├── .gitignore ├── README.md ├── custom └── config.yml ├── docker-compose.yaml ├── docker └── config.yml ├── gcr └── config.yml ├── gencert.sh ├── get-docker.sh ├── ghcr └── config.yml ├── k8s └── config.yml ├── nginx.conf ├── nvcr └── config.yml └── quay └── config.yml /.gitignore: -------------------------------------------------------------------------------- 1 | data 2 | cert 3 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # 自建 Docker 镜像加速&缓存服务 2 | 3 | > 利用 Registry 的 [镜像代理与缓存](https://docs.docker.com/registry/recipes/mirror/) 功能加速&缓存镜像，同时支持 dockerhub、gcr.io、quay.io、nvcr.io、registry.k8s.io 等多个仓库，保持原有仓库的镜像tag不变，且一次拉取之后打包整个仓库目录可离线使用， 4 | 5 | ## 1. 安装docker 6 | 7 | ```sh 8 | git clone https://github.com/brighill/registry-mirror.git 9 | cd registry-mirror 10 | ./get-docker.sh --mirror Aliyun 11 | ``` 12 | 13 | ## 2. 生成证书 14 | 15 | ```sh 16 | ./gencert.sh 17 | ``` 18 | 19 | ## 3. 启动服务端 20 | 设置代理（可选） 21 | ```sh 22 | # 例1: socks5 代理 ip 192.168.1.1 端口 1080 23 | export PROXY=socks5://192.168.1.1:1080 24 | 25 | # 例2: http 代理ip 192.168.1.1 端口 1080 26 | export PROXY=http://192.168.1.1:1080 27 | ``` 28 | 29 | *启动服务* 30 | 31 | ```sh 32 | docker compose up -d 33 | ``` 34 | 35 | ## 4. 配置客户端 36 | ### 劫持域名解析 37 | 38 | *以自建仓库ip为192.168.1.1为例，修改/etc/hosts 添加以下内容* 39 | 40 | ```sh 41 | 192.168.1.1 gcr.io quay.io docker.io registry-1.docker.io nvcr.io registry.k8s.io custom.local 42 | ``` 43 | 44 | ### 信任证书 45 | 46 | 需要把生成的 **cert/ca.crt** 拷贝到客户端 47 | 48 | ```sh 49 | # macOS 50 | sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain cert/ca.crt 51 | ``` 52 | 53 | ```sh 54 | # Debian/Ubuntu 55 | sudo apt install ca-certificates 56 | sudo cp cert/ca.crt /usr/local/share/ca-certificates/ca.crt 57 | sudo update-ca-certificates 58 | ``` 59 | 60 | ```sh 61 | # CentOS/Fedora/RHEL 62 | sudo yum install ca-certificates 63 | sudo update-ca-trust force-enable 64 | sudo cp cert/ca.crt /etc/pki/ca-trust/source/anchors/ 65 | sudo update-ca-trust 66 | ``` 67 | 68 | ### 重启docker 69 | 70 | ```sh 71 | sudo systemctl daemon-reload 72 | sudo systemctl restart docker 73 | ``` 74 | 75 | ### 测试 76 | 77 | ```sh 78 | # Docker Hub 79 | docker pull alpine 80 | # registry.k8s.io 81 | docker pull registry.k8s.io/pause:3.9 82 | # quay.io 83 | docker pull quay.io/coreos/etcd:v3.4.33 84 | # gcr.io 85 | docker pull gcr.io/google-containers/pause:3.2 86 | # ghcr.io 87 | docker pull ghcr.io/coder/coder:v2.13.0 88 | # nvcr.io 89 | docker pull nvcr.io/nvidia/k8s/cuda-sample:devicequery 90 | ``` 91 | -------------------------------------------------------------------------------- /custom/config.yml: -------------------------------------------------------------------------------- 1 | version: 0.1 2 | log: 3 | fields: 4 | service: registry 5 | storage: 6 | cache: 7 | blobdescriptor: inmemory 8 | filesystem: 9 | rootdirectory: /var/lib/registry 10 | http: 11 | addr: :80 12 | headers: 13 | X-Content-Type-Options: [nosniff] 14 | health: 15 | storagedriver: 16 | enabled: true 17 | interval: 10s 18 | threshold: 3 19 | -------------------------------------------------------------------------------- /docker-compose.yaml: -------------------------------------------------------------------------------- 1 | version: '3' 2 | services: 3 | docker: 4 | container_name: docker 5 | image: registry:2.8.3 6 | restart: always 7 | environment: 8 | - HTTP_PROXY=${PROXY} 9 | - HTTPS_PROXY=${PROXY} 10 | volumes: 11 | - ./data:/var/lib/registry 12 | - ./docker/config.yml:/etc/docker/registry/config.yml 13 | nvcr: 14 | container_name: nvcr 15 | image: registry:2.8.3 16 | restart: always 17 | environment: 18 | - HTTP_PROXY=${PROXY} 19 | - HTTPS_PROXY=${PROXY} 20 | volumes: 21 | - ./data:/var/lib/registry 22 | - ./nvcr/config.yml:/etc/docker/registry/config.yml 23 | gcr: 24 | container_name: gcr 25 | image: registry:2.8.3 26 | restart: always 27 | environment: 28 | - HTTP_PROXY=${PROXY} 29 | - HTTPS_PROXY=${PROXY} 30 | volumes: 31 | - ./data:/var/lib/registry 32 | - ./gcr/config.yml:/etc/docker/registry/config.yml 33 | ghcr: 34 | container_name: ghcr 35 | image: registry:2.8.3 36 | restart: always 37 | environment: 38 | - HTTP_PROXY=${PROXY} 39 | - HTTPS_PROXY=${PROXY} 40 | volumes: 41 | - ./data:/var/lib/registry 42 | - ./ghcr/config.yml:/etc/docker/registry/config.yml 43 | k8s: 44 | container_name: k8s 45 | image: registry:2.8.3 46 | restart: always 47 | environment: 48 | - HTTP_PROXY=${PROXY} 49 | - HTTPS_PROXY=${PROXY} 50 | volumes: 51 | - ./data:/var/lib/registry 52 | - ./k8s/config.yml:/etc/docker/registry/config.yml 53 | quay: 54 | container_name: quay 55 | image: registry:2.8.3 56 | restart: always 57 | environment: 58 | - HTTP_PROXY=${PROXY} 59 | - HTTPS_PROXY=${PROXY} 60 | volumes: 61 | - ./data:/var/lib/registry 62 | - ./quay/config.yml:/etc/docker/registry/config.yml 63 | custom: 64 | container_name: custom 65 | image: registry:2.8.3 66 | restart: always 67 | volumes: 68 | - ./data:/var/lib/registry 69 | - ./custom/config.yml:/etc/docker/registry/config.yml 70 | nginx: 71 | container_name: nginx 72 | image: nginx:alpine 73 | restart: always 74 | ports: 75 | - "443:443" 76 | volumes: 77 | - ./nginx.conf:/etc/nginx/conf.d/default.conf 78 | - ./cert:/etc/nginx/cert 79 | -------------------------------------------------------------------------------- /docker/config.yml: -------------------------------------------------------------------------------- 1 | version: 0.1 2 | log: 3 | fields: 4 | service: registry 5 | storage: 6 | cache: 7 | blobdescriptor: inmemory 8 | filesystem: 9 | rootdirectory: /var/lib/registry 10 | http: 11 | addr: :80 12 | headers: 13 | X-Content-Type-Options: [nosniff] 14 | health: 15 | storagedriver: 16 | enabled: true 17 | interval: 10s 18 | threshold: 3 19 | proxy: 20 | remoteurl: https://registry-1.docker.io 21 | -------------------------------------------------------------------------------- /gcr/config.yml: -------------------------------------------------------------------------------- 1 | version: 0.1 2 | log: 3 | fields: 4 | service: registry 5 | storage: 6 | cache: 7 | blobdescriptor: inmemory 8 | filesystem: 9 | rootdirectory: /var/lib/registry 10 | http: 11 | addr: :80 12 | headers: 13 | X-Content-Type-Options: [nosniff] 14 | health: 15 | storagedriver: 16 | enabled: true 17 | interval: 10s 18 | threshold: 3 19 | proxy: 20 | remoteurl: https://gcr.io 21 | -------------------------------------------------------------------------------- /gencert.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # 检查 OpenSSL 命令是否存在 4 | if ! command -v openssl &>/dev/null; then 5 | echo "错误：未安装 OpenSSL 或未将其添加到 PATH 中。" 6 | exit 1 7 | fi 8 | 9 | read -s -p "设置 CA 密码：" password 10 | echo "" 11 | 12 | # 创建 cert 目录 13 | cert_dir="cert" 14 | mkdir -p $cert_dir 15 | 16 | # 证书的基本信息 17 | days=3650 18 | country="CN" 19 | state="Shanghai" 20 | locality="Shanghai" 21 | organization="registry" 22 | organizational_unit="registry" 23 | common_name="registry.com" 24 | alt_names="DNS:gcr.io,DNS:ghcr.io,DNS:*.k8s.io,DNS:*.docker.io,DNS:quay.io,DNS:nvcr.io,DNS:custom.local" 25 | 26 | # 生成自签名的 CA 私钥和证书 27 | generate_ca() { 28 | echo "正在生成自签名的 CA 私钥和证书..." 29 | openssl genrsa -des3 -out $cert_dir/ca.key -passout pass:"$password" 4096 30 | openssl req -x509 -new -key $cert_dir/ca.key -out $cert_dir/ca.crt -subj "/C=$country/ST=$state/L=$locality/O=$organization/OU=$organizational_unit/CN=$common_name" -days $days -passin pass:"$password" 31 | } 32 | 33 | # 生成服务器证书签署请求（CSR）和私钥 34 | generate_server_csr() { 35 | echo "正在生成服务器证书签署请求（CSR）和私钥..." 36 | openssl req -new -keyout $cert_dir/server.key -out $cert_dir/server.csr -subj "/C=$country/ST=$state/L=$locality/O=$organization/OU=$organizational_unit/CN=$common_name" -nodes 37 | } 38 | 39 | # 使用 CA 对 CSR 进行签名，生成服务器证书 40 | sign_server_certificate() { 41 | echo "正在使用 CA 对 CSR 进行签名，生成服务器证书..." 42 | openssl x509 -req -in $cert_dir/server.csr -CA $cert_dir/ca.crt -CAkey $cert_dir/ca.key -CAcreateserial -out $cert_dir/server.crt -days $days -extfile <(echo "subjectAltName=$alt_names") -passin pass:"$password" 43 | } 44 | 45 | # 执行证书生成流程 46 | main() { 47 | generate_ca 48 | generate_server_csr 49 | sign_server_certificate 50 | } 51 | 52 | main 53 | 54 | -------------------------------------------------------------------------------- /get-docker.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | set -e 3 | # Docker Engine for Linux installation script. 4 | # 5 | # This script is intended as a convenient way to configure docker's package 6 | # repositories and to install Docker Engine, This script is not recommended 7 | # for production environments. Before running this script, make yourself familiar 8 | # with potential risks and limitations, and refer to the installation manual 9 | # at https://docs.docker.com/engine/install/ for alternative installation methods. 10 | # 11 | # The script: 12 | # 13 | # - Requires `root` or `sudo` privileges to run. 14 | # - Attempts to detect your Linux distribution and version and configure your 15 | # package management system for you. 16 | # - Doesn't allow you to customize most installation parameters. 