差分

このページの2つのバージョン間の差分を表示します。

--- linux:podman:simple-container-registry [2024/03/21 07:42] – [レジストリ構築] ともやん
+++ linux:podman:simple-container-registry [2024/03/21 09:43] (現在) – [レジストリの起動/停止] ともやん
@@ 行 121: / 行 121: @@
 <font color="#FF8700"><b>$</b></font> <font color="#26A269"><u style="text-decoration-style:single">sudo</u></font> <font color="#26A269">openssl</font> req <font color="#A347BA">-newkey</font> rsa:4096 <font color="#A347BA">-nodes</font> <font color="#A347BA">-sha256</font> <font color="#A347BA">-keyout</font> <u style="text-decoration-style:single">/var/lib/registry/certs/domain.key</u> \
 <font color="#A347BA">-x509</font> <font color="#A347BA">-days</font> 365 <font color="#A347BA">-out</font> <u style="text-decoration-style:single">/var/lib/registry/certs/domain.crt</u>  \
-<font color="#A347BA">-subj</font> <font color="#A2734C">&quot;/CN=wicked-beat,wicked-beat.fireball.local&quot;</font> \
+<font color="#A347BA">-subj</font> <font color="#A2734C">&quot;/CN=localhost,wicked-beat,wicked-beat.fireball.local&quot;</font> \
-<font color="#A347BA">-addext</font> <font color="#A2734C">&quot;subjectAltName=DNS:wicked-beat,DNS:wicked-beat.fireball.local&quot;</font>
+<font color="#A347BA">-addext</font> <font color="#A2734C">&quot;subjectAltName=DNS:localhost,DNS:wicked-beat,DNS:wicked-beat.fireball.local&quot;</font>
 </pre></html></WRAP>
 <WRAP color_result><html><pre>..+..........+..+......+.+.........+...........+......+....+.....+.........+.+++++++++++++++++++++++++++++++++++++++++++++*......+.+..+.......+......+..+...+....+..................+..+...+.+.........+..+.........+....+...+..+.+....................+.+......+..+.......+...........+...+.+.....+......+++++++++++++++++++++++++++++++++++++++++++++*...+............+...+++++
@@ 行 141: / 行 141: @@
 :86:56:c8:1a:fa:0c:32:13:7b:87:54:10:de:66:12:98:f5:b6:28
         Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN = &quot;wicked-beat,wicked-beat.fireball.local&quot;
+        Issuer: CN = &quot;localhost,wicked-beat,wicked-beat.fireball.local&quot;
         Validity
             Not Before: Mar 20 20:16:18 2024 GMT
             Not After : Mar 20 20:16:18 2025 GMT
-        Subject: CN = &quot;wicked-beat,wicked-beat.fireball.local&quot;
+        Subject: CN = &quot;localhost,wicked-beat,wicked-beat.fireball.local&quot;
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
@@ 行 152: / 行 152: @@
 :99:f1:8c:dd:3b:6e:53:8a:1d:79:47:03:d8:48:
 :de:03:79:af:7c:0e:ff:e8:61:b2:48:45:a9:a5:
-                    ee:bf:62:f5:c9:b3:9f:58:fd:8c:65:fa:bc:94:8c:
 〜省略〜
-                    c1:a8:b5:88:11:d1:bc:75:27:98:4b:e5:e5:13:2c:
-:e2:18:94:81:a8:1c:06:6f:ba:fb:be:4a:a1:a4:
 :f8:cb:9c:f2:98:43:85:ab:86:80:27:cc:10:b8:
                     ac:5b:41
@@ 行 167: / 行 164: @@
                 CA:TRUE
             <b class=DiYE>X509v3 Subject Alternative Name:
-                DNS:wicked-beat, DNS:wicked-beat.fireball.local</b>
+                DNS:localhost, DNS:wicked-beat, DNS:wicked-beat.fireball.local</b>
