[{"data":1,"prerenderedAt":1016},["ShallowReactive",2],{"content:\u002Fposts\u002Fharbor-install":3,"surround:\u002Fposts\u002Fharbor-install":1005},{"id":4,"title":5,"body":6,"categories":980,"date":982,"description":983,"draft":984,"extension":985,"image":986,"meta":987,"navigation":989,"path":990,"permalink":986,"pinned":984,"published":986,"readingTime":991,"recommend":986,"references":986,"seo":996,"sitemap":997,"stem":998,"tags":999,"type":1002,"updated":1003,"__hash__":1004},"content\u002Fposts\u002Fposts\u002Fharbor-install.md","Harbor 私有镜像仓库安装指南",{"type":7,"value":8,"toc":957},"minimark",[9,19,22,50,54,70,117,120,129,136,140,150,159,165,169,175,178,290,331,413,434,437,443,446,452,456,462,480,483,487,495,501,507,513,521,531,534,540,544,550,554,557,565,604,615,619,626,634,640,669,672,880,883,896,899,905,912,915,921],[10,11,15],"alert",{"type":12,"title":13,"icon":14},"info","AI 迁移提示","tabler:robot",[16,17,18],"p",{},"本文由 AI 协助从旧站迁移，尚未完成逐篇人工审校；内容如有疏漏，将在复核后修订。",[16,20,21],{},"Harbor 是一个开源镜像仓库，通过策略和基于角色的访问控制保护镜像，是 CNCF 毕业项目。内网搭建 Harbor 可避免依赖第三方镜像仓库，对无网环境尤为友好。",[10,23,24,33],{"type":12},[16,25,26,27,32],{},"客户端配置证书信任参见 ",[28,29,31],"a",{"href":30},"\u002Fposts\u002Fdocker-private-cert","Docker 配置私服自签名证书信任","。",[16,34,35,36,40,41,44,45,49],{},"本文统一使用 ",[37,38,39],"code",{"code":39},"harbor.local"," 作为示例域名、",[37,42,43],{"code":43},"192.168.2.11"," 作为示例服务器 IP。实际部署请替换为你自己的值，",[46,47,48],"strong",{},"各处保持完全一致","（证书 CN \u002F Docker certs.d 目录名 \u002F hosts 映射 \u002F Nginx server_name 等）。",[51,52,53],"h2",{"id":53},"前置条件",[10,55,56,63],{"type":12},[16,57,58,59],{},"尚未安装 Docker？参见：",[28,60,62],{"href":61},"\u002Fposts\u002Fdocker-guide","Docker 安装与配置指南",[16,64,65,66],{},"Docker Compose 安装与使用参见：",[28,67,69],{"href":68},"\u002Fposts\u002Fdocker-compose-setup","Docker Compose 安装配置",[71,72,73,80,94,100,106,112],"ul",{},[74,75,76,79],"li",{},[46,77,78],{},"Docker Engine ≥ 20.10","（Harbor 2.x 要求）",[74,81,82,85,86,89,90,93],{},[46,83,84],{},"Docker Compose","（Harbor 安装脚本会自动识别 ",[37,87,88],{"code":88},"docker compose"," 插件或老版 ",[37,91,92],{"code":92},"docker-compose"," 二进制）",[74,95,96,99],{},[46,97,98],{},"内存 ≥ 4 GB","（官方建议，低于 4 GB 部分组件会启动失败）",[74,101,102,105],{},[46,103,104],{},"磁盘 ≥ 40 GB","（Harbor 自身约 1 GB，其余留给镜像仓库存储）",[74,107,108,111],{},[46,109,110],{},"端口 80 \u002F 443","（或你自定义的端口）未被其他服务占用",[74,113,114],{},[46,115,116],{},"root 或 sudo 权限",[51,118,119],{"id":119},"下载安装包",[16,121,122,123],{},"Harbor Releases：",[28,124,128],{"href":125,"rel":126},"https:\u002F\u002Fgithub.com\u002Fgoharbor\u002Fharbor\u002Freleases",[127],"nofollow","Harbor - Github",[16,130,131,132,135],{},"建议选择 ",[37,133,134],{"code":134},"offline"," 离线包，安装时自动解压内置的 Docker 镜像，无需在线拉取。",[51,137,139],{"id":138},"生成自签名-ssl-证书","生成自签名 SSL 证书",[141,142,148],"pre",{"className":143,"code":145,"language":146,"meta":147},[144],"language-bash","sudo apt update && sudo apt install -y openssl\nvim harbor_cert.cnf\n","bash","",[37,149,145],{"__ignoreMap":147},[141,151,157],{"className":152,"code":154,"filename":155,"language":156,"meta":147},[153],"language-ini","[req]\ndistinguished_name = req_distinguished_name\nx509_extensions = v3_req\nprompt = no\n\n[req_distinguished_name]\nC = CN                     # 国家代号\nST = Beijing               # 省份\nL = Beijing                # 城市\nO = MyOrg                  # 组织\nOU = DevOps                # 部门\nCN = harbor.local          # ← 替换为你的 Harbor 域名或 IP\n\n[v3_req]\nkeyUsage = keyEncipherment, dataEncipherment, digitalSignature\nextendedKeyUsage = serverAuth\nsubjectAltName = @alt_names\n\n[alt_names]\nDNS.1 = harbor.local         # 主域名\nDNS.2 = *.local              # 可选：泛域名\nIP.1 = 192.168.2.11          # ← 裸 IP 访问场景必须加，否则 Docker 推镜像会报 \"no IP SANs\"\n","harbor_cert.cnf","ini",[37,158,154],{"__ignoreMap":147},[141,160,163],{"className":161,"code":162,"language":146,"meta":147},[144],"# 生成私钥 + 自签名证书（有效期 10 年）\nopenssl req -x509 \\\n  -newkey rsa:4096 \\\n  -sha256 \\\n  -days 3650 \\\n  -nodes \\\n  -keyout harbor.key \\\n  -out harbor.crt \\\n  -config harbor_cert.cnf \\\n  -extensions v3_req\n\n# 把证书放到后续 Harbor 和 Nginx 都方便引用的位置\nsudo mkdir -p \u002Fopt\u002Fharbor\u002Fcrt\nsudo cp harbor.crt harbor.key \u002Fopt\u002Fharbor\u002Fcrt\u002F\n\n# Docker 客户端信任证书\n# 注意：目录名必须和 docker login 时用的域名完全一致\nsudo mkdir -p \u002Fetc\u002Fdocker\u002Fcerts.d\u002Fharbor.local\u002F\nsudo cp harbor.crt \u002Fetc\u002Fdocker\u002Fcerts.d\u002Fharbor.local\u002Fca.crt\n",[37,164,162],{"__ignoreMap":147},[51,166,168],{"id":167},"配置-harboryml","配置 harbor.yml",[141,170,173],{"className":171,"code":172,"language":146,"meta":147},[144],"cp harbor.yml.tmpl harbor.yml\nvim harbor.yml\n",[37,174,172],{"__ignoreMap":147},[16,176,177],{},"关键配置项：",[179,180,181,194],"table",{},[182,183,184],"thead",{},[185,186,187,191],"tr",{},[188,189,190],"th",{},"配置项",[188,192,193],{},"说明",[195,196,197,211,221,231,244,257,270,280],"tbody",{},[185,198,199,205],{},[200,201,202],"td",{},[37,203,204],{"code":204},"hostname",[200,206,207,208,210],{},"Harbor 访问域名或 IP（本文用 ",[37,209,39],{"code":39},"）",[185,212,213,218],{},[200,214,215],{},[37,216,217],{"code":217},"http.port",[200,219,220],{},"HTTP 端口（默认 80）",[185,222,223,228],{},[200,224,225],{},[37,226,227],{"code":227},"https.port",[200,229,230],{},"HTTPS 