17 | # - Installs dependencies and recommendations without asking for confirmation. 18 | # - Installs the latest stable release (by default) of Docker CLI, Docker Engine, 19 | # Docker Buildx, Docker Compose, containerd, and runc. When using this script 20 | # to provision a machine, this may result in unexpected major version upgrades 21 | # of these packages. Always test upgrades in a test environment before 22 | # deploying to your production systems. 23 | # - Isn't designed to upgrade an existing Docker installation. When using the 24 | # script to update an existing installation, dependencies may not be updated 25 | # to the expected version, resulting in outdated versions. 26 | # 27 | # Source code is available at https://github.com/docker/docker-install/ 28 | # 29 | # Usage 30 | # ============================================================================== 31 | # 32 | # To install the latest stable versions of Docker CLI, Docker Engine, and their 33 | # dependencies: 34 | # 35 | # 1. download the script 36 | # 37 | # $ curl -fsSL https://get.docker.com -o install-docker.sh 38 | # 39 | # 2. verify the script's content 40 | # 41 | # $ cat install-docker.sh 42 | # 43 | # 3. run the script with --dry-run to verify the steps it executes 44 | # 45 | # $ sh install-docker.sh --dry-run 46 | # 47 | # 4. run the script either as root, or using sudo to perform the installation. 48 | # 49 | # $ sudo sh install-docker.sh 50 | # 51 | # Command-line options 52 | # ============================================================================== 53 | # 54 | # --version 55 | # Use the --version option to install a specific version, for example: 56 | # 57 | # $ sudo sh install-docker.sh --version 23.0 58 | # 59 | # --channel 60 | # 61 | # Use the --channel option to install from an alternative installation channel. 62 | # The following example installs the latest versions from the "test" channel, 63 | # which includes pre-releases (alpha, beta, rc): 64 | # 65 | # $ sudo sh install-docker.sh --channel test 66 | # 67 | # Alternatively, use the script at https://test.docker.com, which uses the test 68 | # channel as default. 69 | # 70 | # --mirror 71 | # 72 | # Use the --mirror option to install from a mirror supported by this script. 73 | # Available mirrors are "Aliyun" (https://mirrors.aliyun.com/docker-ce), and 74 | # "AzureChinaCloud" (https://mirror.azure.cn/docker-ce), for example: 75 | # 76 | # $ sudo sh install-docker.sh --mirror AzureChinaCloud 77 | # 78 | # ============================================================================== 79 | 80 | 81 | # Git commit from https://github.com/docker/docker-install when 82 | # the script was uploaded (Should only be modified by upload job): 83 | SCRIPT_COMMIT_SHA="6d9743e9656cc56f699a64800b098d5ea5a60020" 84 | 85 | # strip "v" prefix if present 86 | VERSION="${VERSION#v}" 87 | 88 | # The channel to install from: 89 | # * stable 90 | # * test 91 | # * edge (deprecated) 92 | # * nightly (deprecated) 93 | DEFAULT_CHANNEL_VALUE="stable" 94 | if [ -z "$CHANNEL" ]; then 95 | CHANNEL=$DEFAULT_CHANNEL_VALUE 96 | fi 97 | 98 | DEFAULT_DOWNLOAD_URL="https://download.docker.com" 99 | if [ -z "$DOWNLOAD_URL" ]; then 100 | DOWNLOAD_URL=$DEFAULT_DOWNLOAD_URL 101 | fi 102 | 103 | DEFAULT_REPO_FILE="docker-ce.repo" 104 | if [ -z "$REPO_FILE" ]; then 105 | REPO_FILE="$DEFAULT_REPO_FILE" 106 | fi 107 | 108 | mirror='' 109 | DRY_RUN=${DRY_RUN:-} 110 | while [ $# -gt 0 ]; do 111 | case "$1" in 112 | --channel) 113 | CHANNEL="$2" 114 | shift 115 | ;; 116 | --dry-run) 117 | DRY_RUN=1 118 | ;; 119 | --mirror) 120 | mirror="$2" 121 | shift 122 | ;; 123 | --version) 124 | VERSION="${2#v}" 125 | shift 126 | ;; 127 | --*) 128 | echo "Illegal option $1" 129 | ;; 130 | esac 131 | shift $(( $# > 0 ? 1 : 0 )) 132 | done 133 | 134 | case "$mirror" in 135 | Aliyun) 136 | DOWNLOAD_URL="https://mirrors.aliyun.com/docker-ce" 137 | ;; 138 | AzureChinaCloud) 139 | DOWNLOAD_URL="https://mirror.azure.cn/docker-ce" 140 | ;; 141 | "") 142 | ;; 143 | *) 144 | >&2 echo "unknown mirror '$mirror': use either 'Aliyun', or 'AzureChinaCloud'." 145 | exit 1 146 | ;; 147 | esac 148 | 149 | case "$CHANNEL" in 150 | stable|test) 151 | ;; 152 | edge|nightly) 153 | >&2 echo "DEPRECATED: the $CHANNEL channel has been deprecated and is no longer supported by this script." 