配置 Containerd 在 harbor 私有仓库拉取镜像

unexpected status code [manifests 1.28]: 401 Unauthorized
【问题描述】

下载Harbor中的私有镜像时报错：

[root@lidabai app]# ctr -n harbor.lidabai images pull 192.168.2.22:443/lidabai/busybox:1.28 -k
ctr: failed to resolve reference "192.168.2.22:443/lidabai/busybox:1.28": unexpected status code [manifests 1.28]: 401 Unauthorized

【原因】401未经授权

【解决】通过-u参数指定Harbor用户名和密码。

$ ctr -n harbor.lidabai images pull 192.168.2.22:443/lidabai/busybox:1.28 -u admin:Harbor12345 -k

x509: certificate signed by unknown authority
【报错描述】在拉取镜像时报出错误：

[root@lidabai ~]# ctr images pull 192.168.2.22:443/library/prepare:v2.5.1
error="failed to do request: Head \"https://192.168.2.22:443/v2/library/prepare/manifests/v2.5.1\": x509: certificate signed by unknown authority" host="192.168.2.22:443"
ctr: failed to resolve reference "192.168.2.22:443/library/prepare:v2.5.1": failed to do request: Head "https://192.168.2.22:443/v2/library/prepare/manifests/v2.5.1": x509: certificate signed by unknown authority

【解决办法】：

1）通过-k参数跳过证书校验。

[root@lidabai ~]# ctr -n harbor.lidabai i pull 192.168.2.22:443/library/prepare:v2.5.1 -k
1.

2）指定CA证书、Harbor相关证书文件路径。

$ mkdir /etc/containerd/harbor/ #创建证书存放目录
$ scp /app/harbor-cert/{ca.pem,harbor.pem,harbor-key.pem} 192.168.2.41:/etc/containerd/harbor/
$ ctr -n harbor.lidabai images pull 192.168.2.22:443/library/prepare:v2.5.1 \
--tlscacert /etc/containerd/harbor/ca.pem \ #或ca.crt
--tlscert /etc/containerd/harbor/harbor.pem \ #或harbor.crt
--tlskey /etc/containerd/harbor/harbor-key.pem #或harbor.key

精品文章阅读
​ ​Harbor高可用集群设计及部署（实操+视频），基于离线安装方式​​

​ ​Harbor进阶：使用Harbor存储Helm chart​​

​ ​Python实现Harbor私有镜像仓库的垃圾自动化​​

​ ​Harbor jobservice组件异常问题处理​​

​ ​Harbor高可用设计: 使用外部Redis缓存部分​​

​ ​阿里云镜像迁移到Harbor详细的操作步骤​​

​ ​如何将dockerhub上的镜像迁移到Harbor私有镜像仓库中？​​