docker pull push not working post成功登录

问题描述 投票：1回答：2

我目前正在尝试将nexus3配置为docker镜像的私有注册表，其中nginx用作反向代理。在nexus中创建了3个repos，即NexusDockerProxy（docker proxy），NexusDockerHosted（docker托管，http端口：4444）和NexusDockerGroup（docker group，http port：5555），同时添加了托管和代理。

nexus配置了nginx，我们使用自签名证书并将其添加到nginx配置文件中。

server {

    proxy_send_timeout 120;
    proxy_read_timeout 300;
    proxy_buffering    off;
    tcp_nodelay        on;

    server_tokens off;
    client_max_body_size 1G;

    listen 80;
    server_name server908.int.org.com;
    location / {
          rewrite ^(.*) https://server908.int.org.com$1 permanent;
    }
}

server {

    listen 443;
    server_name server908.int.org.com;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/orgnexus.crt;
    ssl_certificate_key /etc/ssl/certs/orgnexus.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;

    location / {

      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto "https";
      proxy_pass              http://server908.int.org.com:8082;
      proxy_read_timeout      90;

    }
}

# correlates to your nexus http connector
server {

    listen 6666;
    server_name server908.int.org.com;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/orgnexus.crt;
    ssl_certificate_key /etc/ssl/certs/orgnexus.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    client_max_body_size 1G;
    chunked_transfer_encoding on;

    location / {

      access_log              /var/log/nginx/docker.log;
      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto "https";
      #proxy_pass              http://server908.int.org.com:4444;
      proxy_pass              http://server908.int.org.com:5555;
      proxy_read_timeout      90;

    }
}

我们在下面的条目中添加了“/ etc / default / docker”文件。

http_proxy=http://x.x.x.x:3128
https_proxy=http://x.x.x.x:3128

登录也是成功的

[root@server446 ~]$ docker login -u admin -p admin123 server908.int.org.com:6666
Login Succeeded

搜索图像也很好。

[dockertest@server446 ~]$ docker search server908.int.org.com:6666/fedora
INDEX      NAME                                                       DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
org.com   server908.int.org.com:6666/fedora                         Official Docker builds of Fedora                544       [OK]
org.com   server908.int.org.com:6666/fedora/apache                                                                  33                   [OK]
org.com   server908.int.org.com:6666/fedora/couchdb                                                                 32                   [OK]
org.com   server908.int.org.com:6666/fedora/firefox                                                                 23                   [OK]
org.com   server908.int.org.com:6666/fedora/mariadb                                                                 23                   [OK]
org.com   server908.int.org.com:6666/fedora/qpid                                                                    20                   [OK]
org.com   server908.int.org.com:6666/fedora/redis                                                                   20                   [OK]
org.com   server908.int.org.com:6666/fedora/ssh                                                                     20                   [OK]
org.com   server908.int.org.com:6666/fedora/nginx                                                                   19                   [OK]
org.com   server908.int.org.com:6666/fedora/memcached                                                               18                   [OK]
org.com   server908.int.org.com:6666/fedora/rabbitmq                                                                18                   [OK]
org.com   server908.int.org.com:6666/fedora/earthquake                                                              17                   [OK]
org.com   server908.int.org.com:6666/fedora/nodejs                                                                  15                   [OK]
org.com   server908.int.org.com:6666/mattsch/fedora-nzbhydra        Fedora NZBHydra                                 4                    [OK]
org.com   server908.int.org.com:6666/dockingbay/fedora-rust         Trusted build of Rust programming language...   3                    [OK]
org.com   server908.int.org.com:6666/gluster/gluster-fedora         Official GlusterFS image [ Fedora ( latest...   3                    [OK]
org.com   server908.int.org.com:6666/startx/fedora                  Simple container used for all startx based...   3                    [OK]
org.com   server908.int.org.com:6666/eminguez/flexget-fedora        Flexget Docker Container based in Fedora t...   2                    [OK]
org.com   server908.int.org.com:6666/eminguez/transmission-fedora   Transmission Fedora (fedora:latest) docker...   2                    [OK]
org.com   server908.int.org.com:6666/fedora/owncloud                                                                2                    [OK]
org.com   server908.int.org.com:6666/gdepuille/fedora-ansible       Image to test Ansible playbook with Fedora      2                    [OK]
org.com   server908.int.org.com:6666/kumarpraveen/fedora-sshd       Fedora docker file for ssh service which m...   2                    [OK]
org.com   server908.int.org.com:6666/vbatts/fedora-varnish          https://github.com/vbatts/laughing-octo/tr...   2                    [OK]
org.com   server908.int.org.com:6666/darksheer/fedora               Hourly update latest Fedora Image               1                    [OK]
org.com   server908.int.org.com:6666/darksheer/fedora22             Base Fedora 22 Image -- Updated hourly  

