主页 / server / 问题 / 985744
Accepted
Wanderer
Asked: 2019-09-27 06:36:22 +0800 CST

使用 S3 存储桶和代理服务器的本地容器注册表

  • 772

我正在尝试在 AWS EC2 实例上部署本地 docker 注册表。实例必须通过转发代理 (apache) 服务器进行访问。但是，我无法从正在运行的注册表容器实例中访问 s3 存储桶。我的 docker 注册表实例配置如下：

version: '3'
services:
  localRegistry:
    image: registry:2
    ports:
      - "5000:5000"
    volumes:
      - ./auth:/auth
    environment:
      - "REGISTRY_AUTH=htpasswd"
      - "REGISTRY_AUTH_HTPASSWD_REALM=MyRealm"
      - "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd"
      - "REGISTRY_STORAGE=s3"
      - "REGISTRY_STORAGE_S3_REGION={{ s3Region }}"
      - "REGISTRY_STORAGE_S3_BUCKET={{ s3BucketName }}"
      - "REGISTRY_STORAGE_CACHE_BLOBDESCRIPTOR=inmemory"
      - "REGISTRY_STORAGE_S3_ACCESSKEY={{ s3UserAccessID }}"
      - "REGISTRY_STORAGE_S3_SECRETKEY={{ s3UserAccessKey }}"
      - "REGISTRY_STORAGE_S3_ROOTDIRECTORY=/registry"
      - "REGISTRY_MIDDLEWARE_REDIRECT_BASEURL={{ proxyServerURL }}"
    restart: always

我可以使用主机上的 AWS CLI 与用户一起访问 S3 存储桶。我已在主机上禁用 SELinux。来自容器的错误消息是

localRegistry1  | time="2019-09-26T13:48:04.873569714Z" level=error msg="response completed with error" auth.user.name=<USER> err.code=unknown err.detail="s3aws: RequestError: send request failed
localRegistry1  | caused by: Put https://<s3BucketName>.s3.us-west-1.amazonaws.com/registry/docker/registry/v2/repositories/ubuntu/_uploads/34732c55-6be3-4741-bfa8-e084708eb2a1/startedat: dial tcp <s3BucketIP>:443: i/o timeout" err.message="unknown error" go.version=go1.11.2 http.request.host="localhost:5000" http.request.id=<requestID> http.request.method=POST http.request.remoteaddr="<docker0_iface_addr>:46102" http.request.uri="/v2/ubuntu/blobs/uploads/" http.request.useragent="docker/19.03.2 go/go1.12.8 git-commit/6a30dfc kernel/3.10.0-957.21.3.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/19.03.2 \(linux\))" http.response.contenttype="application/json; charset=utf-8" http.response.duration=2m0.357571388s http.response.status=500 http.response.written=104 vars.name=ubuntu 
localRegistry1  | <docker0_iface_addr> - - [26/Sep/2019:13:46:04 +0000] "POST /v2/ubuntu/blobs/uploads/ HTTP/1.1" 500 104 "" "docker/19.03.2 go/go1.12.8 git-commit/6a30dfc kernel/3.10.0-957.21.3.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/19.03.2 \\(linux\\))"

我认为这可能是转发代理 ec2 服务器和 docker 主机实例之间的 aws 安全组的问题。但是，我不太确定那会是什么。

proxy

1 个回答

  1. Best Answer

    解决方案正盯着我的脸。将 HTTP(S)_PROXY 添加到容器环境变量中。

    version: '3'
services:
  localRegistry:
    image: registry:2
    ports:
      - .....
    volumes:
      - .....
    environment:
      ......
      - "HTTP_PROXY={{ proxyServerURL }}"
      - "HTTPS_PROXY={{ proxyServerURL }}"
    restart: always
    • 1

相关问题