     Signature Algorithm: sha256WithRSAEncryption
     Signature Value:
 :9e:7f:a9:17:6e:86:83:16:fb:2b:45:7b:20:bb:5b:7e:7e:
         c9:77:45:ce:f6:a2:05:c2:c5:cb:9f:22:2b:aa:90:2e:0d:e7:
-a:6d:e9:09:24:3c:c8:1e:bd:43:14:c5:8c:45:0e:6d:66:93:
 〜省略〜
-        fe:45:49:e0:d3:e7:91:7c:c0:be:36:5f:c4:82:b2:90:5b:5b:
         ae:c7:0b:d1:19:72:15:2d:67:db:fe:b7:d0:46:c0:87:dc:c1:
         aa:e9:3b:ce:e8:5c:11:e0
@@ 行 188: / 行 183: @@
 </pre></html></WRAP>
 <WRAP color_result><html><pre>
-    label: <font color="#C01C28"><b>wicked-beat</b></font>,<font color="#C01C28"><b>wicked-beat</b></font>.fireball.local
+    label: localhost,<font color="#C01C28"><b>wicked-beat</b></font>,<font color="#C01C28"><b>wicked-beat</b></font>.fireball.local
 </pre></html></WRAP>
 </WRAP>
@@ 行 214: / 行 209: @@
 </WRAP>
-===== レジストリの起動 =====
+===== レジストリの起動/停止 =====
+レジストリの起動🤔\\
 <WRAP color_term>
 <WRAP color_command><html><pre>
 <font color="#FF8700"><b>$</b></font> <font color="#26A269"><u style="text-decoration-style:single">sudo</u></font> <font color="#26A269">podman</font> run <font color="#A347BA">-d</font> <font color="#A347BA">--restart</font> always <font color="#A347BA">--name</font> registry \
 <font color="#A347BA">-p</font> 5000:5000 \
 <font color="#A347BA">-v</font> /var/lib/registry/data:/var/lib/registry:z \
 <font color="#A347BA">-v</font> /var/lib/registry/auth:/auth:z \
-<font color="#A347BA">-e</font> <font color="#A2734C">&quot;REGISTRY_AUTH=htpasswd&quot;</font> \
+<font color="#A347BA">-e</font> <font color="#A2734C">&apos;REGISTRY_AUTH=htpasswd&apos;</font> \
-<font color="#A347BA">-e</font> <font color="#A2734C">&quot;REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm&quot;</font> \
+<font color="#A347BA">-e</font> <font color="#A2734C">&apos;REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm&apos;</font> \
 <font color="#A347BA">-e</font> REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
 <font color="#A347BA">-v</font> /var/lib/registry/certs:/certs:z \
-<font color="#A347BA">-e</font> <font color="#A2734C">&quot;REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt&quot;</font> \
+<font color="#A347BA">-e</font> <font color="#A2734C">&apos;REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt&apos;</font> \
-<font color="#A347BA">-e</font> <font color="#A2734C">&quot;REGISTRY_HTTP_TLS_KEY=/certs/domain.key&quot;</font> \
+<font color="#A347BA">-e</font> <font color="#A2734C">&apos;REGISTRY_HTTP_TLS_KEY=/certs/domain.key&apos;</font> \
 <font color="#A347BA">-e</font> REGISTRY_COMPATIBILITY_SCHEMA1_ENABLED=true \
+<font color="#A347BA">-e</font> REGISTRY_STORAGE_DELETE_ENABLED=true \
 docker.io/library/registry:2.8.3
 </pre></html></WRAP>
@@ 行 244: / 行 241: @@
 </WRAP>
 [[https://hub.docker.com/_/registry/tags|registry Tags | Docker Hub]] で最新バージョンを確認できる🤔\\
+レジストリを停止する場合...🤔\\
+<WRAP color_term>
+<WRAP color_command><html><pre>
