GitLab 容器镜像仓库管理

# /etc/gitlab/gitlab.rb

# 启用 Registry
registry['enable'] = true

# Registry 外部访问地址
registry_external_url 'https://registry.example.com'

# 对接配置
gitlab_rails['registry_enabled'] = true
registry['registry_http_addr'] = 'localhost:5000'

# 证书文件命名格式
registry.example.com.crt
registry.example.com.key

# Registry config.yml
version: 0.1

http:
  addr: :5000

auth:
  token:
    realm: https://gitlab.example.com/jwt/auth
    service: container_registry
    issuer: gitlab-issuer
    rootcertbundle: /etc/registry/registry.crt

services:
  registry:
    image: registry:2
    ports:
      - "5000:5000"
    volumes:
      - /home/registry/service:/etc/registry
      - /home/registry/data:/var/lib/registry
    environment:
      REGISTRY_AUTH_TOKEN_REALM: https://gitlab.example.com/jwt/auth
      REGISTRY_AUTH_TOKEN_SERVICE: container_registry
      REGISTRY_AUTH_TOKEN_ISSUER: gitlab-issuer
      REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE: /etc/registry/registry.crt

openssl req -newkey rsa:4096 -nodes -sha256 \
  -keyout /home/registry/service/registry.key \
  -x509 -days 365 \
  -out /home/registry/service/registry.crt \
  -subj "/CN=registry.example.com"

# 登录
docker login registry.example.com

# 标记镜像
docker tag myapp registry.example.com/group/project/myapp:latest

# 推送
docker push registry.example.com/group/project/myapp:latest

# 下载离线安装包
wget https://github.com/goharbor/harbor/releases/download/v2.5.0/harbor-offline-installer-v2.5.0.tgz
tar xvf harbor-offline-installer-v2.5.0.tgz

# 修改配置
cd harbor
cp harbor.yml.tmpl harbor.yml
# 编辑 harbor.yml：修改 hostname、admin 密码

# 安装启动
./install.sh

# .gitlab-ci.yml

stages:
  - build
  - deploy

build_image:
  stage: build
  image: docker:latest
  services:
    - docker:dind
  before_script:
    - docker login -u $HARBOR_USER -p $HARBOR_PASSWORD $HARBOR_URL
  script:
    - docker build -t $HARBOR_URL/$HARBOR_PROJECT/myapp:$CI_COMMIT_SHORT_SHA .
    - docker push $HARBOR_URL/$HARBOR_PROJECT/myapp:$CI_COMMIT_SHORT_SHA
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

build_image:
  stage: build
  image: docker:latest
  services:
    - docker:dind
  before_script:
    - docker login -u $HARBOR_USER -p $HARBOR_PASSWORD $HARBOR_URL
  script:
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        IMAGE_TAG="latest"
      else
        IMAGE_TAG="$CI_COMMIT_REF_SLUG"
      fi
    - docker build -t $HARBOR_URL/$HARBOR_PROJECT/myapp:$IMAGE_TAG .
    - docker push $HARBOR_URL/$HARBOR_PROJECT/myapp:$IMAGE_TAG
    # 主分支同时打 commit SHA 标签
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker tag $HARBOR_URL/$HARBOR_PROJECT/myapp:latest \
          $HARBOR_URL/$HARBOR_PROJECT/myapp:$CI_COMMIT_SHORT_SHA
        docker push $HARBOR_URL/$HARBOR_PROJECT/myapp:$CI_COMMIT_SHORT_SHA
      fi