1. Harbor私有镜像仓库部署指南在企业级容器化部署中镜像仓库如同物流中心的中转仓库Harbor则是这个领域最受欢迎的自主托管解决方案。作为CNCF毕业项目它提供了企业级Registry服务、漏洞扫描、镜像签名等完整功能链。不同于直接使用Docker Hub等公有仓库自建Harbor环境能实现镜像资产完全自主可控、内网高速传输、细粒度权限管理和合规审计——这对金融、政务等敏感行业尤为关键。我在三次不同规模的生产环境部署中总结出这套兼顾效率和安全的部署方案。你将通过本指南完成基于Linux系统的Harbor v2.7.0离线安装、HTTPS证书配置、LDAP集成以及日常运维关键命令。所有步骤均在CentOS 7.9 Docker 20.10.17环境下验证通过适配x86/ARM架构。2. 基础环境准备2.1 硬件资源规划生产环境资源配置需考虑镜像存储量和并发请求数。以下为经验值参考规模CPU内存存储适用场景开发测试2核4GB100GB10人以下团队中小生产4核8GB500GB50节点K8s集群大型生产8核16GB1TB跨地域多集群分发特别注意存储应挂载独立分区或外置存储避免容器日志占满根分区2.2 软件依赖安装# 卸载旧版Docker如有 sudo yum remove docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-engine # 安装必要工具 sudo yum install -y yum-utils device-mapper-persistent-data lvm2 # 设置Docker仓库 sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo # 安装指定版本Docker sudo yum install -y docker-ce-20.10.17 docker-ce-cli-20.10.17 containerd.io # 配置镜像加速国内环境必需 sudo mkdir -p /etc/docker sudo tee /etc/docker/daemon.json -EOF { registry-mirrors: [https://registry.cn-hangzhou.aliyuncs.com], exec-opts: [native.cgroupdriversystemd] } EOF # 启动服务 sudo systemctl enable docker sudo systemctl start docker2.3 防火墙与SELinux配置# 放行必要端口 sudo firewall-cmd --permanent --add-port80/tcp sudo firewall-cmd --permanent --add-port443/tcp sudo firewall-cmd --permanent --add-port4443/tcp sudo firewall-cmd --reload # 如使用SELinux需设置标签 sudo setsebool -P httpd_can_network_connect 13. Harbor安装与初始化3.1 离线安装包获取从Github Release页面下载对应架构的离线包wget https://github.com/goharbor/harbor/releases/download/v2.7.0/harbor-offline-installer-v2.7.0.tgz tar xvf harbor-offline-installer-v2.7.0.tgz cd harbor3.2 配置文件调整修改harbor.yml关键参数hostname: registry.yourcompany.com # 必须匹配证书域名 http: port: 80 https: port: 443 certificate: /data/cert/registry.yourcompany.com.crt private_key: /data/cert/registry.yourcompany.com.key harbor_admin_password: YourStrongPassword123 # 修改默认admin密码 database: password: root123 # 数据库密码 data_volume: /data # 数据存储路径3.3 证书生成自签名示例mkdir -p /data/cert cd /data/cert openssl req -newkey rsa:4096 -nodes -sha256 -keyout registry.yourcompany.com.key \ -x509 -days 3650 -out registry.yourcompany.com.crt \ -subj /CCN/STBeijing/LBeijing/OYourCompany/CNregistry.yourcompany.com3.4 执行安装脚本sudo ./install.sh --with-trivy --with-chartmuseum参数说明--with-trivy集成漏洞扫描功能--with-chartmuseum启用Helm Chart仓库4. 进阶配置实战4.1 LDAP集成配置修改harbor.yml添加ldap: url: ldap://ldap.yourcompany.com base_dn: dcyourcompany,dccom uid: sAMAccountName filter: (objectClassperson) scope: 2 bind_dn: cnadmin,dcyourcompany,dccom bind_password: LdapPassword123 timeout: 5应用配置sudo docker-compose down -v sudo ./prepare --with-trivy --with-chartmuseum sudo docker-compose up -d4.2 存储后端配置NFS示例在NFS服务器共享目录sudo mkdir /nfs/harbor sudo chown -R 10000:10000 /nfs/harbor echo /nfs/harbor *(rw,sync,no_root_squash) /etc/exports sudo systemctl restart nfs-server客户端挂载sudo mount -t nfs nfs-server:/nfs/harbor /data echo nfs-server:/nfs/harbor /data nfs defaults 0 0 /etc/fstab5. 