+<font color="#FF8700"><b>$</b></font> <font color="#26A269"><u style="text-decoration-style:single">sudo</u></font> <font color="#26A269">sh</font> <font color="#A347BA">-c</font> <font color="#A2734C">&apos;podman stop registry &amp;&amp; podman rm registry&apos;</font>
+</pre></html></WRAP>
+</WRAP>
 レジストリへのアクセス確認🤔\\
@@ 行 253: / 行 257: @@
 Enter host password for user &apos;tomoyan&apos;:
 {&quot;repositories&quot;:[]}
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+registry
+registry
 </pre></html></WRAP>
 </WRAP>
@@ 行 263: / 行 271: @@
 <WRAP color_result_long><html><pre>
 CONNECTED(00000003)
-depth=0 CN = &quot;wicked-beat,wicked-beat.fireball.local&quot;
+depth=0 CN = &quot;localhost,wicked-beat,wicked-beat.fireball.local&quot;
 verify return:1
 ---
 Certificate chain
-s:CN = &quot;wicked-beat,wicked-beat.fireball.local&quot;
+s:CN = &quot;localhost,wicked-beat,wicked-beat.fireball.local&quot;
-   i:CN = &quot;wicked-beat,wicked-beat.fireball.local&quot;
+   i:CN = &quot;localhost,wicked-beat,wicked-beat.fireball.local&quot;
    a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
    v:NotBefore: Mar 20 20:20:12 2024 GMT; NotAfter: Mar 20 20:20:12 2025 GMT
@@ 行 277: / 行 285: @@
 BQAwMTEvMC0GA1UEAwwmd2lja2VkLWJlYXQsd2lja2VkLWJlYXQuZmlyZWJhbGwu
 bG9jYWwwHhcNMjQwMzIwMjAyMDEyWhcNMjUwMzIwMjAyMDEyWjAxMS8wLQYDVQQD
-DCZ3aWNrZWQtYmVhdCx3aWNrZWQtYmVhdC5maXJlYmFsbC5sb2NhbDCCAiIwDQYJ
+〜省略〜
-KoZIhvcNAQEBBQADggIPADCCAgoCggIBAKU5eypWIT954zZW3oNHOjX1xtSv6yak
-V7XVMHtQb9JlkbXLpR/QBHn/qrAPoq2itsRJFvyjlYt+pIHMq9eWxt426Jnyqsg7
-XadYXmD6PfSgypNMmmEstt8bbsO8Qbq1dr7xmMS8pxSKnp2sFqLf+dhU6HdEHmJW
-f2GhRqB8WU+d+qhxL4AJvd76Z/8G+fKHdlWOklH7YqXIU9oH869OOsVot2UROrkn
-vDth1TU1/Fv0Qs436xZ7OSpbC9Z9udP1r/ANFxXei3c3QzaoJkAIDTP4fVa+AbY
-sPY6fVvhPFAxMQDf+Es9TVqrUqtYMYTYWjEjVPOvEU4MnQJVuz6TV9ZZeEi6c46C
-yXgSnZEebq1SJiSG5/10CKg0ngVIGmlrNRzxZKYwAkbuAuAcsJ4YbOQSoOPam4qg
-vmYmP/jiqgSfLWSTrSNmXp5qkPMvP3NtayMS2fZ0UUEVnVWmiY8jz3wS52zs8kUU
-dOZ55Q+quKuR8DaS0OxlZeaPUfYFJs60VLkwN2oB0R70en1GE6eXu+3YunVN7AMJ
-yIAl4xcZ3mLmdHvifvr8XZGiJk0oiic+nDOCHPm7mw0EXh54scRLHjOQyhnMXLOc
-Bv7oxz82RFGjzfvuC9b3csyXfkP5BE88lNjkk3ScwCMZ3vleC8iFoVRqkEKjApkR
-POevKCWSLxUFAgMBAAGjgYgwgYUwHQYDVR0OBBYEFD+/vezvjPaSqRot9zLNaqXl
-NHwmMB8GA1UdIwQYMBaAFD+/vezvjPaSqRot9zLNaqXlNHwmMA8GA1UdEwEB/wQF
-MAMBAf8wMgYDVR0RBCswKYILd2lja2VkLWJlYXSCGndpY2tlZC1iZWF0LmZpcmVi
-YWxsLmxvY2FsMA0GCSqGSIb3DQEBCwUAA4ICAQBFURGP68S5V9UwEKLraWr0WR+i
-sGBvuEymDdGbS1ThyQTB7p7VCV5vC6TvtcR+IQYL2a/m1RaxjaqOjsbDJYtUREa
-QGljZkJpB0kj/VeZUnPyW7T7e3Lkb/Pv/EWYhBNoSH9oKA6iJh7g7ch2ghqg9kvQ
-TmHhrHLaQhLdES0pNpbPpQCL5Z0u9JThdW1chSGGbUIy+UNXrhndOrOwxp/CJzF9
-plkli6ptDBSIsT/LRC8+Z5kU4t/yXXoMEePL97IDBlkkksbnEN4EN9RaE8K0NYHe
-GxRHXvOKY/BBvA+6vS9PSKf6jvr01IQeLvC0E8FyrZmaCdFSg6Vxnq+qvgXLxsZn
-T78wnHhUbFoZv8DriFAWWk3eC2Jh5wzWZ3WaaiGjICqPutZ8+IJ7J0vjnKwkEwU8
-zH/Xo1YaQscxtIrytLtXPCTgcPAH6i9UZixplJpv2iVnhmL1ffvJ/JhZQr+dOTP4
-cxfPCURtPtZtA6Vdd1DyScHJ4C3wZ9Eeo1OM6aEq7G7kaPGCCXRn/MIFAl0Q2dpE
-BbSmv2VxfnnrBAhQN3bro/j+iDZb+hWSNc1OI/LuEo0UTAXZuXVTsfmiaCoW6QBc
 I72x52OQk9dfvXp2yiXhTSjZVcqY2axwvdEm8dA7kBE+vImTbxUJYzGWetMo3n4a
 oZEMw11w4NNmuw1fvw==
 -----END CERTIFICATE-----
