如何在 docker-machine 上使用安全的 docker 注册表镜像？

Question

我有一个 docker 发行版 v2 注册表，我将其用作镜像。它使用 Docker 用于 Mac 社区版 17.03.1-ce-mac12 (17661)，但从 docker 机器访问它时出现 "certificate signed by unknown authority" 错误节点。设置如下：

openssl req -newkey rsa:4096 -nodes -sha256 -keyout "/certs/domain.key" -x509 -days "365" -out "/certs/domain.cert" -subj /CN=“192.168.17.11”

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain $DIR/devenv/domain.cert
docker run -d --restart=always -p 6000:5000 --name registry-mirror -v /Volumes/Data/registry_cache:/var/lib/registry registry:2 /var/lib/registry/config.yml

docker pull busybox

curl -k https://192.168.17.11:6000/v2/_catalog

{"repositories":["library/busybox"]}

docker-machine create -d virtualbox —engine-registry-mirror https://192.168.17.11:6000 mynode

docker-machine ssh mynode "sudo mkdir -p /etc/docker/certs.d/192.168.17.11:6000 && sudo chmod -R 777 /etc/docker/certs.d"
docker-machine scp $DIR/devenv/domain.cert mynode:/etc/docker/certs.d/192.168.17.11:6000/domain.cert
docker-machine scp $DIR/devenv/domain.key mynode:/etc/docker/certs.d/192.168.17.11:6000/domain.key
docker-machine restart mynode

eval $(docker-machine env mynode)
docker info

… Registry Mirrors:

https://192.168.17.11:6000/

docker pull busybox

cat /var/log/docker.log

… time="2017-05-30T12:33:01.593516721Z" level=debug msg="Trying to pull busybox from https://192.168.17.11:6000/ v2"

time="2017-05-30T12:33:02.539391694Z" level=warning msg="Error getting v2 registry: Get https://192.168.17.11:6000/v2/: x509: certificate signed by unknown authority"

我不确定如何让 boot2docker VM 接受 docker 复制 v2 注册表镜像使用的证书。其他示例将证书颁发机构的 ca.crt 复制到 /etc/certs.d/，但此证书是自签名的。

Answer 1

重新启动托管此设置的 OSX 机器似乎已经解决了问题，现在，等待时间确定它，这已经足够了。

如何在 docker-machine 上使用安全的 docker 注册表镜像？

how to use a secure docker registry mirror with docker-machine?

certificate

boot2docker

docker-machine

docker-registry

docker-for-mac