端口（默认 443）",[185,232,233,238],{},[200,234,235],{},[37,236,237],{"code":237},"https.certificate",[200,239,240,241,210],{},"CRT 证书路径（建议 ",[37,242,243],{"code":243},"\u002Fopt\u002Fharbor\u002Fcrt\u002Fharbor.crt",[185,245,246,251],{},[200,247,248],{},[37,249,250],{"code":250},"https.private_key",[200,252,253,254,210],{},"KEY 私钥路径（建议 ",[37,255,256],{"code":256},"\u002Fopt\u002Fharbor\u002Fcrt\u002Fharbor.key",[185,258,259,264],{},[200,260,261],{},[37,262,263],{"code":263},"harbor_admin_password",[200,265,266,267,210],{},"admin 初始密码（默认 ",[37,268,269],{"code":269},"Harbor12345",[185,271,272,277],{},[200,273,274],{},[37,275,276],{"code":276},"external_url",[200,278,279],{},"外部 URL 地址",[185,281,282,287],{},[200,283,284],{},[37,285,286],{"code":286},"data_volume",[200,288,289],{},"数据持久化目录（建议配置到大容量盘）",[10,291,294,307,328],{"type":292,"title":293},"warning","务必修改默认密码 Harbor12345",[16,295,296,298,299,302,303,306],{},[37,297,269],{"code":269}," 是 Harbor 官方文档里的",[46,300,301],{},"公开默认密码","——任何扫描器都会第一时间尝试它。部署完成后",[46,304,305],{},"第一件事","就是改掉：",[71,308,309,322],{},[74,310,311,312,315,316,318,319],{},"首次部署前：直接在 ",[37,313,314],{"code":314},"harbor.yml"," 里把 ",[37,317,263],{"code":263}," 改成强密码，再 ",[37,320,321],{"code":321},".\u002Finstall.sh",[74,323,324,325],{},"已经部署完成：Web UI 登录后进 ",[46,326,327],{},"用户管理 → admin → 修改密码",[16,329,330],{},"不改就部署、尤其是公网可达的 Harbor，基本等于当场被接管。",[10,332,335,349],{"type":333,"title":334},"tip","推荐在第一次 install.sh 之前就调整好的配置",[16,336,337,338,340,341,344,345,348],{},"首次 ",[37,339,321],{"code":321}," 之后改部分配置需要重新 ",[37,342,343],{"code":343},".\u002Fprepare"," + 重建容器，",[46,346,347],{},"一次到位更省事","。首次安装前至少检查以下几项：",[71,350,351,361,368,382,397,406],{},[74,352,353,357,358,360],{},[46,354,355],{},[37,356,204],{"code":204},"：改成 ",[37,359,39],{"code":39},"（或你的实际域名），要和证书 CN 一致",[74,362,363,367],{},[46,364,365],{},[37,366,263],{"code":263},"：改成强密码（见上方 caution）",[74,369,370,374,375,378,379,210],{},[46,371,372],{},[37,373,286],{"code":286},"：默认 ",[37,376,377],{"code":377},"\u002Fdata","，如果根分区小必须挪到大容量盘挂载点（如 ",[37,380,381],{"code":381},"\u002Fmnt\u002Fstorage\u002Fharbor",[74,383,384,391,392,394,395],{},[46,385,386,388,389],{},[37,387,237],{"code":237}," \u002F ",[37,390,250],{"code":250},"：指向 ",[37,393,243],{"code":243}," 和 ",[37,396,256],{"code":256},[74,398,399,405],{},[46,400,401,388,403],{},[37,402,217],{"code":217},[37,404,227],{"code":227},"：如果宿主机 80\u002F443 被系统 Nginx \u002F Apache 占用，改成 31080 \u002F 31443（或任意非占用端口），再配合下文 Nginx 反向代理做对外映射",[74,407,408,412],{},[46,409,410],{},[37,411,276],{"code":276},"：用非标端口 \u002F Nginx 反代时必配，否则登录认证会走错端口（详见下方 note）",[10,414,416,419,422,425,428,431],{"type":12,"title":415},"external_url 详解",[16,417,418],{},"external_url 是 Harbor 配置文件中的参数，用于定义外部客户端访问该服务的基准 URL。