Registry va obrazni nashr qilish

Obraz mahalliy kompyuterda qurildi. Uni serverga yetkazish uchun registry kerak - obrazlar saqlanadigan omborxona.

Obraz nomining to'liq shakli #

docker inspect alpine:3.21 -f '{{index .RepoTags 0}}'
docker inspect alpine:3.21 -f '{{index .RepoDigests 0}}'

alpine:3.21
alpine@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d

alpine:3.21 - qisqartirilgan shakl. To'lig'i shunday tuzilgan:

docker.io  /  library  /  alpine  :  3.21
    ^            ^           ^         ^
    |            |           |         +-- teg
    |            |           +------------ omborxona nomi
    |            +------------------------ egasi (namespace)
    +--------------------------------------- registry

Registry yozilmasa, Docker docker.io deb tushunadi. Egasi yozilmasa - library (rasmiy obrazlar).

Shuning uchun xususiy registry ishlatish uchun uni nomga qo'shish kifoya: reyestr.dokon.uz/jamoa/ilova:1.0.

O'z registry ingizni ko'tarish #

Registry ning o'zi ham konteyner:

docker run -d --name reyestr -p 5001:5000 registry:2

curl -s http://127.0.0.1:5001/v2/_catalog

{"repositories":[]}

Bo'sh. Endi unga obraz yuboramiz.

Obrazni tayyorlash #

FROM alpine:3.21
LABEL org.opencontainers.image.title="Dokon ilovasi"
LABEL org.opencontainers.image.version="1.0"
CMD ["echo", "Dokon 1.0"]

Obraz registry manzili bilan teglanishi kerak - docker push manzilni nomdan oladi:

docker images '127.0.0.1:5001/dokon/ilova' --format '{{.Repository}}:{{.Tag}}'

127.0.0.1:5001/dokon/ilova:1.0

Yuborish #

docker push 127.0.0.1:5001/dokon/ilova:1.0

Chiqish shunday ko'rinadi (identifikatorlar sizda boshqacha):

b3ee1c069dce: Pushed
44136fa355b3: Pushed
1.0: digest: sha256:a57b09cc7b66a4afee214fe14b47e6174a9a2547... size: 855

Identifikatorlar va digest har qurishda yangilanadi, shuning uchun ularni yod olishning hojati yo'q. Muhimi - yuborish o'tdimi:

docker push 127.0.0.1:5001/dokon/ilova:1.0 >/dev/null 2>&1 \
    && echo "yuborildi"

yuborildi

Oxirgi qator - manifest digesti: aynan shu obrazni keyinchalik nomi bilan emas, digest bilan chaqirish mumkin.

Qatlamlarning muhim xususiyati ham shu yerda ko'rinadi: bir xil qatlam registry ga bir marta yuklanadi. Yigirmata obraz bir xil asosdan qurilgan bo'lsa, asos qatlami bitta nusxada yotadi - shuning uchun ikkinchi push deyarli bir zumda tugaydi.

curl -s http://127.0.0.1:5001/v2/_catalog
curl -s http://127.0.0.1:5001/v2/dokon/ilova/tags/list

{"repositories":["dokon/ilova"]}
{"name":"dokon/ilova","tags":["1.0"]}

Qaytadan tortish #

Mahalliy nusxani o'chirib, registry dan olamiz:

docker rmi -f 127.0.0.1:5001/dokon/ilova:1.0 >/dev/null 2>&1
docker pull -q 127.0.0.1:5001/dokon/ilova:1.0
docker run --rm 127.0.0.1:5001/dokon/ilova:1.0

127.0.0.1:5001/dokon/ilova:1.0
Dokon 1.0

Bu - yetkazib berishning butun mohiyati: obraz bir joyda qurildi, boshqa joyda aynan o'sha holicha ishga tushdi.

Teg strategiyasi #

Bitta obrazga bir nechta teg beriladi:

docker tag 127.0.0.1:5001/dokon/ilova:1.0 127.0.0.1:5001/dokon/ilova:1
docker tag 127.0.0.1:5001/dokon/ilova:1.0 127.0.0.1:5001/dokon/ilova:latest
docker push -q 127.0.0.1:5001/dokon/ilova:1 >/dev/null 2>&1
docker push -q 127.0.0.1:5001/dokon/ilova:latest >/dev/null 2>&1
curl -s http://127.0.0.1:5001/v2/dokon/ilova/tags/list \
    | sed 's/.*\[//; s/\].*//; s/"//g; s/,/\n/g' | sort

1
1.0
latest

Uchala teg bitta obrazga ishora qiladi.

docker build -t reyestr/dokon:sha-$(git rev-parse --short HEAD) .

OCI yorliqlari #

LABEL obrazga metama'lumot qo'shadi:

docker inspect 127.0.0.1:5001/dokon/ilova:1.0 \
    -f '{{range $k,$v := .Config.Labels}}{{printf "%s=%s\n" $k $v}}{{end}}' \
    | sort

org.opencontainers.image.title=Dokon ilovasi
org.opencontainers.image.version=1.0

Standart yorliqlar org.opencontainers.image.* bilan boshlanadi:

Bularni CI avtomatik to'ldiradi:

docker build \
    --label org.opencontainers.image.revision=$(git rev-parse HEAD) \
    --label org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
    -t dokon:1.0 .

Digest bilan qotirish #

DIG=$(docker inspect 127.0.0.1:5001/dokon/ilova:1.0 \
    -f '{{index .RepoDigests 0}}')
docker rmi -f 127.0.0.1:5001/dokon/ilova:1.0 >/dev/null 2>&1
docker pull -q "$DIG" >/dev/null 2>&1 && echo "digest bo'yicha tortildi"

digest bo'yicha tortildi

3-bobda aytilgan qoida shu yerda amalda: teg ko'chishi mumkin, digest - hech qachon.

Registry ni tanlash #

Xulosa #

• To'liq nom: registry/egasi/omborxona:teg; yozilmaganini Docker docker.io/library deb to'ldiradi.
• Xususiy registry ishlatish uchun uni nomga qo'shish kifoya.
• registry:2 obrazi bilan o'z registry ingizni bir buyruqda ko'tarish mumkin.
• docker push manzilni obraz nomidan oladi - shuning uchun teg to'g'ri bo'lishi kerak.
• Push chiqishidagi oxirgi qator - manifest digesti.
• Bitta obrazga bir nechta teg beriladi; ular bir xil obrazga ishora qiladi.
• CI da kommit xeshini teg qiling - obrazdan kodga yo'l ochiladi.
• LABEL bilan OCI metama'lumotini qo'shing; CI uni avtomatik to'ldirsin.
• Ishlab chiqarishga digest bilan chiqing, teg bilan emas.
• Registry ga yozish huquqi - ta'minot zanjiri xavfi; uni faqat CI ga bering.