日常运维操作5.1 用户权限管理创建项目并设置成员权限# 通过API创建项目 curl -u admin:YourStrongPassword123 -X POST \ https://registry.yourcompany.com/api/v2.0/projects \ -H Content-Type: application/json \ -d {project_name: devops, public: false} # 添加LDAP用户为开发者 curl -u admin:YourStrongPassword123 -X POST \ https://registry.yourcompany.com/api/v2.0/projects/devops/members \ -H Content-Type: application/json \ -d {role_id: 2, member_user: {username: zhangsan}}5.2 镜像清理策略启用垃圾回收# 查看回收空间预估 curl -u admin:YourStrongPassword123 -X PUT \ https://registry.yourcompany.com/api/v2.0/system/gc/schedule \ -H Content-Type: application/json \ -d {schedule: {type: Daily, cron: 0 0 * * *}}设置保留策略保留最近5个tag# 在harbor.yml添加 retention: dry_run: false rules: - repositories: - ** tag_selectors: - pattern: .* extras: {untagged:false} keep_most_recent: 56. 故障排查指南6.1 常见错误解决方案错误现象可能原因解决方案推送镜像时报403 Forbidden用户无项目push权限在项目成员中添加用户并赋予开发者/维护者角色拉取镜像时报证书错误客户端未信任自签名证书将ca.crt复制到/etc/docker/certs.d/registry.yourcompany.com/ca.crtWeb界面加载缓慢Redis性能问题检查Redis容器资源使用情况考虑升级配置或启用持久化漏洞扫描失败Trivy数据库未更新执行docker exec -it harbor-trivy-db bash -c trivy --cache-dir /home/scanner/.cache/trivy db update6.2 日志查看技巧关键服务日志路径# 核心组件日志 docker-compose logs -f portal core jobservice registry # 数据库日志 docker exec -it harbor-db tail -f /var/log/postgresql/postgresql-13-main.log # 特定时间段的错误日志 docker-compose logs --tail100 -t | grep -i error | awk $1 2023-07-01T00:00:00 $1 2023-07-02T00:00:007. 性能优化建议7.1 数据库调优修改PostgreSQL配置docker-compose.ymlharbor-db: environment: POSTGRESQL_SHARED_BUFFERS: 2GB # 建议分配内存的25% POSTGRESQL_EFFECTIVE_CACHE_SIZE: 4GB # 建议分配内存的50% POSTGRESQL_MAINTENANCE_WORK_MEM: 512MB POSTGRESQL_RANDOM_PAGE_COST: 1.1 # SSD存储建议值7.2 Redis缓存优化redis: image: goharbor/redis-photon:v2.7.0 command: [redis-server, --save 900 1, --maxmemory 2gb, --maxmemory-policy allkeys-lru] volumes: - /data/redis:/data7.3 前端负载均衡配置Nginx示例配置upstream harbor { server 10.0.0.1:80; server 10.0.0.2:80; keepalive 32; } server { listen 443 ssl; server_name registry.yourcompany.com; ssl_certificate /etc/nginx/ssl/registry.yourcompany.com.crt; ssl_certificate_key /etc/nginx/ssl/registry.yourcompany.com.key; location / { proxy_pass http://harbor; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_http_version 1.1; proxy_set_header Connection ; } }8. 升级与迁移方案8.1 版本升级步骤停止现有服务cd /opt/harbor docker-compose down备份数据库和配置文件docker exec -i harbor-db pg_dump -U postgres registry registry_backup.sql cp -r /data /data_backup cp harbor.yml harbor.yml.bak执行升级mv /opt/harbor /opt/harbor_old tar xvf harbor-offline-installer-v2.7.0.tgz -C /opt cd /opt/harbor cp ../harbor_old/harbor.yml . ./prepare --with-trivy --with-chartmuseum docker-compose up -d8.2 跨服务器迁移源服务器导出数据# 导出数据库 docker exec -i harbor-db pg_dump -U postgres registry | gzip registry.sql.gz # 打包存储卷 tar czvf harbor_data.tar.gz /data/registry /data/chart_storage /data/trivy-adapter目标服务器恢复# 恢复数据库 gunzip -c registry.sql.gz | docker exec -i harbor-db psql -U postgres registry # 解压数据文件 tar xzvf harbor_data.tar.gz -C / 