-subject=CN = &quot;wicked-beat,wicked-beat.fireball.local&quot;
+subject=CN = &quot;localhost,wicked-beat,wicked-beat.fireball.local&quot;
-issuer=CN = &quot;wicked-beat,wicked-beat.fireball.local&quot;
+issuer=CN = &quot;localhost,wicked-beat,wicked-beat.fireball.local&quot;
 ---
 No client certificate CA names sent
@@ 行 416: / 行 400: @@
 </WRAP>
+プッシュする🤔\\
+<WRAP color_term>
+<WRAP color_command><html><pre>
+<font color="#FF8700"><b>$</b></font> <font color="#26A269">podman</font> push localhost/haruo_podman:0.01 wicked-beat:5000/haruo_podman:v0.01
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+Getting image source signatures
+Copying blob 10650e391d43 done   |
+Copying blob aacbd0b4169c done   |
+Copying blob 80f811a7d4fe done   |
+Copying blob 53f86715cdba done   |
+Copying blob eb2eb8ccdc68 done   |
+Copying config f291a9bf30 done   |
+Writing manifest to image destination
+</pre></html></WRAP>
+</WRAP>
+プッシュされた内容を確認する🤔\\
+<WRAP color_term>
+<WRAP color_command><html><pre>
+<font color="#FF8700"><b>$</b></font> <font color="#26A269">podman</font> search wicked-beat:5000/
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+NAME                           DESCRIPTION
+wicked-beat:5000/haruo_podman
+</pre></html></WRAP>
+</WRAP>
+削除してみる🤔\\
+<WRAP color_term>
+<WRAP color_command><html><pre>
+<font color="#FF8700"><b>$</b></font> <font color="#26A269">skopeo</font> <font color="#A347BA">--debug</font> delete docker://wicked-beat:5000/haruo_podman:v0.01
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+<font color="#D0CFCC">DEBU</font>[0000] Using registries.d directory /etc/containers/registries.d
+<font color="#D0CFCC">DEBU</font>[0000] Loading registries configuration &quot;/etc/containers/registries.conf&quot;
+<font color="#D0CFCC">DEBU</font>[0000] Loading registries configuration &quot;/etc/containers/registries.conf.d/000-shortnames.conf&quot;
+<font color="#D0CFCC">DEBU</font>[0000] Found credentials for wicked-beat:5000/haruo_podman in credential helper containers-auth.json in file /run/user/1000/containers/auth.json
+<font color="#D0CFCC">DEBU</font>[0000]  No signature storage configuration found for wicked-beat:5000/haruo_podman:v0.01, using built-in default file:///home/tomoyan/.local/share/containers/sigstore
+<font color="#D0CFCC">DEBU</font>[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/wicked-beat:5000
+<font color="#D0CFCC">DEBU</font>[0000] GET https://wicked-beat:5000/v2/
+<font color="#D0CFCC">DEBU</font>[0000] Ping https://wicked-beat:5000/v2/ status 401
+<font color="#D0CFCC">DEBU</font>[0000] GET https://wicked-beat:5000/v2/haruo_podman/manifests/v0.01
+<font color="#D0CFCC">DEBU</font>[0000] DELETE https://wicked-beat:5000/v2/haruo_podman/manifests/sha256:f652ef85a8862285775a01c6dd279c35debd0b581c41e209875c3ab1d3ceacd7
+<font color="#D0CFCC">DEBU</font>[0000] Deleting /home/tomoyan/.local/share/containers/sigstore/haruo_podman@sha256=f652ef85a8862285775a01c6dd279c35debd0b581c41e209875c3ab1d3ceacd7/signature-1
+</pre></html></WRAP>
+</WRAP>
