基础配置 yum install -y wget net-tools nfs-utils lrzsz gcc gcc-c++ make cmake libxml2-devel openssl-devel curl curl-devel unzip sudo ntp libaio-devel wget vim ncurses-devel autoconf automake zlib-devel python-devel epel-release openssh-server socat ipvsadm conntrack yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo yum install -y yum-utils device-mapper-persistent-data lvm2 yum install docker-ce -y systemctl enable docker systemctl start docker systemctl status docker curl -L https://get.daocloud.io/docker/compose/releases/download/1.21.1/docker-compose-`uname -s`-`uname -m` -o /usr/bin/docker-compose chmod +x /usr/bin/docker-composedocker-compose version
开启包转发功能和修改内核参数 modprobe br_netfilter cat > /etc/sysctl.d/docker.conf <<EOF net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 net.ipv4.ip_forward = 1 EOF sysctl -p /etc/sysctl.d/docker.conf
为Harbor自签发证书 mkdir /data/ssl -pcd /data/ssl/openssl genrsa -out ca.key 3072 openssl req -new -x509 -days 3650 -key ca.key -out ca.pem openssl genrsa -out harbor.key 3072 openssl req -new -key harbor.key -out harbor.csr openssl x509 -req -in harbor.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out harbor.pem -days 3650
安装harbor cd /optwget https://github.com/goharbor/harbor/releases/download/v2.8.2/harbor-offline-installer-v2.8.2.tgz tar xvf harbor-offline-installer-v2.8.2.tgz cd harbor && cp harbor.yml.tmpl harbor.ymlvim harbor.yml ./install.sh Note: docker version: 24.0.2 [Step 1]: checking docker-compose is installed ... Note: Docker Compose version v2.18.1 [Step 2]: loading Harbor images ... Loaded image: goharbor/harbor-log:v2.8.2 Loaded image: goharbor/harbor-db:v2.8.2 Loaded image: goharbor/registry-photon:v2.8.2 Loaded image: goharbor/harbor-core:v2.8.2 Loaded image: goharbor/harbor-jobservice:v2.8.2 Loaded image: goharbor/harbor-registryctl:v2.8.2 Loaded image: goharbor/notary-signer-photon:v2.8.2 Loaded image: goharbor/trivy-adapter-photon:v2.8.2 Loaded image: goharbor/prepare:v2.8.2 Loaded image: goharbor/harbor-portal:v2.8.2 Loaded image: goharbor/redis-photon:v2.8.2 Loaded image: goharbor/harbor-exporter:v2.8.2 Loaded image: goharbor/nginx-photon:v2.8.2 Loaded image: goharbor/notary-server-photon:v2.8.2 [Step 3]: preparing environment ... [Step 4]: preparing harbor configs ... prepare base dir is set to /root/harbor Generated configuration file: /config/portal/nginx.conf Generated configuration file: /config/log/logrotate.conf Generated configuration file: /config/log/rsyslog_docker.conf Generated configuration file: /config/nginx/nginx.conf Generated configuration file: /config/core/env Generated configuration file: /config/core/app.conf Generated configuration file: /config/registry/config.yml Generated configuration file: /config/registryctl/env Generated configuration file: /config/registryctl/config.yml Generated configuration file: /config/db/env Generated configuration file: /config/jobservice/env Generated configuration file: /config/jobservice/config.yml loaded secret from file: /data/secret/keys/secretkey Generated configuration file: /compose_location/docker-compose.yml Clean up the input dir Note: stopping existing Harbor instance ... [+] Running 10/10 ✔ Container nginx Removed 0.1s ✔ Container harbor-jobservice Removed 0.1s ✔ Container registryctl Removed 0.0s ✔ Container harbor-core Removed 0.0s ✔ Container harbor-portal