가장 빨리 만나는 Docker 6장 - 1.4. 기본 인증 사용하기

127.0.0.1       localhost
127.0.1.1       ubuntu
<레지스트리 서버 IP 주소>    registry.example.com

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

$ openssl genrsa -out server.key 2048

$ openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:KO
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:Seoul
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Company
Organizational Unit Name (eg, section) []:Example Company
Common Name (e.g. server FQDN or YOUR name) []:registry.example.com
Email Address []:exampleuser@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:<아무것도 입력하지 않음>
An optional company name []:<아무것도 입력하지 않음>

$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

$ sudo cp server.crt /usr/share/ca-certificates/
$ echo "server.crt" | sudo tee -a /etc/ca-certificates.conf
$ sudo update-ca-certificates

$ sudo cp server.crt /etc/pki/ca-trust/source/anchors/
$ sudo update-ca-trust enable
$ sudo update-ca-trust extract

$ sudo service docker restart

$ sudo apt-get install apache2-utils

$ sudo yum install httpd-tools

$ htpasswd -c .htpasswd hellouser
New password:<비밀번호 입력>
Re-type new password:<비밀번호 입력>
Adding password for user hellouser

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    server {
        listen       443;
        server_name  registry.example.com;

        ssl on;
        ssl_certificate /etc/server.crt;
        ssl_certificate_key /etc/server.key;

        proxy_set_header Host           $http_host;
        proxy_set_header X-Real-IP      $remote_addr;
        proxy_set_header Authorization  "";

        client_max_body_size 0;

        chunked_transfer_encoding on;

        location / {
            proxy_pass          http://docker-registry:5000;
            proxy_set_header    Host  $host;
            proxy_read_timeout  900;

            auth_basic            "Restricted";
            auth_basic_user_file  .htpasswd;
        }
    }
}

$ sudo docker run -d --name docker-registry \
    -v /tmp/registry:/tmp/registry \
    registry:0.8.1

$ sudo docker run -d --name nginx-registry \
    -v ~/nginx.conf:/etc/nginx/nginx.conf \
    -v ~/.htpasswd:/etc/nginx/.htpasswd \
    -v ~/server.key:/etc/server.key \
    -v ~/server.crt:/etc/server.crt \
    --link docker-registry:docker-registry \
    -p 443:443 \
    nginx:1.7.5

$ sudo docker login https://registry.example.com
Username: hellouser
Password: <비밀번호 입력>
Email:
Login Succeeded

$ sudo docker tag hello:0.1 registry.example.com/hello:0.1
$ sudo docker push registry.example.com/hello:0.1
The push refers to a repository [registry.example.com/hello] (len: 1)
Sending image list
Pushing repository registry.example.com/hello (1 tags)
511136ea3c5a: Image successfully pushed
bfb8b5a2ad34: Image successfully pushed
c1f3bdbd8355: Image successfully pushed
897578f527ae: Image successfully pushed
9387bcc9826e: Image successfully pushed
809ed259f845: Image successfully pushed
96864a7d2df3: Image successfully pushed
ba3b051655b4: Image successfully pushed
11ae3a0f7f28: Image successfully pushed
e75f421fc19c: Image successfully pushed
507149de4094: Image successfully pushed
ce11bd8322f9: Image successfully pushed
bb5b14a7e9b8: Image successfully pushed
548b98b8a152: Image successfully pushed
e376f7a8e74c: Image successfully pushed
e2626c81818f: Image successfully pushed
7a06b68da607: Image successfully pushed
Pushing tag for rev [7a06b68da607] on {https://registry.example.com/v1/repositories/hello/tags/0.1}

$ sudo docker pull registry.example.com/hello:0.1