+削除しても消えないが、配布には使える🤪\\
+<WRAP color_term>
+<WRAP color_command><html><pre>
+<font color="#FF8700"><b>$</b></font> <font color="#26A269">podman</font> search wicked-beat:5000/
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+NAME                           DESCRIPTION
+wicked-beat:5000/haruo_podman
+</pre></html></WRAP>
+</WRAP>
+プッシュしたら二度と消せない🤪\\
+コンテナ起動時に REGISTRY_STORAGE_DELETE_ENABLED=true も指定してるし、docker v2 API で DELETE も実行している🤔\\
+<WRAP color_term>
+<WRAP color_command><html><pre>
+<font color="#FF8700"><b>$</b></font> <font color="#26A269">skopeo</font> <font color="#A347BA">--debug</font> delete docker://wicked-beat:5000/haruo_podman:v0.01
+</pre></html></WRAP>
+<WRAP color_result><html><pre>
+<font color="#D0CFCC">DEBU</font>[0000] Using registries.d directory /etc/containers/registries.d
+<font color="#D0CFCC">DEBU</font>[0000] Loading registries configuration &quot;/etc/containers/registries.conf&quot;
+<font color="#D0CFCC">DEBU</font>[0000] Loading registries configuration &quot;/etc/containers/registries.conf.d/000-shortnames.conf&quot;
+<font color="#D0CFCC">DEBU</font>[0000] Found credentials for wicked-beat:5000/haruo_podman in credential helper containers-auth.json in file /run/user/1000/containers/auth.json
+<font color="#D0CFCC">DEBU</font>[0000]  No signature storage configuration found for wicked-beat:5000/haruo_podman:v0.01, using built-in default file:///home/tomoyan/.local/share/containers/sigstore
+<font color="#D0CFCC">DEBU</font>[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/wicked-beat:5000
+<font color="#D0CFCC">DEBU</font>[0000] GET https://wicked-beat:5000/v2/
+<font color="#D0CFCC">DEBU</font>[0000] Ping https://wicked-beat:5000/v2/ status 401
+<font color="#D0CFCC">DEBU</font>[0000] GET https://wicked-beat:5000/v2/haruo_podman/manifests/v0.01
+<font color="#C01C28">FATA</font>[0000] Unable to delete wicked-beat:5000/haruo_podman:v0.01. Image may not exist or is not stored with a v2 Schema in a v2 registry
+</pre></html></WRAP>
+</WRAP>
 ===== 参考文献 =====
 [[https://www.redhat.com/sysadmin/simple-container-registry|How to implement a simple personal/private Linux container image registry for internal use | Enable Sysadmin]] [[gtr>https://www.redhat.com/sysadmin/simple-container-registry|翻訳]]\\
 [[https://thenewstack.io/tutorial-host-a-local-podman-image-registry/|Tutorial: Host a Local Podman Image Registry - The New Stack]] [[gtr>https://thenewstack.io/tutorial-host-a-local-podman-image-registry/|翻訳]]\\
+[[git>quay/quay|quay/quay: Build, Store, and Distribute your Applications and Containers]]\\
+[[https://github.com/quay/quay/blob/master/docs/quick-local-deployment.md|quay/docs/quick-local-deployment.md at master · quay/quay]]\\
+[[https://access.redhat.com/docum.entation/ja-jp/red_hat_quay/2.9/html-single/deploy_red_hat_quay_-_basic/index|Deploy Red Hat Quay - Basic Red Hat Quay 2.9 | Red Hat Customer Portal]] [[gtr>https://access.redhat.com/documentation/ja-jp/red_hat_quay/2.9/html-single/deploy_red_hat_quay_-_basic/index|翻訳]]\\