其技术逻辑如下：",[16,420,421],{},"优先级：启用该参数后，配置中的 hostname 将失效。",[16,423,424],{},"令牌生成：Harbor 的认证服务（Token Service）会根据此参数生成 OAuth 令牌挑战（Challenge）中的 realm 地址。",[16,426,427],{},"重定向逻辑：决定 Harbor 在返回 HTTP 重定向或 API 响应时，所携带的协议、域名及端口号。",[16,429,430],{},"端口同步：在通过 Nginx 映射非标准端口（如 31001）时，该参数确保后端返回的认证地址与外部监听端口一致，防止客户端因默认访问 443 端口导致连接超时。",[16,432,433],{},"配置生效：修改此参数后，必须执行 .\u002Fprepare 脚本，以重新生成各个微服务组件内部的配置文件。",[51,435,436],{"id":436},"安装",[141,438,441],{"className":439,"code":440,"language":146,"meta":147},[144],".\u002Finstall.sh\n",[37,442,440],{"__ignoreMap":147},[16,444,445],{},"修改配置后重新加载：",[141,447,450],{"className":448,"code":449,"language":146,"meta":147},[144],".\u002Fprepare\ndocker compose down\ndocker compose up -d\n",[37,451,449],{"__ignoreMap":147},[453,454,455],"h3",{"id":455},"验证部署成功",[141,457,460],{"className":458,"code":459,"language":146,"meta":147},[144],"# 1. 查看所有 Harbor 容器状态（正常应该全部 Up 且 healthy）\ndocker compose ps\n\n# 2. 检查端口监听\nss -lntp | grep -E ':(80|443)\\b'\n\n# 3. 浏览器访问 https:\u002F\u002Fharbor.local（需先配好客户端 hosts，见下一节）\n#    默认凭据：admin \u002F Harbor12345（若未改）\n",[37,461,459],{"__ignoreMap":147},[16,463,464,465,468,469,472,473,476,477,479],{},"如果 ",[37,466,467],{"code":467},"docker compose ps"," 看到某个容器在反复 ",[37,470,471],{"code":471},"Restarting","，先 ",[37,474,475],{"code":475},"docker compose logs \u003C服务名>"," 定位具体错误——绝大多数是端口冲突或 ",[37,478,314],{"code":314}," 语法问题。",[51,481,482],{"id":482},"使用",[453,484,486],{"id":485},"配置客户端-hosts","配置客户端 hosts",[16,488,489,491,492,32],{},[37,490,39],{"code":39}," 是内网自定义域名，没有公网 DNS 解析——",[46,493,494],{},"所有需要访问 Harbor 的客户端都要手动写 hosts 文件",[16,496,497,500],{},[46,498,499],{},"Linux \u002F macOS","：",[141,502,505],{"className":503,"code":504,"language":146,"meta":147},[144],"echo \"192.168.2.11 harbor.local\" | sudo tee -a \u002Fetc\u002Fhosts\n",[37,506,504],{"__ignoreMap":147},[16,508,509,512],{},[46,510,511],{},"Windows","（管理员 PowerShell）：",[141,514,519],{"className":515,"code":517,"language":518,"meta":147},[516],"language-powershell","Add-Content -Path \"$env:SystemRoot\\System32\\drivers\\etc\\hosts\" -Value \"192.168.2.11 harbor.local\"\n","powershell",[37,520,517],{"__ignoreMap":147},[16,522,523,524,527,528,32],{},"或者手动编辑 ",[37,525,526],{"code":526},"C:\\Windows\\System32\\drivers\\etc\\hosts","，末尾加一行 ",[37,529,530],{"code":530},"192.168.2.11 harbor.local",[16,532,533],{},"配完后验证：",[141,535,538],{"className":536,"code":537,"language":146,"meta":147},[144],"ping harbor.local\n# 应当解析到 