    1                    [OK]

但是在尝试拉图像时我们面临下面的问题。

[dockertest@server446 ~]$ docker pull server908.int.org.com:6666/fedora
Using default tag: latest
Trying to pull repository server908.int.org.com:6666/fedora ...
latest: Pulling from server908.int.org.com:6666/fedora

691bc14ee274: Pulling fs layer
error pulling image configuration: unknown blob

使用nexus日志，我看到下面的认证错误。

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) [na:1.8.0_91]
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) [na:1.8.0_91]
        at sun.security.validator.Validator.validate(Validator.java:260) [na:1.8.0_91]
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) [na:1.8.0_91]
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) [na:1.8.0_91]

不确定它在寻找什么证书以及在哪里

还有推送我们得到404错误如下。

[dockertest@server446 ~]$ docker push server908.int.org.com:6666/maven:1
The push refers to a repository [server908.int.org.com:6666/maven]
701925f78142: Layer already exists
78bb4fee972f: Layer already exists
e1300844f726: Layer already exists
bfee0515af91: Preparing
2afcf4c557eb: Preparing
72cfa243711c: Waiting
9bf603e17b04: Waiting
70b22baddf90: Waiting
596ecbaf3ba4: Waiting
445ed6ee6867: Waiting
c59fa6cbcbd9: Waiting
8d4d1ab5ff74: Waiting
error parsing HTTP 404 response body: invalid character '<' looking for beginning of value:

当proxy_pass设置为“http://server908.int.org.com:4444”即NexusDockerHosted（docker托管，http端口：4444，我们能够使用nexus登录，推送和拉动，但无法从互联网泊坞窗集线器中提取新图像。我们得到以下错误。

[root@server446 ~]$ docker pull server908.int.org.com:6666/centos
Using default tag: latest
Trying to pull repository server908.int.org.com:6666/centos ...
manifest unknown: manifest unknown

nexus文档没有提供任何明确的说明。我错过了nginx或docker或nexus中的重要内容。我在下面引用参考文献。

https://stackoverflow.com/questions/39148462/docker-login-not-working-with-nexus-3-private-registry

Nexus3 Documentation for Docker Hosting

得到docker pull的任何帮助都非常有用，谢谢。

nginx docker registry reverse-proxy
2个回答
0
投票

我不相信Nexus是一个拉通缓存。你可以直接从集线器拉出来。然后，您可以标记您的图像并将其推送到您希望它在那里的本地注册表。

docker pull centos
docker tag centos local.registry:5000/centos
docker push local.registry:5000/centos
0
投票

我可以通过在nexus内完成一个小调整来拉动图像。通过以下链接，我可以搜索并从docker hub中拉出nexus中的不可用图像。

https://support.sonatype.com/hc/en-us/articles/213464948-How-to-trust-the-SSL-certificate-issued-by-the-HTTP-proxy-server-in-Nexus

