ └┬┘
仓库地址 命名空间 名字 tag
nginx:1.27 → docker.io/library/nginx:1.27
me/myapp → docker.io/me/myapp:latestDocker Hub
Bash
docker login
docker tag myapp:1.0 <username>/myapp:1.0
docker push <username>/myapp:1.0
docker logout私有仓库
Bash
docker run -d -p 5000:5000 --restart always --name registry \
-v registry-data:/var/lib/registry \
registry:2
docker tag myapp:1.0 localhost:5000/myapp:1.0
docker push localhost:5000/myapp:1.0
curl http://localhost:5000/v2/_catalog加认证
A bare registry accepts pushes from anyone. Keep it internal, or add basic auth + TLS — or use Harbor, which adds RBAC, replication and scanning.
Bash
mkdir -p auth
docker run --rm --entrypoint htpasswd httpd:2 -Bbn alice s3cret > auth/htpasswd
docker run -d -p 5000:5000 --name registry \
-v "$PWD/auth:/auth" \
-e REGISTRY_AUTH=htpasswd \
-e REGISTRY_AUTH_HTPASSWD_REALM=Registry \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
registry:2常用仓库产品
| Product | Strength |
|---|---|
| Docker Hub | Public images, free tier limits |
| Harbor | RBAC, replication, scanning, CNCF |
| GitLab Container Registry | Built into CI |
| 云厂商 ACR/ECR/GCR | Managed, IAM integrated |
镜像名怎么读
Text
registry.example.com/team/myapp:1.0
└──────┬───────────┘ └─┬─┘ └─┬─┘ └┬┘
仓库地址 命名空间 名字 tag
nginx:1.27 → docker.io/library/nginx:1.27
me/myapp → docker.io/me/myapp:latestDocker Hub
Bash
docker login
docker tag myapp:1.0 <username>/myapp:1.0
docker push <username>/myapp:1.0
docker logout私有仓库
Bash
docker run -d -p 5000:5000 --restart always --name registry \
-v registry-data:/var/lib/registry \
registry:2
docker tag myapp:1.0 localhost:5000/myapp:1.0
docker push localhost:5000/myapp:1.0
curl http://localhost:5000/v2/_catalog加认证
裸跑的 registry 谁都能 push。生产要么放内网，要么加 basic auth + TLS，或者直接上 Harbor 这类带权限、复制、漏洞扫描的发行版。
Bash
mkdir -p auth
docker run --rm --entrypoint htpasswd httpd:2 -Bbn alice s3cret > auth/htpasswd
docker run -d -p 5000:5000 --name registry \
-v "$PWD/auth:/auth" \
-e REGISTRY_AUTH=htpasswd \
-e REGISTRY_AUTH_HTPASSWD_REALM=Registry \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
registry:2常用仓库产品
| 产品 | 优势 |
|---|---|
| Docker Hub | 公共镜像，免费额度有限流 |
| Harbor | 权限、复制、扫描，CNCF 项目 |
| GitLab 容器仓库 | 与 CI 一体 |
| 云厂商 ACR/ECR/GCR | 托管，与 IAM 打通 |