192.168.2.11\n",[37,539,537],{"__ignoreMap":147},[453,541,543],{"id":542},"推送-拉取镜像","推送 \u002F 拉取镜像",[141,545,548],{"className":546,"code":547,"language":146,"meta":147},[144],"# 登录（默认 admin \u002F 你在 harbor.yml 设定的密码）\ndocker login harbor.local\n\n# 打标签\ndocker tag myapp:latest harbor.local\u002Fmyproject\u002Fmyapp:v1.0.0\n\n# 推送\ndocker push harbor.local\u002Fmyproject\u002Fmyapp:v1.0.0\n\n# 拉取\ndocker pull harbor.local\u002Fmyproject\u002Fmyapp:v1.0.0\n",[37,549,547],{"__ignoreMap":147},[51,551,553],{"id":552},"nginx-反向代理使用非-80443-端口时","Nginx 反向代理（使用非 80\u002F443 端口时）",[16,555,556],{},"当宿主机的 80\u002F443 已被其他服务占用，可以让 Harbor 监听非标端口（比如 31080\u002F31443），再用外层 Nginx 做 TLS 终结和对外映射。",[141,558,563],{"className":559,"code":561,"language":562,"meta":147},[560],"language-nginx","upstream harbor_backend {\n    server 127.0.0.1:5443;   # ← 对应 harbor.yml 里的 https.port，按实际填写\n    keepalive 32;\n}\n\nserver {\n    listen 443 ssl http2;\n    server_name harbor.local;\n\n    # 复用第 3 节生成的自签名证书\n    ssl_certificate     \u002Fopt\u002Fharbor\u002Fcrt\u002Fharbor.crt;\n    ssl_certificate_key \u002Fopt\u002Fharbor\u002Fcrt\u002Fharbor.key;\n    ssl_protocols       TLSv1.2 TLSv1.3;\n    ssl_ciphers         ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;\n\n    client_max_body_size 0;   # 允许无限大镜像上传，必加\n\n    location \u002F {\n        proxy_pass https:\u002F\u002Fharbor_backend;\n\n        # 关键：Harbor 后端也是 HTTPS（自签证书），Nginx 默认会尝试验证且必定失败，要关掉\n        proxy_ssl_verify off;\n\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_buffering off;\n        proxy_request_buffering off;\n        proxy_connect_timeout 90s;\n        proxy_send_timeout    90s;\n        proxy_read_timeout    90s;\n    }\n}\n\nserver {\n    listen 80;\n    server_name harbor.local;\n    return 301 https:\u002F\u002F$host$request_uri;\n}\n","nginx",[37,564,561],{"__ignoreMap":147},[10,566,568,583],{"type":333,"title":567},"关于双 TLS 架构",[16,569,570,571,574,575,582],{},"上面是 ",[46,572,573],{},"Nginx HTTPS → Harbor HTTPS"," 的双 TLS 结构（Nginx 和 Harbor 可以共用同一张自签证书，也可以各用各的）。",[46,576,577,578,581],{},"即便两边用同一张证书，",[37,579,580],{"code":580},"proxy_ssl_verify off;"," 仍然要加","——Nginx 作为 TLS 客户端去连后端时，默认会走完整的 CA 链校验，自签证书没有\"可信 CA\"，所以一定失败。关掉校验后加密仍然在，只是不再做身份验证。",[16,584,585,586,589,590,592,593,596,597,599,600,603],{},"如果嫌双 TLS 麻烦，还有一种更常见的简化架构：",[46,587,588],{},"Harbor 跑 HTTP","（",[37,591,314],{"code":314}," 里注释掉整个 ",[37,594,595],{"code":595},"https:"," 块、只留 ",[37,598,217],{"code":217},"），",[46,601,602],{},"Nginx 做唯一的 TLS 终结","。