> For AI agents: the complete documentation index is available at https://www.tteam.icu/llms.txt, the full documentation bundle is available at https://www.tteam.icu/llms-full.txt.

# registry

## 私有仓库

### docker-compose.yml

```yaml file="./registry/docker-compose.yml" title="docker-compose.yml"
version: "3"
services:
  registry:
    image: registry:2.8.3
    container_name: registry
    restart: always
    ports:
      - 5000:5000
    environment:
      REGISTRY_AUTH: htpasswd
      REGISTRY_AUTH_HTPASSWD_PATH: /etc/docker/registry/htpasswd
      REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
    volumes:
      - ./data/registry:/var/lib/registry
      - ./config:/etc/docker/registry
  registry-web:
    image: klausmeyer/docker-registry-browser
    container_name: registry-web
    ports:
      - 8083:8080
    environment:
      - DOCKER_REGISTRY_URL=https://xxx.top
      - PORT=8080
      - NO_SSL_VERIFICATION=false
      - PUBLIC_REGISTRY_URL=xxx.top
      - TOKEN_AUTH_USER=
      - TOKEN_AUTH_PASSWORD=
      - ENABLE_DELETE_IMAGES=true
      - SECRET_KEY_BASE=xxx

```

### config/config.yaml

```yaml file="./registry/config/config.yaml" title="config.yaml"
version: 0.1
log:
  fields:
  service: registry
storage:
  cache:
    blobdescriptor: inmemory
  filesystem:
    rootdirectory: /var/lib/registry
  delete:
    enabled: true
http:
  addr: :5000
  headers:
    X-Content-Type-Options: [nosniff]
health:
  storagedriver:
    enabled: true
    interval: 10s
    threshold: 3

```

:::tip
`SECRET_KEY_BASE` 参数使用 `openssl rand -hex 64` 获取。

启动后，如果没有配置 SSL 证书，或者 SSL 证书链不完整([修复地址](https://myssl.com/chain_download.html))，需要在对应的服务器的 `/etc/docker/daemon.json` 中增加 `"insecure-registries"` 配置:
:::

```json
{
  "insecure-registries": [
      "http://xxx.com"
  ],
  "registry-mirrors": [
    "https://pee6w651.mirror.aliyuncs.com"
  ],
  "data-root": "/data/data-docker",
  "log-driver": "syslog",
  "log-opts": {
    "syslog-address": "tcp://127.0.0.1:514",
    "tag": "docker/{{.Name}},"
   }
}
```

:::tip
如果不需要密码，去掉以下三行:
:::

```yaml
    environment:
      REGISTRY_AUTH: htpasswd
      REGISTRY_AUTH_HTPASSWD_PATH: /etc/docker/registry/htpasswd
      REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
```

:::tip
如果需要密码，则需要生成密码并配置:
:::

```shell
yum install -y httpd-tools

htpasswd -c -B -b htpasswd username password
```

:::tip
最后在需要使用的机器上登录: `docker login xxx.com`
:::

## 代理仓库

### registry-proxy.sh

```sh file="./registry/registry-proxy.sh" title="registry-proxy.sh"
#!/bin/bash

# 海外代理

docker rm -f registry
docker run -d \
--restart=always \
--name registry \
--network host \
-e REGISTRY_HTTP_ADDR=":5000" \
-e REGISTRY_HTTP_HEADERS_X-Content-Type-Options="[nosniff]" \
-e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \
-e REGISTRY_STORAGE_MAINTENANCE="{\"readonly\":{\"enabled\":true},\"uploadpurging\":{\"enabled\":true,\"age\":\"72h\",\"dryrun\":false,\"interval\":\"12h\"}}" \
-v ./data/registry:/var/lib/registry \
registry:2.8.3
```

:::tip
然后在 `registry-mirrors` 中填上域名即可(原来填写镜像的地方)。
:::

- `readonly.enabled`: 将 Docker Registry 设置为只读模式，设置为 true 表示启用只读模式，在此模式下注册表中的内容只能被读取，不能被修改或删除
- `uploadpurging.enabled`: 启用上传清理功能，设置为 true 表示启用此功能
- `uploadpurging.age`: 指定未完成的上传在被清理之前的最大年龄，8760h 表示 8760 小时(即一年)，任何未完成的上传文件如果超过此时间将会被清理
- `uploadpurging.dryrun`: 用于测试清理功能，设置为 false 表示实际执行清理操作，而不是仅进行模拟
- `uploadpurging.interval`: 指定执行清理操作的时间间隔，24h 表示每 24 小时执行一次清理操作