1

podman pull registry:3.0.0

1
2
3
4
5
6

mkdir -p /podman/podman-registry
podman run --privileged -d \
    -v /podman/podman-registry:/var/lib/registry:Z \
    -p 5000:5000 \
    --name registry \
    registry:3.0.0

1

curl http://localhost:5000/v2/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

mkdir -p /podman/podman-registry/certs
cd /podman/podman-registry/certs

openssl genrsa 2048 > cert.key

cat > csr.cnf <<EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
[dn]
C = CN
ST = shanxi
L = xi'an
O = example
OU = example
CN = localhost
EOF

openssl req -new -key cert.key -config csr.cnf -out cert.csr

1

openssl x509 -req -days 3650 -in cert.csr -signkey cert.key -out cert.crt

1

openssl x509 -in /podman/podman-registry/certs/cert.crt -text -noout

1
2
3
4

yum install -y httpd-tools
mkdir -p /podman/podman-registry/auth

htpasswd -Bbn fanyang Fhl3y_Jsdwj > /podman/podman-registry/auth/htpasswd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

mkdir -p /podman/podman-registry/etc
cat > /podman/podman-registry/etc/config.yml << 'END'
version: 0.1
log:
  level: info
storage:
  delete:
    enabled: true
  filesystem:
    rootdirectory: /var/lib/registry
http:
  addr: :5000
  secret: "Fs4Pl+rZazJr7HaBvTIOQ/crN0PUGRA06kvzJG/OmHA="
  tls:
    certificate: /var/lib/registry/certs/cert.crt
    key: /var/lib/registry/certs/cert.key
  headers:
    Access-Control-Allow-Origin: ['https://registry.example.com:5000']
    Access-Control-Allow-Methods: ['HEAD', 'GET', 'OPTIONS', 'DELETE']
    Access-Control-Allow-Headers: ['Authorization', 'Accept', 'Cache-Control']
    Access-Control-Allow-Credentials: ['true']
    Access-Control-Expose-Headers: ['Docker-Content-Digest']
auth:
  htpasswd:
    realm: Registry Realm
    path: /var/lib/registry/auth/htpasswd
END

1
2
3
4
5
6
7
8

podman rm -f registry

podman run --privileged -d -p 5000:5000 \
    -v /podman/podman-registry:/var/lib/registry:Z \
    -v /podman/podman-registry/etc/config.yml:/etc/distribution/config.yml:Z \
    -e OTEL_TRACES_EXPORTER=none \
    --name registry \
    registry:3.0.0

1
2
3
4
5
6

podman generate systemd --files --new --name registry
mv container-registry.service ~/.config/systemd/user/
restorecon -RvF ~/.config/systemd/user/

# 设置用户级别服务自动启动
systemctl --user enable --now container-registry.service

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# 备份并修改配置文件
cp -a /etc/containers/registries.conf{,.bak}

cat > /etc/containers/registries.conf << 'EOF'
unqualified-search-registries = ["registry.hflxhn.com:50000", "docker.io"]

[[registry]]
prefix = "docker.io"
location = "fiyc0dbc.mirror.aliyuncs.com"

[[registry]]
prefix = "registry.hflxhn.com:50000"
location = "registry.hflxhn.com:50000"
insecure = true
EOF

1
2
3

cat >> /etc/hosts << EOF
172.24.0.248 registry.hflxhn.com
EOF

1
2

podman tag docker.io/library/nginx registry.hflxhn.com:50000/nginx:latest
podman tag docker.io/library/registry registry.hflxhn.com:50000/registry:latest

1

podman login --username fanyang --password Fhl3y_Jsdwj registry.hflxhn.com:50000

1
2

podman push registry.hflxhn.com:50000/nginx:latest
podman push registry.hflxhn.com:50000/registry:latest

1

curl -u fanyang:Fhl3y_Jsdwj -X GET https://registry.hflxhn.com:50000/v2/_catalog -k

1

curl -u fanyang:Fhl3y_Jsdwj -k https://registry.hflxhn.com:50000/v2/php/tags/list

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 获取镜像 Manifest 的 digest：
curl -I -X GET -k \
  --header "Accept:application/vnd.docker.distribution.manifest.v2+json" \
  -u fanyang:Fhl3y_Jsdwj \
  https://registry.hflxhn.com:50000/v2/php/manifests/fpm
  
# 执行删除操作：
curl -k -I -X DELETE -u fanyang:Fhl3y_Jsdwj \
  https://registry.hflxhn.com:50000/v2/php/manifests/sha256:<digest>

# 删除功能默认关闭，需在 config.yml 中开启 delete.enabled=true

1
2

# 在删除镜像后，需要手动进行垃圾回收才能释放磁盘空间。
podman exec -it registry registry garbage-collect /etc/distribution/config.yml