宿主机本地 Docker 网络里的 HTTP 流量不出机器，风险可接受、配置更简单。",[10,605,606,609],{"type":12},[16,607,608],{},"如果你的 harbor 是非标端口，请使用下面的 nginx 配置",[141,610,613],{"className":611,"code":612,"language":562,"meta":147},[560],"location \u002F {\n    proxy_pass https:\u002F\u002Fharbor_backend; # 指向 Harbor 内部的 30443\n    proxy_ssl_verify off;\n\n    proxy_set_header Host $host:31001; # 显式告诉后端外部端口\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header X-Forwarded-Port 31001; # 必须明确告诉是 31001\n\n    # 下面两项对大镜像上传至关重要\n    proxy_buffering off;\n    proxy_request_buffering off;\n}\n",[37,614,612],{"__ignoreMap":147},[51,616,618],{"id":617},"使用-http不推荐生产环境","使用 HTTP（不推荐生产环境）",[16,620,621,622,625],{},"在 Docker 的 ",[37,623,624],{"code":624},"daemon.json"," 中添加：",[141,627,632],{"className":628,"code":630,"language":631,"meta":147},[629],"language-json","{\n  \"insecure-registries\": [\"harbor.local\"]\n}\n","json",[37,633,630],{"__ignoreMap":147},[141,635,638],{"className":636,"code":637,"language":146,"meta":147},[144],"systemctl restart docker\n",[37,639,637],{"__ignoreMap":147},[10,641,643,652,663],{"type":292,"title":642},"HTTP 模式的真实风险",[16,644,645,648,649,500],{},[37,646,647],{"code":647},"insecure-registries"," 模式下，Docker 和 Harbor 之间",[46,650,651],{},"所有流量都是明文",[71,653,654,657,660],{},[74,655,656],{},"登录凭据（HTTP Basic Auth）直接在请求头里裸奔——被嗅探就是当场被盗号",[74,658,659],{},"镜像层数据也走明文，既能被拦截拷贝、也可能被篡改（例如注入恶意二进制）",[74,661,662],{},"任何链路上的中间人（交换机、路由器、代理、公共 Wi-Fi AP）都能看到并改写",[16,664,665,668],{},[46,666,667],{},"仅适用于完全隔离的实验网络","。只要有一点外部访问，或涉及生产凭据，都必须走 HTTPS。",[51,670,671],{"id":671},"故障排查",[179,673,674,687],{},[182,675,676],{},[185,677,678,681,684],{},[188,679,680],{},"现象",[188,682,683],{},"可能原因",[188,685,686],{},"对策",[195,688,689,722,749,772,793,818,838,860],{},[185,690,691,700,706],{},[200,692,693,696,697],{},[37,694,695],{"code":695},"docker login"," 报 ",[37,698,699],{"code":699},"x509: certificate signed by unknown authority",[200,701,702,705],{},[37,703,704],{"code":704},"certs.d"," 目录名和登录时用的域名对不上",[200,707,708,709,711,712,715,716,718,719],{},"目录名必须和 ",[37,710,695],{"code":695}," 时用的域名",[46,713,714],{},"完全一致","：登录 ",[37,717,39],{"code":39}," 就放 ",[37,720,721],{"code":721},"\u002Fetc\u002Fdocker\u002Fcerts.d\u002Fharbor.local\u002Fca.crt",[185,723,724,732,735],{},[200,725,726,696,729],{},[37,727,728],{"code":728},"docker push",[37,730,731],{"code":731},"x509: cannot validate certificate for 192.168.x.x because it doesn't contain any IP SANs",[200,733,734],{},"证书没有 IP SAN",[200,736,737,738,740,741,744,745,748],{},"在 ",[37,739,155],{"code":155}," 的 ",[37,742,743],{"code":743},"[alt_names]"," 段加 ",[37,746,747],{"code":747},"IP.1 = 192.168.x.x","，重新签发",[185,750,751,759,766],{},[200,752,753,755,756],{},[37,754,728],{"code":728}," 