154 | exit 1 155 | ;; 156 | *) 157 | >&2 echo "unknown CHANNEL '$CHANNEL': use either stable or test." 158 | exit 1 159 | ;; 160 | esac 161 | 162 | command_exists() { 163 | command -v "$@" > /dev/null 2>&1 164 | } 165 | 166 | # version_gte checks if the version specified in $VERSION is at least the given 167 | # SemVer (Maj.Minor[.Patch]), or CalVer (YY.MM) version.It returns 0 (success) 168 | # if $VERSION is either unset (=latest) or newer or equal than the specified 169 | # version, or returns 1 (fail) otherwise. 170 | # 171 | # examples: 172 | # 173 | # VERSION=23.0 174 | # version_gte 23.0 // 0 (success) 175 | # version_gte 20.10 // 0 (success) 176 | # version_gte 19.03 // 0 (success) 177 | # version_gte 21.10 // 1 (fail) 178 | version_gte() { 179 | if [ -z "$VERSION" ]; then 180 | return 0 181 | fi 182 | eval version_compare "$VERSION" "$1" 183 | } 184 | 185 | # version_compare compares two version strings (either SemVer (Major.Minor.Path), 186 | # or CalVer (YY.MM) version strings. It returns 0 (success) if version A is newer 187 | # or equal than version B, or 1 (fail) otherwise. Patch releases and pre-release 188 | # (-alpha/-beta) are not taken into account 189 | # 190 | # examples: 191 | # 192 | # version_compare 23.0.0 20.10 // 0 (success) 193 | # version_compare 23.0 20.10 // 0 (success) 194 | # version_compare 20.10 19.03 // 0 (success) 195 | # version_compare 20.10 20.10 // 0 (success) 196 | # version_compare 19.03 20.10 // 1 (fail) 197 | version_compare() ( 198 | set +x 199 | 200 | yy_a="$(echo "$1" | cut -d'.' -f1)" 201 | yy_b="$(echo "$2" | cut -d'.' -f1)" 202 | if [ "$yy_a" -lt "$yy_b" ]; then 203 | return 1 204 | fi 205 | if [ "$yy_a" -gt "$yy_b" ]; then 206 | return 0 207 | fi 208 | mm_a="$(echo "$1" | cut -d'.' -f2)" 209 | mm_b="$(echo "$2" | cut -d'.' -f2)" 210 | 211 | # trim leading zeros to accommodate CalVer 212 | mm_a="${mm_a#0}" 213 | mm_b="${mm_b#0}" 214 | 215 | if [ "${mm_a:-0}" -lt "${mm_b:-0}" ]; then 216 | return 1 217 | fi 218 | 219 | return 0 220 | ) 221 | 222 | is_dry_run() { 223 | if [ -z "$DRY_RUN" ]; then 224 | return 1 225 | else 226 | return 0 227 | fi 228 | } 229 | 230 | is_wsl() { 231 | case "$(uname -r)" in 232 | *microsoft* ) true ;; # WSL 2 233 | *Microsoft* ) true ;; # WSL 1 234 | * ) false;; 235 | esac 236 | } 237 | 238 | is_darwin() { 239 | case "$(uname -s)" in 240 | *darwin* ) true ;; 241 | *Darwin* ) true ;; 242 | * ) false;; 243 | esac 244 | } 245 | 246 | deprecation_notice() { 247 | distro=$1 248 | distro_version=$2 249 | echo 250 | printf "\033[91;1mDEPRECATION WARNING\033[0m\n" 251 | printf " This Linux distribution (\033[1m%s %s\033[0m) reached end-of-life and is no longer supported by this script.\n" "$distro" "$distro_version" 252 | echo " No updates or security fixes will be released for this distribution, and users are recommended" 253 | echo " to upgrade to a currently maintained version of $distro." 254 | echo 255 | printf "Press \033[1mCtrl+C\033[0m now to abort this script, or wait for the installation to continue." 256 | echo 257 | sleep 10 258 | } 259 | 260 | get_distribution() { 261 | lsb_dist="" 262 | # Every system that we officially support has /etc/os-release 263 | if [ -r /etc/os-release ]; then 264 | lsb_dist="$(. /etc/os-release && echo "$ID")" 265 | fi 266 | # Returning an empty string here should be alright since the 267 | # case statements don't act unless you provide an actual value 268 | echo "$lsb_dist" 269 | } 270 | 271 | echo_docker_as_nonroot() { 272 | if is_dry_run; then 273 | return 274 | fi 275 | if command_exists docker && [ -e /var/run/docker.sock ]; then 276 | ( 277 | set -x 278 | $sh_c 'docker version' 279 | ) || true 280 | fi 281 | 282 | # intentionally mixed spaces and tabs here -- tabs are stripped by "<<-EOF", spaces are kept in the output 283 | echo 284 | echo "================================================================================" 285 | echo 286 | if version_gte "20.10"; then 287 | echo "To run Docker as a non-privileged user, consider setting up the" 288 | echo "Docker daemon in rootless mode for your user:" 289 | echo 290 | echo " dockerd-rootless-setuptool.sh install" 291 | echo 292 | echo "Visit https://docs.docker.com/go/rootless/ to learn about rootless mode." 293 | echo 294 | fi 295 | echo 296 | echo "To run the Docker daemon as a fully privileged service, but granting non-root" 297 | echo "users access, refer to https://docs.docker.com/go/daemon-access/" 298 | echo 299 | echo "WARNING: Access to the remote API on a privileged Docker daemon is equivalent" 300 | echo " to root access on the host. Refer to the 'Docker daemon attack surface'" 301 | echo " documentation for details: https://docs.docker.com/go/attack-surface/" 302 | echo 303 | echo "================================================================================" 304 | echo 305 | } 306 | 307 | # Check if this is a forked Linux distro 308 | check_forked() { 309 | 310 | # Check for lsb_release command existence, it usually exists in forked distros 311 | if command_exists lsb_release; then 312 | # Check if the `-u` option is supported 313 | set +e 314 | lsb_release -a -u > /dev/null 2>&1 315 | lsb_release_exit_code=$? 