Removed 0.0s ✔ Container registry Removed 0.0s ✔ Container redis Removed 0.0s ✔ Container harbor-db Removed 0.0s ✔ Container harbor-log Removed 0.0s ✔ Network harbor_harbor Removed 0.1s [Step 5]: starting Harbor ... [+] Building 0.0s (0/0) [+] Running 10/10 ✔ Network harbor_harbor Created 0.1s ✔ Container harbor-log Started 0.5s ✔ Container registryctl Started 2.0s ✔ Container harbor-portal Started 2.1s ✔ Container redis Started 2.2s ✔ Container harbor-db Started 2.1s ✔ Container registry Started 1.9s ✔ Container harbor-core Started 2.3s ✔ Container harbor-jobservice Started 2.7s ✔ Container nginx Started 2.9s ✔ ----Harbor has been installed and started successfully.----
安装先决条件 Harbor 被部署为多个 Docker 容器。因此，您可以将其部署在任何支持 Docker 的 Linux 发行版上。目标主机需要安装 Docker 和 Docker Compose。
硬件 下表列出了部署 Harbor 的最低和推荐硬件配置。
资源 最低限度 推荐 CPU 2 CPU 4 CPU Mem 4 GB 8 GB Disk 40 GB 160 GB
软件 下表列出了目标主机上必须安装的软件版本。
软件 版本 描述 Docker Engine 17.06.0-ce+ 或更高版本 有关安装说明，请参阅 Docker 引擎文档 Docker Compose docker-compose (v1.18.0+) or docker compose v2 (docker-compose-plugin) 有关安装说明，请参阅 Docker Compose 文档 OpenSSL 最好保持最新 用于为Harbor生成证书和密钥
网络端口 Harbor 要求目标主机上打开以下端口。
端口 协议 描述 443 HTTPS Harbor 门户和核心 API 在此端口上接受 HTTPS 请求。您可以在配置文件中更改此端口。 4443 HTTPS 连接到 Harbor 的 Docker Content Trust 服务。只有在启用 Notary 时才需要。您可以在配置文件中更改此端口。 80 HTTP Harbor 门户和核心 API 在此端口上接受 HTTP 请求。您可以在配置文件中更改此端口。
安装故障排除 以下部分帮助您解决安装Harbor时遇到的问题。
访问港口Harbor日志 默认情况下，注册表数据保留在主机的 /data/ 目录中。即使 Harbor 的容器被删除和/或重新创建，此数据也保持不变，您可以编辑 harbor.yml 文件中的 data_volume 来更改此目录。
另外，Harbor使用 rsyslog 来收集各个容器的日志。默认情况下，这些日志文件存储在目标主机上的 /var/log/harbor/ 目录中，以供故障排除，也可以更改 harbor.yml 中的日志目录。
无法启动或功能不正确 如果Harbor无法启动或运行不正常，请运行以下命令检查Harbor的所有容器是否处于 Up 状态。sudo docker-compose ps Name Command State Ports ----------------------------------------------------------------------------------------- harbor-core /harbor/start.sh Up harbor-db /entrypoint.sh postgres Up 5432/tcp harbor-jobservice /harbor/start.sh Up harbor-log /bin/sh -c /usr/local/bin/ ... Up 127.0.0.1:1514->10514/tcp harbor-portal nginx -g daemon off; Up 80/tcp nginx nginx -g daemon off; Up 0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp, 0.0.0.0:80->80/tcp redis docker-entrypoint.sh redis ... Up 6379/tcp registry /entrypoint.sh /etc/regist ... Up 5000/tcp registryctl /harbor/start.sh Up
如果容器不处于 Up 状态，请检查 /var/log/harbor 中该容器的日志文件。例如，如果 harbor-core 容器未运行，请查看 core.log 日志文件。
遇到的错误 Network harbor_harbor Error ✘ Network harbor_harbor Error 0.0s failed to create network harbor_harbor: Error response from daemon: Failed to Setup IP tables: Unable to enable SKIP DNAT rule: (iptables failed: iptables --wait -t nat -I DOCKER -i br-4733c61275a3 -j RETURN: iptables: No chain/target/match by that name. systemctl restart docker.service docker-compose up -d
使用 nginx 或负载平衡 如果 Harbor 在 nginx 代理或弹性负载平衡后面运行，请打开文件 common/config/nginx/nginx.conf 并搜索以下行。proxy_set_header X-Forwarded-Proto $scheme ;
如果代理已经有类似的设置，请将其从 location / 、 location /v2/ 和 location /service/ 部分中删除，然后重新部署 Harbor。有关如何重新部署 Harbor 的说明，请参阅重新配置 Harbor 和管理 Harbor 生命周期。
HTTPS 连接故障排除 如果您使用来自证书颁发者的中间证书，请将中间证书与您自己的证书合并以创建证书包。运行以下命令。cat intermediate-certificate.pem >> yourdomain.com.crt
当 Docker 守护程序在某些操作系统上运行时，您可能需要在操作系统级别信任证书。例如，运行以下命令。
cp yourdomain.com.crt /usr/local/share/ca-certificates/yourdomain.com.crt update-ca-certificates
cp yourdomain.com.crt /etc/pki/ca-trust/source/anchors/yourdomain.com.crtupdate-ca-trust
参考