大镜像报 ",[37,757,758],{"code":758},"413 Request Entity Too Large",[200,760,761,762,765],{},"Nginx ",[37,763,764],{"code":764},"client_max_body_size"," 限制",[200,767,768,769],{},"确认 Nginx 配置里有 ",[37,770,771],{"code":771},"client_max_body_size 0;",[185,773,774,780,785],{},[200,775,776,777],{},"登录报 ",[37,778,779],{"code":779},"unauthorized: authentication required",[200,781,782,784],{},[37,783,276],{"code":276}," 配置错，Harbor 返回的 token realm 对不上实际访问地址",[200,786,787,788,790,791],{},"核对 ",[37,789,276],{"code":276}," 协议 \u002F 域名 \u002F 端口和浏览器地址栏一致，改完跑 ",[37,792,343],{"code":343},[185,794,795,798,804],{},[200,796,797],{},"浏览器访问白屏或 502",[200,799,800,801],{},"Nginx upstream 端口不对 \u002F 没关 ",[37,802,803],{"code":803},"proxy_ssl_verify",[200,805,806,807,740,809,811,812,815,816],{},"确认 ",[37,808,314],{"code":314},[37,810,227],{"code":227}," 和 Nginx ",[37,813,814],{"code":814},"upstream"," 端口一致；加 ",[37,817,580],{"code":580},[185,819,820,827,833],{},[200,821,822,824,825],{},[37,823,467],{"code":467}," 某容器反复 ",[37,826,471],{"code":471},[200,828,829,830,832],{},"端口冲突 \u002F ",[37,831,314],{"code":314}," 语法错 \u002F 磁盘满",[200,834,835,837],{},[37,836,475],{"code":475}," 定位具体报错",[185,839,840,847,850],{},[200,841,842,843,846],{},"hosts 配好了但 ",[37,844,845],{"code":845},"ping harbor.local"," 还不通",[200,848,849],{},"写错了行 \u002F hosts 文件有 BOM \u002F Windows 权限不够",[200,851,852,855,856,859],{},[37,853,854],{"code":854},"cat \u002Fetc\u002Fhosts"," 或 Windows 下用",[46,857,858],{},"以管理员身份","编辑；确认没有奇怪字符",[185,861,862,865,868],{},[200,863,864],{},"推送镜像非常慢或中途断开",[200,866,867],{},"Nginx 缓冲 \u002F 超时不够",[200,869,806,870,873,874,388,877],{},[37,871,872],{"code":872},"proxy_buffering off; proxy_request_buffering off;","；调大 ",[37,875,876],{"code":876},"proxy_send_timeout",[37,878,879],{"code":879},"proxy_read_timeout",[51,881,882],{"id":882},"备份与升级",[16,884,885,886,888,889,891,892,895],{},"Harbor 的全部数据都在 ",[37,887,286],{"code":286}," 指定的目录下（默认 ",[37,890,377],{"code":377},"），包括 PostgreSQL 数据、镜像层存储、Redis、日志等。",[46,893,894],{},"升级前一定要备份","，出问题才有回滚余地。",[453,897,898],{"id":898},"备份",[141,900,903],{"className":901,"code":902,"language":146,"meta":147},[144],"cd \u002Fpath\u002Fto\u002Fharbor-installer\n\n# 1. 停止 Harbor\ndocker compose down\n\n# 2. 备份数据目录（data_volume 指定的路径）\nsudo tar czf \u002Fbackup\u002Fharbor-data-$(date +%F).tar.gz \u002Fdata\n\n# 3. 备份 harbor.yml（里面有一堆你调过的配置）\ncp harbor.yml \u002Fbackup\u002Fharbor.yml.$(date +%F)\n\n# 4. 重启\ndocker compose up -d\n",[37,904,902],{"__ignoreMap":147},[16,906,907,908,911],{},"建议把 ",[37,909,910],{"code":910},"\u002Fbackup"," 目录定时同步到另一台机器或云存储，单点备份不算真正的备份。",[453,913,914],{"id":914},"升级",[141,916,919],{"className":917,"code":918,"language":146,"meta":147},[144],"# 1. 