316 | set -e 317 | 318 | # Check if the command has exited successfully, it means we're in a forked distro 319 | if [ "$lsb_release_exit_code" = "0" ]; then 320 | # Print info about current distro 321 | cat <<-EOF 322 | You're using '$lsb_dist' version '$dist_version'. 323 | EOF 324 | 325 | # Get the upstream release info 326 | lsb_dist=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'id' | cut -d ':' -f 2 | tr -d '[:space:]') 327 | dist_version=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'codename' | cut -d ':' -f 2 | tr -d '[:space:]') 328 | 329 | # Print info about upstream distro 330 | cat <<-EOF 331 | Upstream release is '$lsb_dist' version '$dist_version'. 332 | EOF 333 | else 334 | if [ -r /etc/debian_version ] && [ "$lsb_dist" != "ubuntu" ] && [ "$lsb_dist" != "raspbian" ]; then 335 | if [ "$lsb_dist" = "osmc" ]; then 336 | # OSMC runs Raspbian 337 | lsb_dist=raspbian 338 | else 339 | # We're Debian and don't even know it! 340 | lsb_dist=debian 341 | fi 342 | dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')" 343 | case "$dist_version" in 344 | 12) 345 | dist_version="bookworm" 346 | ;; 347 | 11) 348 | dist_version="bullseye" 349 | ;; 350 | 10) 351 | dist_version="buster" 352 | ;; 353 | 9) 354 | dist_version="stretch" 355 | ;; 356 | 8) 357 | dist_version="jessie" 358 | ;; 359 | esac 360 | fi 361 | fi 362 | fi 363 | } 364 | 365 | do_install() { 366 | echo "# Executing docker install script, commit: $SCRIPT_COMMIT_SHA" 367 | 368 | if command_exists docker; then 369 | cat >&2 <<-'EOF' 370 | Warning: the "docker" command appears to already exist on this system. 371 | 372 | If you already have Docker installed, this script can cause trouble, which is 373 | why we're displaying this warning and provide the opportunity to cancel the 374 | installation. 375 | 376 | If you installed the current Docker package using this script and are using it 377 | again to update Docker, you can safely ignore this message. 378 | 379 | You may press Ctrl+C now to abort this script. 380 | EOF 381 | ( set -x; sleep 20 ) 382 | fi 383 | 384 | user="$(id -un 2>/dev/null || true)" 385 | 386 | sh_c='sh -c' 387 | if [ "$user" != 'root' ]; then 388 | if command_exists sudo; then 389 | sh_c='sudo -E sh -c' 390 | elif command_exists su; then 391 | sh_c='su -c' 392 | else 393 | cat >&2 <<-'EOF' 394 | Error: this installer needs the ability to run commands as root. 395 | We are unable to find either "sudo" or "su" available to make this happen. 396 | EOF 397 | exit 1 398 | fi 399 | fi 400 | 401 | if is_dry_run; then 402 | sh_c="echo" 403 | fi 404 | 405 | # perform some very rudimentary platform detection 406 | lsb_dist=$( get_distribution ) 407 | lsb_dist="$(echo "$lsb_dist" | tr '[:upper:]' '[:lower:]')" 408 | 409 | if is_wsl; then 410 | echo 411 | echo "WSL DETECTED: We recommend using Docker Desktop for Windows." 412 | echo "Please get Docker Desktop from https://www.docker.com/products/docker-desktop/" 413 | echo 414 | cat >&2 <<-'EOF' 415 | 416 | You may press Ctrl+C now to abort this script. 417 | EOF 418 | ( set -x; sleep 20 ) 419 | fi 420 | 421 | case "$lsb_dist" in 422 | 423 | ubuntu) 424 | if command_exists lsb_release; then 425 | dist_version="$(lsb_release --codename | cut -f2)" 426 | fi 427 | if [ -z "$dist_version" ] && [ -r /etc/lsb-release ]; then 428 | dist_version="$(. /etc/lsb-release && echo "$DISTRIB_CODENAME")" 429 | fi 430 | ;; 431 | 432 | debian|raspbian) 433 | dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')" 434 | case "$dist_version" in 435 | 12) 436 | dist_version="bookworm" 437 | ;; 438 | 11) 439 | dist_version="bullseye" 440 | ;; 441 | 10) 442 | dist_version="buster" 443 | ;; 444 | 9) 445 | dist_version="stretch" 446 | ;; 447 | 8) 448 | dist_version="jessie" 449 | ;; 450 | esac 451 | ;; 452 | 453 | centos|rhel) 454 | if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then 455 | dist_version="$(. /etc/os-release && echo "$VERSION_ID")" 456 | fi 457 | ;; 458 | 459 | *) 460 | if command_exists lsb_release; then 461 | dist_version="$(lsb_release --release | cut -f2)" 462 | fi 463 | if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then 464 | dist_version="$(. /etc/os-release && echo "$VERSION_ID")" 465 | fi 466 | ;; 467 | 468 | esac 469 | 470 | # Check if this is a forked Linux distro 471 | check_forked 472 | 473 | # Print deprecation warnings for distro versions that recently reached EOL, 474 | # but may still be commonly used (especially LTS versions). 