[dockertest@server446 ~]$ docker search server908.int.org.com:6666/mac
INDEX      NAME                                                                 DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
org.com   server908.int.org.com:6666/crate                                    CrateDB is a distributed SQL database hand...   79        [OK]
org.com   server908.int.org.com:6666/maccam912/meanjs                         MEANJS (not MEANIO) starting point for dev...   27                   [OK]
org.com   server908.int.org.com:6666/macadmins/puppetmaster                   Simple puppetmaster based on CentOS 6           25                   [OK]
org.com   server908.int.org.com:6666/macadmins/bsdpy                          Apple NetBoot replacement written in Pytho...   18                   [OK]
org.com   server908.int.org.com:6666/macadmins/reposado                       Host Apple Software Updates from a Docker ...   12                   [OK]
org.com   server908.int.org.com:6666/mackerel/mackerel-agent                                                                  11                   [OK]
org.com   server908.int.org.com:6666/macadmins/munkiwebadmin                  This Docker container runs MunkiWebAdmin. ...   8                    [OK]
org.com   server908.int.org.com:6666/macadmins/postgres                       Postgres that accepts remote connections b...   8                    [OK]
org.com   server908.int.org.com:6666/macropin/strider                         Possibly the best `Dockerfile` for Strider-CD   8                    [OK]
org.com   server908.int.org.com:6666/mace/openvpn-as                          OpenVPN Access-Server with WebUI                7                    [OK]
org.com   server908.int.org.com:6666/frolvlad/alpine-python-machinelearning   Small Docker image with Python Machine Lea...   6                    [OK]
org.com   server908.int.org.com:6666/macadmins/munkireport-php                Docker autobuild repository for https://re...   6                    [OK]
org.com   server908.int.org.com:6666/mace/qbittorrent                         qBittorrent build from source                   6                    [OK]
org.com   server908.int.org.com:6666/macropin/sshd                            (deprecated) Use docker.io/panubo/sshd          5                    [OK]
org.com   server908.int.org.com:6666/macadmins/macnamer                                                                       4                    [OK]
org.com   server908.int.org.com:6666/macadmins/puppetmaster-whdcli            Puppetmaster + WHDCLI for autosigning base...   4                    [OK]
org.com   server908.int.org.com:6666/macadmins/sal                            An image that runs [Sal](https://github.co...   4                    [OK]
org.com   server908.int.org.com:6666/macropin/roundcube                       Docker container for Roundcube webmail          4                    [OK]
org.com   server908.int.org.com:6666/uetchy/machinelearning                   Dockerfile for scientists studying Machine...   4                    [OK]
org.com   server908.int.org.com:6666/clearlinux/machine-learning              Machine Learning Container                      3                    [OK]
org.com   server908.int.org.com:6666/hartator/wayback-machine-downloader      Download an entire archive from the Waybac...   3                    [OK]
org.com   server908.int.org.com:6666/macadmins/whd                            Docker container for SolarWinds WebHelpDesk     3                    [OK]
org.com   server908.int.org.com:6666/macinv/gunicorn-example                  A simple Gunicorn example                       2                    [OK]
org.com   server908.int.org.com:6666/macropin/mailman                         Mailman all in one container                    2                    [OK]
org.com   server908.int.org.com:6666/spacemacs/emacs25                        Spacemacs running on Emacs 25.                  2                    [OK]

[dockertest@server446 ~]$ docker pull server908.int.org.com:6666/macadmins/puppetmaster
Using default tag: latest
Trying to pull repository server908.int.org.com:6666/macadmins/puppetmaster ...
sha256:bf7a53a0ddb6cd0371cfec3fe6131347b5a3712c2cf282400c979ed254a38f67: Pulling from server908.int.org.com:6666/macadmins/puppetmaster
0d399614d56a: Pull complete
75e4c6031170: Pull complete
12a00ed15a39: Pull complete
6fb754ec65e3: Pull complete
9b6cf7664f02: Pull complete
07db30a930a5: Pull complete
ccdd2cf9b303: Pull complete
820dfdfc6db7: Pull complete
78c5dec8ba5d: Pull complete
Digest: sha256:bf7a53a0ddb6cd0371cfec3fe6131347b5a3712c2cf282400c979ed254a38f67
Status: Downloaded newer image for server908.int.org.com:6666/macadmins/puppetmaster:latest
最新问题
© www.soinside.com 2019 - 2024. All rights reserved.