docker pull manifest 未知的 blob 错误

Question

我目前正在尝试将 nexus 设置为 docker 映像的私有注册表，并且已经能够登录、推送、拉取、搜索 nexus 存储库。

目前，如果在 nexus 托管存储库中不可用，我们只能从 docker 中提取图像。我们面临的错误范围从blob unknown 到manifest unknown。

[root@server1446 ~]$ docker pull server908.int.org.com:6666/centos
Using default tag: latest
Trying to pull repository server908.int.org.com:6666/centos ...
manifest unknown: manifest unknown

尝试以下参考 [Setup-Docker-Private-Registry-in-Nexus-Repository-OSS-3.0.0][1]

[1]: https://github.com/TerrenceMiao/nexus/wiki/Setup-Docker-Private-Registry-in-Nexus-Repository-OSS-3.0.0 使用 docker(group) 设置 docker(proxy) 和 docker(hosted) repo，但它会引发 blob unknown to registry 错误。

docker(hosted) 配置了 http 端口 4444 和 docker(group) 配置了 http 端口 5555，我们在下面的 nginx 配置中使用了相同的配置，但似乎都没有工作。

server {

    listen 6666;
    server_name server908.int.org.com;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/orgnexus.crt;
    ssl_certificate_key /etc/ssl/certs/orgnexus.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    client_max_body_size 1G;
    chunked_transfer_encoding on;

   location / {

      access_log              /var/log/nginx/docker.log;
      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto "https";
      proxy_pass              http://server908.int.org.com:5555;
      proxy_read_timeout      90;

    }

我们在“/etc/sysconfig/docker”文件中的条目下方发表了评论。

http_proxy=http://x.x.x.x:3128 https_proxy=http://x.x.x.x:3128

Answer 1

下面是我的配置让它工作。

server {

    proxy_send_timeout 120;
    proxy_read_timeout 300;
    proxy_buffering    off;
    tcp_nodelay        on;

    server_tokens off;
    client_max_body_size 1G;

    listen 80;
    server_name box.company.net;
    location / {
          rewrite ^(.*) https://box.company.net$1 301;
    }
}

server {

    listen 443;
    server_name box.company.net;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/ssl.crt;
    ssl_certificate_key /etc/ssl/certs/ssl.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;

    location / {

      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto "https";
      proxy_pass              http://box.company.net:8081;
      proxy_read_timeout      90;

    }
}

# correlates to your nexus http connector
server {

    listen 6666;
    server_name box.company.net;
    keepalive_timeout 60;
    ssl on;
    ssl_certificate /etc/ssl/certs/ssl.crt;
    ssl_certificate_key /etc/ssl/certs/ssl.key;
    ssl_ciphers HIGH:!kEDH:!ADH:!MD5:@STRENGTH;
    ssl_session_cache shared:TLSSSL:16m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    client_max_body_size 1G;
    chunked_transfer_encoding on;

    location / {

      proxy_set_header        Host $http_host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;

        if ($request_method !~* GET) {
                proxy_pass              http://box.company.net:4444;
        }
        if ($request_method = GET) {
                proxy_pass              http://box.company.net:5555;
        }
      proxy_read_timeout      90;
    }
}

用“/etc/default/docker”文件注释下面的条目。

http_proxy=http://x.x.x.x:3128
https_proxy=http://x.x.x.x:3128

重启 Nginx。

执行登录

[test@server ~]$ docker login -u admin -p admin123 box.company.net:6666
Login Succeeded

登录后会在“.docker”目录下创建一个名为“config.json”的文件

[test@server ~]$ cat ~/.docker/config.json
{
        "auths": {
                "box.company.net:6666": {
                        "auth": "YWRtaW46YWRtaW4xMjM="
                }
        }
}

在 docker hub 中搜索可用的图像。

[test@server ~]$ docker search box.company.net:6666/ubuntu
INDEX      NAME                                                                               DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
company.net   box.company.net:6666/ubuntu                                                 Ubuntu is a Debian-based Linux operating s...   6186      [OK] 

通过 nexus 代理从 docker hub 拉取图像。

[test@server ~]$ docker pull box.company.net:6666/ubuntu
Using default tag: latest
Trying to pull repository box.company.net:6666/ubuntu ...
sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4: Pulling from box.company.net:6666/ubuntu

75c416ea735c: Pull complete
c6ff40b6d658: Pull complete
a7050fc1f338: Pull complete
f0ffb5cf6ba9: Pull complete
be232718519c: Pull complete
Digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4
Status: Downloaded newer image for box.company.net:6666/ubuntu:latest

标记提取的图像

docker tag box.company.net:6666/ubuntu:latest box.company.net:6666/ubuntu:1

推送到 NexusHostedRepo（端口：4444）

[test@server ~]$ docker push box.company.net:6666/ubuntu:1
The push refers to a repository [box.company.net:6666/ubuntu]
0566c118947e: Pushed
6f9cf951edf5: Pushed
182d2a55830d: Pushed
latest: digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4 size: 1357

从 Nexus Repo 拉取（这应该比从 docker hub 拉取要快）

[test@server ~]$ docker pull box.company.net:6666/ubuntu:1
Trying to pull repository box.company.net:6666/ubuntu ...
sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4: Pulling from server908.int.org.com:6666/ubuntu

75c416ea735c: Pull complete
c6ff40b6d658: Pull complete
a7050fc1f338: Pull complete
Digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f423268293c25d924fbe18fd82db5a4
Status: Downloaded newer image for box.company.net:6666/ubuntu:1

----------------------------------------------- ----------------------------------

还要确保在 Nexus SSL 证书部分中添加代理服务器证书。

keytool -J-Dhttps.proxyHost=<proxy_hostname> -J-Dhttps.proxyPort=<proxy_port> -printcert -rfc -sslserver <remote_host_name:remote_ssl_port>

将 proxy_hostname 和 proxy_port 替换为 Nexus 在 Administration -> Server 下配置的 HTTP 代理服务器。将remote_host_name:remote_ssl_port 替换为存在认证问题的远程主机和端口之一。如果端口是默认的 443，则可以省略端口。对于 docker，它将是 registry-1.docker.io:443

您应该看到至少两个由上述命令打印的条目。获取最后打印的证书内容并将其完全复制到剪贴板。这应该是您的代理服务器的证书，添加到证书链的末尾。

复制的证书内容应以 -----BEGIN CERTIFICATE----- 开头，并以 -----END CERTIFICATE----- 结尾。

然后在 Nexus UI 中，转到 Administration -> SSL Certificates 并单击 Add... 并选择 Paste PEM。将证书内容粘贴到打开的对话框中。

单击加载证书。在下一个窗口中验证证书内容。验证列出的颁发者详细信息是否来自您的代理服务器证书。满意后点击添加证书。

---

希望这会有所帮助。