475 | case "$lsb_dist.$dist_version" in 476 | debian.stretch|debian.jessie) 477 | deprecation_notice "$lsb_dist" "$dist_version" 478 | ;; 479 | raspbian.stretch|raspbian.jessie) 480 | deprecation_notice "$lsb_dist" "$dist_version" 481 | ;; 482 | ubuntu.xenial|ubuntu.trusty) 483 | deprecation_notice "$lsb_dist" "$dist_version" 484 | ;; 485 | ubuntu.lunar|ubuntu.kinetic|ubuntu.impish|ubuntu.hirsute|ubuntu.groovy|ubuntu.eoan|ubuntu.disco|ubuntu.cosmic) 486 | deprecation_notice "$lsb_dist" "$dist_version" 487 | ;; 488 | fedora.*) 489 | if [ "$dist_version" -lt 36 ]; then 490 | deprecation_notice "$lsb_dist" "$dist_version" 491 | fi 492 | ;; 493 | esac 494 | 495 | # Run setup for each distro accordingly 496 | case "$lsb_dist" in 497 | ubuntu|debian|raspbian) 498 | pre_reqs="apt-transport-https ca-certificates curl" 499 | apt_repo="deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] $DOWNLOAD_URL/linux/$lsb_dist $dist_version $CHANNEL" 500 | ( 501 | if ! is_dry_run; then 502 | set -x 503 | fi 504 | $sh_c 'apt-get update -qq >/dev/null' 505 | $sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq $pre_reqs >/dev/null" 506 | $sh_c 'install -m 0755 -d /etc/apt/keyrings' 507 | $sh_c "curl -fsSL \"$DOWNLOAD_URL/linux/$lsb_dist/gpg\" -o /etc/apt/keyrings/docker.asc" 508 | $sh_c "chmod a+r /etc/apt/keyrings/docker.asc" 509 | $sh_c "echo \"$apt_repo\" > /etc/apt/sources.list.d/docker.list" 510 | $sh_c 'apt-get update -qq >/dev/null' 511 | ) 512 | pkg_version="" 513 | if [ -n "$VERSION" ]; then 514 | if is_dry_run; then 515 | echo "# WARNING: VERSION pinning is not supported in DRY_RUN" 516 | else 517 | # Will work for incomplete versions IE (17.12), but may not actually grab the "latest" if in the test channel 518 | pkg_pattern="$(echo "$VERSION" | sed 's/-ce-/~ce~.*/g' | sed 's/-/.*/g')" 519 | search_command="apt-cache madison docker-ce | grep '$pkg_pattern' | head -1 | awk '{\$1=\$1};1' | cut -d' ' -f 3" 520 | pkg_version="$($sh_c "$search_command")" 521 | echo "INFO: Searching repository for VERSION '$VERSION'" 522 | echo "INFO: $search_command" 523 | if [ -z "$pkg_version" ]; then 524 | echo 525 | echo "ERROR: '$VERSION' not found amongst apt-cache madison results" 526 | echo 527 | exit 1 528 | fi 529 | if version_gte "18.09"; then 530 | search_command="apt-cache madison docker-ce-cli | grep '$pkg_pattern' | head -1 | awk '{\$1=\$1};1' | cut -d' ' -f 3" 531 | echo "INFO: $search_command" 532 | cli_pkg_version="=$($sh_c "$search_command")" 533 | fi 534 | pkg_version="=$pkg_version" 535 | fi 536 | fi 537 | ( 538 | pkgs="docker-ce${pkg_version%=}" 539 | if version_gte "18.09"; then 540 | # older versions didn't ship the cli and containerd as separate packages 541 | pkgs="$pkgs docker-ce-cli${cli_pkg_version%=} containerd.io" 542 | fi 543 | if version_gte "20.10"; then 544 | pkgs="$pkgs docker-compose-plugin docker-ce-rootless-extras$pkg_version" 545 | fi 546 | if version_gte "23.0"; then 547 | pkgs="$pkgs docker-buildx-plugin" 548 | fi 549 | if ! is_dry_run; then 550 | set -x 551 | fi 552 | $sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq $pkgs >/dev/null" 553 | ) 554 | echo_docker_as_nonroot 555 | exit 0 556 | ;; 557 | centos|fedora|rhel) 558 | if [ "$(uname -m)" != "s390x" ] && [ "$lsb_dist" = "rhel" ]; then 559 | echo "Packages for RHEL are currently only available for s390x." 560 | exit 1 561 | fi 562 | 563 | if command_exists dnf; then 564 | pkg_manager="dnf" 565 | pkg_manager_flags="--best" 566 | config_manager="dnf config-manager" 567 | enable_channel_flag="--set-enabled" 568 | disable_channel_flag="--set-disabled" 569 | pre_reqs="dnf-plugins-core" 570 | else 571 | pkg_manager="yum" 572 | pkg_manager_flags="" 573 | config_manager="yum-config-manager" 574 | enable_channel_flag="--enable" 575 | disable_channel_flag="--disable" 576 | pre_reqs="yum-utils" 577 | fi 578 | 579 | if [ "$lsb_dist" = "fedora" ]; then 580 | pkg_suffix="fc$dist_version" 581 | else 582 | pkg_suffix="el" 583 | fi 584 | repo_file_url="$DOWNLOAD_URL/linux/$lsb_dist/$REPO_FILE" 585 | ( 586 | if ! is_dry_run; then 587 | set -x 588 | fi 589 | $sh_c "$pkg_manager $pkg_manager_flags install -y -q $pre_reqs" 590 | $sh_c "$config_manager --add-repo $repo_file_url" 591 | 592 | if [ "$CHANNEL" != "stable" ]; then 593 | $sh_c "$config_manager $disable_channel_flag 'docker-ce-*'" 594 | $sh_c "$config_manager $enable_channel_flag 'docker-ce-$CHANNEL'" 595 | fi 596 | $sh_c "$pkg_manager makecache" 597 | ) 598 | pkg_version="" 599 | if [ -n "$VERSION" ]; then 600 | if is_dry_run; then 601 | echo "# WARNING: VERSION pinning is not supported in DRY_RUN" 602 | else 603 | pkg_pattern="$(echo "$VERSION" | sed 's/-ce-/\\\\.ce.