Nginx反向代理Docker私有仓库

 

有问题去官网看文档！有问题去官网看文档！有问题去官网看文档！ 重要的事情说三遍！！

 

为啥啊这么说呢？是因为别人经验真的不适合你，，亲身体验啊！

起因是本人在阿里云服务器上使用docker镜像部署本仓库，想着使用nginx反向代理到二级目录下(因为ssl证书只在主域名下，当时申请ssl证书时候傻了没注意)，

在nginx代理私有仓库的时候总是404，就百度了很多帖子博客都是大同小异，有的也很接近正确答案，但就是不成功！！也有可能是本人不精通nginx吧。总之磨磨唧唧一天没弄成！！

于是就去了docker官网找了找文档，，没想到啊没想到，仅仅半小时就解决了！！

 

官网：https://docs.docker.com/registry/recipes/nginx/  使用Nginx作为身份验证代理

本人nginx.conf配置文件,供参考：

upstream my_docker_registry  {
    server 你的服务器IP:5000; # 本地仓库容器映射导docker宿主机上的端口
}

  ## Set a variable to help us decide if we need to add the
  ## 'Docker-Distribution-Api-Version' header.
  ## The registry always sets this header.
  ## In the case of nginx performing auth, the header is unset
  ## since nginx is auth-ing before proxying.
map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
   '' 'registry/2.0';
}

server {
    listen    80;       #侦听80端口，如果强制所有的访问都必须是HTTPs的，这行需要注销掉
    listen    443 ssl;
    server_name  你的域名;   #域名

    # 增加ssl
    # ssl on;        #如果强制HTTPs访问，这行要打开
    ssl_certificate       /etc/nginx/ssl/你的ssl证书.pem;   #这个目录不要照抄
    ssl_certificate_key   /etc/nginx/ssl/你的ssl证书.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    # 指定密码为openssl支持的格式
    ssl_protocols  SSLv2 SSLv3 TLSv1.2;

    ssl_ciphers  HIGH:!aNULL:!MD5;   # 密码加密方式
    ssl_prefer_server_ciphers  on;   # 依赖SSLv3和TLSv1协议的服务器密码将优先于客户端密码

    # 定义首页索引目录和名称
    location / {
      root   /usr/share/nginx/html;    #你的网站根目录
      index  index.html index.htm;
    }

    client_max_body_size 0; # disable any limits to avoid HTTP 413 for large image uploads

    # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
    chunked_transfer_encoding on;

    # Docker私有仓库二级目录
    location /registry/ {
        # Do not allow connections from docker 1.5 and earlier
        # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
        if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
            return 404;
        }

        # To add basic authentication to v2 use auth_basic setting.
        auth_basic "Registry realm";
        # auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd;

        ## If $docker_distribution_api_version is empty, the header is not added.
        ## See the map directive above where this variable is defined.
        add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;

        proxy_pass                          http://my_docker_registry;
        proxy_set_header  Host              $http_host;   # required for docker client's sake
        proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
        proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header  X-Forwarded-Proto $scheme;
        proxy_read_timeout                  900;
    }

}