长河君 · 2026/8/17 23:02:12 · 阅读 1.2k Harbor私有镜像仓库部署与运维实战指南
1. Harbor私有镜像仓库部署指南在企业级容器化部署中镜像仓库如同物流中心的中转仓库Harbor则是这个领域最受欢迎的自主托管解决方案。作为CNCF毕业项目它提供了企业级Registry服务、漏洞扫描、镜像签名等完整功能链。不同于直接使用Docker Hub等公有仓库自建Harbor环境能实现镜像资产完全自主可控、内网高速传输、细粒度权限管理和合规审计——这对金融、政务等敏感行业尤为关键。我在三次不同规模的生产环境部署中总结出这套兼顾效率和安全的部署方案。你将通过本指南完成基于Linux系统的Harbor v2.7.0离线安装、HTTPS证书配置、LDAP集成以及日常运维关键命令。所有步骤均在CentOS 7.9 Docker 20.10.17环境下验证通过适配x86/ARM架构。2. 基础环境准备2.1 硬件资源规划生产环境资源配置需考虑镜像存储量和并发请求数。以下为经验值参考规模CPU内存存储适用场景开发测试2核4GB100GB10人以下团队中小生产4核8GB500GB50节点K8s集群大型生产8核16GB1TB跨地域多集群分发特别注意存储应挂载独立分区或外置存储避免容器日志占满根分区2.2 软件依赖安装# 卸载旧版Docker如有 sudo yum remove docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-engine # 安装必要工具 sudo yum install -y yum-utils device-mapper-persistent-data lvm2 # 设置Docker仓库 sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo # 安装指定版本Docker sudo yum install -y docker-ce-20.10.17 docker-ce-cli-20.10.17 containerd.io # 配置镜像加速国内环境必需 sudo mkdir -p /etc/docker sudo tee /etc/docker/daemon.json -EOF { registry-mirrors: [https://registry.cn-hangzhou.aliyuncs.com], exec-opts: [native.cgroupdriversystemd] } EOF # 启动服务 sudo systemctl enable docker sudo systemctl start docker2.3 防火墙与SELinux配置# 放行必要端口 sudo firewall-cmd --permanent --add-port80/tcp sudo firewall-cmd --permanent --add-port443/tcp sudo firewall-cmd --permanent --add-port4443/tcp sudo firewall-cmd --reload # 如使用SELinux需设置标签 sudo setsebool -P httpd_can_network_connect 13. Harbor安装与初始化3.1 离线安装包获取从Github Release页面下载对应架构的离线包wget https://github.com/goharbor/harbor/releases/download/v2.7.0/harbor-offline-installer-v2.7.0.tgz tar xvf harbor-offline-installer-v2.7.0.tgz cd harbor3.2 配置文件调整修改harbor.yml关键参数hostname: registry.yourcompany.com # 必须匹配证书域名 http: port: 80 https: port: 443 certificate: /data/cert/registry.yourcompany.com.crt private_key: /data/cert/registry.yourcompany.com.key harbor_admin_password: YourStrongPassword123 # 修改默认admin密码 database: password: root123 # 数据库密码 data_volume: /data # 数据存储路径3.3 证书生成自签名示例mkdir -p /data/cert cd /data/cert openssl req -newkey rsa:4096 -nodes -sha256 -keyout registry.yourcompany.com.key \ -x509 -days 3650 -out registry.yourcompany.com.crt \ -subj /CCN/STBeijing/LBeijing/OYourCompany/CNregistry.yourcompany.com3.4 执行安装脚本sudo ./install.sh --with-trivy --with-chartmuseum参数说明--with-trivy集成漏洞扫描功能--with-chartmuseum启用Helm Chart仓库4. 进阶配置实战4.1 LDAP集成配置修改harbor.yml添加ldap: url: ldap://ldap.yourcompany.com base_dn: dcyourcompany,dccom uid: sAMAccountName filter: (objectClassperson) scope: 2 bind_dn: cnadmin,dcyourcompany,dccom bind_password: LdapPassword123 timeout: 5应用配置sudo docker-compose down -v sudo ./prepare --with-trivy --with-chartmuseum sudo docker-compose up -d4.2 存储后端配置NFS示例在NFS服务器共享目录sudo mkdir /nfs/harbor sudo chown -R 10000:10000 /nfs/harbor echo /nfs/harbor *(rw,sync,no_root_squash) /etc/exports sudo systemctl restart nfs-server客户端挂载sudo mount -t nfs nfs-server:/nfs/harbor /data echo nfs-server:/nfs/harbor /data nfs defaults 0 0 /etc/fstab5. 