*/g' | sed 's/-/.*/g').*$pkg_suffix" 604 | search_command="$pkg_manager list --showduplicates docker-ce | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'" 605 | pkg_version="$($sh_c "$search_command")" 606 | echo "INFO: Searching repository for VERSION '$VERSION'" 607 | echo "INFO: $search_command" 608 | if [ -z "$pkg_version" ]; then 609 | echo 610 | echo "ERROR: '$VERSION' not found amongst $pkg_manager list results" 611 | echo 612 | exit 1 613 | fi 614 | if version_gte "18.09"; then 615 | # older versions don't support a cli package 616 | search_command="$pkg_manager list --showduplicates docker-ce-cli | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'" 617 | cli_pkg_version="$($sh_c "$search_command" | cut -d':' -f 2)" 618 | fi 619 | # Cut out the epoch and prefix with a '-' 620 | pkg_version="-$(echo "$pkg_version" | cut -d':' -f 2)" 621 | fi 622 | fi 623 | ( 624 | pkgs="docker-ce$pkg_version" 625 | if version_gte "18.09"; then 626 | # older versions didn't ship the cli and containerd as separate packages 627 | if [ -n "$cli_pkg_version" ]; then 628 | pkgs="$pkgs docker-ce-cli-$cli_pkg_version containerd.io" 629 | else 630 | pkgs="$pkgs docker-ce-cli containerd.io" 631 | fi 632 | fi 633 | if version_gte "20.10"; then 634 | pkgs="$pkgs docker-compose-plugin docker-ce-rootless-extras$pkg_version" 635 | fi 636 | if version_gte "23.0"; then 637 | pkgs="$pkgs docker-buildx-plugin" 638 | fi 639 | if ! is_dry_run; then 640 | set -x 641 | fi 642 | $sh_c "$pkg_manager $pkg_manager_flags install -y -q $pkgs" 643 | ) 644 | echo_docker_as_nonroot 645 | exit 0 646 | ;; 647 | sles) 648 | if [ "$(uname -m)" != "s390x" ]; then 649 | echo "Packages for SLES are currently only available for s390x" 650 | exit 1 651 | fi 652 | repo_file_url="$DOWNLOAD_URL/linux/$lsb_dist/$REPO_FILE" 653 | pre_reqs="ca-certificates curl libseccomp2 awk" 654 | ( 655 | if ! is_dry_run; then 656 | set -x 657 | fi 658 | $sh_c "zypper install -y $pre_reqs" 659 | $sh_c "zypper addrepo $repo_file_url" 660 | if ! is_dry_run; then 661 | cat >&2 <<-'EOF' 662 | WARNING!! 663 | openSUSE repository (https://download.opensuse.org/repositories/security:/SELinux) will be enabled now. 664 | Do you wish to continue? 665 | You may press Ctrl+C now to abort this script. 666 | EOF 667 | ( set -x; sleep 30 ) 668 | fi 669 | opensuse_repo="https://download.opensuse.org/repositories/security:/SELinux/openSUSE_Factory/security:SELinux.repo" 670 | $sh_c "zypper addrepo $opensuse_repo" 671 | $sh_c "zypper --gpg-auto-import-keys refresh" 672 | $sh_c "zypper lr -d" 673 | ) 674 | pkg_version="" 675 | if [ -n "$VERSION" ]; then 676 | if is_dry_run; then 677 | echo "# WARNING: VERSION pinning is not supported in DRY_RUN" 678 | else 679 | pkg_pattern="$(echo "$VERSION" | sed 's/-ce-/\\\\.ce.*/g' | sed 's/-/.*/g')" 680 | search_command="zypper search -s --match-exact 'docker-ce' | grep '$pkg_pattern' | tail -1 | awk '{print \$6}'" 681 | pkg_version="$($sh_c "$search_command")" 682 | echo "INFO: Searching repository for VERSION '$VERSION'" 683 | echo "INFO: $search_command" 684 | if [ -z "$pkg_version" ]; then 685 | echo 686 | echo "ERROR: '$VERSION' not found amongst zypper list results" 687 | echo 688 | exit 1 689 | fi 690 | search_command="zypper search -s --match-exact 'docker-ce-cli' | grep '$pkg_pattern' | tail -1 | awk '{print \$6}'" 691 | # It's okay for cli_pkg_version to be blank, since older versions don't support a cli package 692 | cli_pkg_version="$($sh_c "$search_command")" 693 | pkg_version="-$pkg_version" 694 | fi 695 | fi 696 | ( 697 | pkgs="docker-ce$pkg_version" 698 | if version_gte "18.09"; then 699 | if [ -n "$cli_pkg_version" ]; then 700 | # older versions didn't ship the cli and containerd as separate packages 701 | pkgs="$pkgs docker-ce-cli-$cli_pkg_version containerd.io" 702 | else 703 | pkgs="$pkgs docker-ce-cli containerd.io" 704 | fi 705 | fi 706 | if version_gte "20.10"; then 707 | pkgs="$pkgs docker-compose-plugin docker-ce-rootless-extras$pkg_version" 708 | fi 709 | if version_gte "23.0"; then 710 | pkgs="$pkgs docker-buildx-plugin" 711 | fi 712 | if ! is_dry_run; then 713 | set -x 714 | fi 715 | $sh_c "zypper -q install -y $pkgs" 716 | ) 717 | echo_docker_as_nonroot 718 | exit 0 719 | ;; 720 | *) 721 | if [ -z "$lsb_dist" ]; then 722 | if is_darwin; then 723 | echo 724 | echo "ERROR: Unsupported operating system 'macOS'" 725 | echo "Please get Docker Desktop from https://www.docker.com/products/docker-desktop" 726 | echo 727 | exit 1 728 | fi 729 | fi 730 | echo 731 | echo "ERROR: Unsupported distribution '$lsb_dist'" 732 | echo 733 | exit 1 734 | ;; 735 | esac 736 | exit 1 737 | } 738 | 739 | # wrapped up in a function so that we have some protection against only getting 740 | # half the file during "curl | sh" 741 | do_install 742 | -------------------------------------------------------------------------------- /ghcr/config.yml: -------------------------------------------------------------------------------- 1 | version: 0.1 2 | log: 3 | fields: 4 | service: registry 5 | storage: 6 | delete: 7 | enabled: true 8 | cache: 9 | blobdescriptor: inmemory 10 | filesystem: 11 | rootdirectory: /var/lib/registry 12 | http: 13 | addr: :80 14 | headers: 15 | X-Content-Type-Options: [nosniff] 16 | health: 17 | storagedriver: 18 | enabled: true 19 | interval: 10s 20 | threshold: 3 21 | proxy: 22 | remoteurl: https://ghcr.io 23 | -------------------------------------------------------------------------------- /k8s/config.yml: -------------------------------------------------------------------------------- 1 | version: 0.1 2 | log: 3 | fields: 4 | service: registry 5 | storage: 6 | cache: 7 | blobdescriptor: inmemory 8 | filesystem: 9 | rootdirectory: /var/lib/registry 10 | http: 11 | addr: :80 12 | headers: 13 | X-Content-Type-Options: [nosniff] 14 | health: 15 | storagedriver: 16 | enabled: true 17 | interval: 10s 18 | threshold: 3 19 | proxy: 20 | remoteurl: https://registry.k8s.io 21 | -------------------------------------------------------------------------------- /nginx.conf: -------------------------------------------------------------------------------- 1 | map $upstream_http_docker_distribution_api_version $docker_distribution_api_version { 2 | '' 'registry/2.0'; 3 | } 4 | 5 | ssl_certificate /etc/nginx/cert/server.crt; 6 | ssl_certificate_key /etc/nginx/cert/server.key; 7 | ssl_protocols TLSv1.2 TLSv1.3; 8 | 9 | proxy_set_header Host $http_host; 10 | proxy_set_header X-Real-IP $remote_addr; 11 | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 12 | proxy_set_header X-Forwarded-Proto $scheme; 13 | proxy_read_timeout 9000; 14 | 15 | server { 16 | listen 443 ssl; 17 | server_name registry-1.docker.io docker.io; 18 | 19 | location / { 20 | proxy_pass http://docker; 21 | } 22 | } 23 | 24 | server { 25 | listen 443 ssl; 26 | server_name gcr.io; 27 | 28 | location / { 29 | proxy_pass http://gcr; 30 | } 31 | } 32 | 33 | server { 34 | listen 443 ssl; 35 | server_name ghcr.io; 36 | 37 | location / { 38 | proxy_pass http://ghcr; 39 | } 40 | } 41 | 42 | 43 | server { 44 | listen 443 ssl; 45 | server_name registry.k8s.io; 46 | 47 | location / { 48 | proxy_pass http://k8s; 49 | } 50 | } 51 | 52 | server { 53 | listen 443 ssl; 54 | server_name quay.io; 55 | 56 | location / { 57 | proxy_pass http://quay; 58 | } 59 | } 60 | 61 | server { 62 | listen 443 ssl; 63 | server_name nvcr.io; 64 | 65 | location / { 66 | proxy_pass http://nvcr; 67 | } 68 | } 69 | -------------------------------------------------------------------------------- /nvcr/config.yml: -------------------------------------------------------------------------------- 1 | version: 0.1 2 | log: 3 | fields: 4 | service: registry 5 | storage: 6 | cache: 7 | blobdescriptor: inmemory 8 | filesystem: 9 | rootdirectory: /var/lib/registry 10 | http: 11 | addr: :80 12 | headers: 13 | X-Content-Type-Options: [nosniff] 14 | health: 15 | storagedriver: 16 | enabled: true 17 | interval: 10s 18 | threshold: 3 19 | proxy: 20 | remoteurl: https://nvcr.io 21 | -------------------------------------------------------------------------------- /quay/config.yml: -------------------------------------------------------------------------------- 1 | version: 0.1 2 | log: 3 | fields: 4 | service: registry 5 | storage: 6 | cache: 7 | blobdescriptor: inmemory 8 | filesystem: 9 | rootdirectory: /var/lib/registry 10 | http: 11 | addr: :80 12 | headers: 13 | X-Content-Type-Options: [nosniff] 14 | health: 15 | storagedriver: 16 | enabled: true 17 | interval: 10s 18 | threshold: 3 19 | proxy: 20 | remoteurl: https://quay.io 21 | --------------------------------------------------------------------------------