先按上面\"备份\"节做完备份\n\n# 2. 下载新版本的离线安装包、解压到新目录\ntar xvf harbor-offline-installer-v2.x.x.tgz -C \u002Fopt\u002F\ncd \u002Fopt\u002Fharbor   # 新版本目录\n\n# 3. 把旧 harbor.yml 拷过来（保留你的所有配置）\ncp \u002Fbackup\u002Fharbor.yml.\u003C日期> .\u002Fharbor.yml\n\n# 4. 停止旧版本\ncd \u002Fpath\u002Fto\u002Fold-harbor && docker compose down\n\n# 5. 在新目录安装（会自动检测 data_volume 里已有数据并升级）\ncd \u002Fopt\u002Fharbor\n.\u002Finstall.sh\n",[37,920,918],{"__ignoreMap":147},[10,922,924,927,951],{"type":292,"title":923},"升级失败的回滚思路",[16,925,926],{},"如果新版本起不来或者数据有问题：",[928,929,930,936,945],"ol",{},[74,931,932,935],{},[37,933,934],{"code":934},"docker compose down"," 停掉新版本",[74,937,938,939,941,942],{},"恢复 ",[37,940,286],{"code":286}," 目录：",[37,943,944],{"code":944},"sudo tar xzf \u002Fbackup\u002Fharbor-data-\u003C日期>.tar.gz -C \u002F",[74,946,947,948],{},"回到旧版本的安装目录 ",[37,949,950],{"code":950},"docker compose up -d",[16,952,953,954,32],{},"所以",[46,955,956],{},"备份的 tar 包必须保留到新版本稳定运行一段时间之后再删",{"title":147,"searchDepth":958,"depth":958,"links":959},4,[960,962,963,964,965,969,973,974,975,976],{"id":53,"depth":961,"text":53},2,{"id":119,"depth":961,"text":119},{"id":138,"depth":961,"text":139},{"id":167,"depth":961,"text":168},{"id":436,"depth":961,"text":436,"children":966},[967],{"id":455,"depth":968,"text":455},3,{"id":482,"depth":961,"text":482,"children":970},[971,972],{"id":485,"depth":968,"text":486},{"id":542,"depth":968,"text":543},{"id":552,"depth":961,"text":553},{"id":617,"depth":961,"text":618},{"id":671,"depth":961,"text":671},{"id":882,"depth":961,"text":882,"children":977},[978,979],{"id":898,"depth":968,"text":898},{"id":914,"depth":968,"text":914},[981],"服务","2024-07-19 14:11:19","使用 Docker Compose 部署 Harbor 私有镜像仓库，包含自签名 SSL 证书生成、YAML 配置、Nginx 反向代理等完整流程。",false,"md",null,{"slots":988},{},true,"\u002Fposts\u002Fharbor-install",{"text":992,"minutes":993,"time":994,"words":995},"13 min read",12.56,753600,2512,{"title":5,"description":983},{"loc":990},"posts\u002Fposts\u002Fharbor-install",[1000,1001],"docker","harbor","tech","2026-06-27 14:11:19","8C8ODexTvlWsRvGXdUqseWzuNNksRCo-ttO702z5Qp4",[1006,1011],{"title":1007,"path":1008,"stem":1009,"date":1010,"type":1002,"children":-1},"Linux 手动安装 JDK 1.8 并配置环境变量","\u002Fposts\u002Fjdk-install","posts\u002Fposts\u002Fjdk-install","2024-06-20",{"title":1012,"path":1013,"stem":1014,"date":1015,"type":1002,"children":-1},"使用 Squid 为内网服务器搭建 HTTP 代理","\u002Fposts\u002Fcentos-squid-proxy","posts\u002Fposts\u002Fcentos-squid-proxy","2024-07-20 09:48:41",1788712226378]