日常运维操作5.1 用户权限管理创建项目并设置成员权限# 通过API创建项目 curl -u admin:YourStrongPassword123 -X POST \ https://registry.yourcompany.com/api/v2.0/projects \ -H Content-Type: application/json \ -d {project_name: devops, public: false} # 添加LDAP用户为开发者 curl -u admin:YourStrongPassword123 -X POST \ https://registry.yourcompany.com/api/v2.0/projects/devops/members \ -H Content-Type: application/json \ -d {role_id: 2, member_user: {username: zhangsan}}5.2 镜像清理策略启用垃圾回收# 查看回收空间预估 curl -u admin:YourStrongPassword123 -X PUT \ https://registry.yourcompany.com/api/v2.0/system/gc/schedule \ -H Content-Type: application/json \ -d {schedule: {type: Daily, cron: 0 0 * * *}}设置保留策略保留最近5个tag# 在harbor.yml添加 retention: dry_run: false rules: - repositories: - ** tag_selectors: - pattern: .* extras: {untagged:false} keep_most_recent: 56. 故障排查指南6.1 常见错误解决方案错误现象可能原因解决方案推送镜像时报403 Forbidden用户无项目push权限在项目成员中添加用户并赋予开发者/维护者角色拉取镜像时报证书错误客户端未信任自签名证书将ca.crt复制到/etc/docker/certs.d/registry.yourcompany.com/ca.crtWeb界面加载缓慢Redis性能问题检查Redis容器资源使用情况考虑升级配置或启用持久化漏洞扫描失败Trivy数据库未更新执行docker exec -it harbor-trivy-db bash -c trivy --cache-dir /home/scanner/.cache/trivy db update6.2 日志查看技巧关键服务日志路径# 核心组件日志 docker-compose logs -f portal core jobservice registry # 数据库日志 docker exec -it harbor-db tail -f /var/log/postgresql/postgresql-13-main.log # 特定时间段的错误日志 docker-compose logs --tail100 -t | grep -i error | awk $1 2023-07-01T00:00:00 $1 2023-07-02T00:00:007. 性能优化建议7.1 数据库调优修改PostgreSQL配置docker-compose.ymlharbor-db: environment: POSTGRESQL_SHARED_BUFFERS: 2GB # 建议分配内存的25% POSTGRESQL_EFFECTIVE_CACHE_SIZE: 4GB # 建议分配内存的50% POSTGRESQL_MAINTENANCE_WORK_MEM: 512MB POSTGRESQL_RANDOM_PAGE_COST: 1.1 # SSD存储建议值7.2 Redis缓存优化redis: image: goharbor/redis-photon:v2.7.0 command: [redis-server, --save 900 1, --maxmemory 2gb, --maxmemory-policy allkeys-lru] volumes: - /data/redis:/data7.3 前端负载均衡配置Nginx示例配置upstream harbor { server 10.0.0.1:80; server 10.0.0.2:80; keepalive 32; } server { listen 443 ssl; server_name registry.yourcompany.com; ssl_certificate /etc/nginx/ssl/registry.yourcompany.com.crt; ssl_certificate_key /etc/nginx/ssl/registry.yourcompany.com.key; location / { proxy_pass http://harbor; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_http_version 1.1; proxy_set_header Connection ; } }8. 升级与迁移方案8.1 版本升级步骤停止现有服务cd /opt/harbor docker-compose down备份数据库和配置文件docker exec -i harbor-db pg_dump -U postgres registry registry_backup.sql cp -r /data /data_backup cp harbor.yml harbor.yml.bak执行升级mv /opt/harbor /opt/harbor_old tar xvf harbor-offline-installer-v2.7.0.tgz -C /opt cd /opt/harbor cp ../harbor_old/harbor.yml . ./prepare --with-trivy --with-chartmuseum docker-compose up -d8.2 跨服务器迁移源服务器导出数据# 导出数据库 docker exec -i harbor-db pg_dump -U postgres registry | gzip registry.sql.gz # 打包存储卷 tar czvf harbor_data.tar.gz /data/registry /data/chart_storage /data/trivy-adapter目标服务器恢复# 恢复数据库 gunzip -c registry.sql.gz | docker exec -i harbor-db psql -U postgres registry # 解压数据文件 tar xzvf harbor_data.tar.gz -C /