容器镜像仓库实战：Harbor私有仓库搭建与镜像漏洞扫描配置

容器镜像仓库是DevOps实践和Docker自动化部署流程中的关键环节。Harbor是VMware开源的企业级容器镜像仓库，在Docker Registry基础上增加了权限管理、镜像漏洞扫描、镜像签名、镜像复制等功能，适合企业内部私有镜像管理。本文介绍Harbor的安装配置、漏洞扫描集成和CI/CD流水线对接方案。

Harbor安装部署与初始配置

Harbor官方推荐使用Docker Compose方式部署，安装前需要确认Docker和Docker Compose已安装。下载Harbor安装包并配置：

# 下载Harbor安装包
cd /opt
wget https://github.com/goharbor/harbor/releases/download/v2.9.0/harbor-offline-installer-v2.9.0.tgz
tar xzf harbor-offline-installer-v2.9.0.tgz
cd harbor

# 复制并修改配置文件
cp harbor.yml.tmpl harbor.yml

编辑harbor.yml核心配置：

# harbor.yml
hostname: registry.example.com

http:
  port: 80

# HTTPS配置（生产环境必须启用）
https:
  port: 443
  certificate: /opt/harbor/ssl/registry.crt
  private_key: /opt/harbor/ssl/registry.key

# 管理员初始密码
harbor_admin_password: Harbor12345

# 数据存储路径
data_volume: /opt/harbor/data

# 日志配置
log:
  level: info
  local:
    location: /var/log/harbor
    rotate_count: 50
    rotate_size: 200M

# Trivy漏洞扫描（内置）
scanner:
  trivy:
    ignore_unfixed: false
    skip_update: false
    offline_scan: false
    security_check: vuln

# 安装并启动Harbor
./install.sh --with-trivy

# 查看运行状态
docker compose ps

# 配置Docker客户端信任私有仓库
# /etc/docker/daemon.json
{
  "insecure-registries": ["registry.example.com"],
  "registry-mirrors": ["https://registry.example.com"]
}

systemctl restart docker

Harbor项目管理与镜像推送拉取

Harbor通过Web界面创建项目并管理访问权限。创建私有项目后，通过Docker CLI推送镜像：

# 登录Harbor
docker login registry.example.com -u admin -p Harbor12345

# 给镜像打标签
docker tag myapp:latest registry.example.com/dev/myapp:1.0.0

# 推送镜像
docker push registry.example.com/dev/myapp:1.0.0

# 拉取镜像
docker pull registry.example.com/dev/myapp:1.0.0

Harbor支持镜像Tag保留策略，避免镜像堆积导致存储不足。在项目配置中设置保留规则：

# 策略示例：每个仓库保留最近10个Tag，且保留7天内的Tag
# 通过API配置保留策略
curl -X POST "https://registry.example.com/api/v2.0/projects/dev/robots" \
  -H "Content-Type: application/json" \
  -u admin:Harbor12345 \
  -d '{
    "name": "retention-robot",
    "level": "project",
    "permissions": [{"resource": "repository", "actions": ["pull","push","delete"]}]
  }'

Trivy镜像漏洞扫描配置

Harbor内置Trivy扫描器，在镜像推送后自动扫描CVE漏洞。Trivy数据库需要定期更新以获取最新漏洞信息：

# 手动更新Trivy漏洞数据库
docker exec -it harbor-trivy trivy image --download-db-only

# 配置定时更新（cron）
# 每天凌晨3点更新漏洞数据库
echo "0 3 * * * docker exec harbor-trivy trivy image --download-db-only" | crontab -

# 查看镜像扫描结果
curl -X GET "https://registry.example.com/api/v2.0/projects/dev/repositories/myapp/artifacts/1.0.0/additions/vulnerabilities" \
  -u admin:Harbor12345

扫描结果按严重程度分为Critical、High、Medium、Low四个级别。可以在Harbor项目配置中设置镜像漏洞阻止策略，存在Critical或High级别漏洞的镜像禁止部署：

# 通过API配置漏洞阻止策略
# 阻止存在High及以上漏洞的镜像被拉取
curl -X PUT "https://registry.example.com/api/v2.0/projects/dev" \
  -H "Content-Type: application/json" \
  -u admin:Harbor12345 \
  -d '{
    "metadata": {
      "prevent_vul": "true",
      "severity": "High"
    }
  }'

Harbor镜像复制与多机房同步

Harbor支持跨仓库镜像复制，用于多机房部署和容灾场景。在源Harbor配置复制策略，目标为另一个Harbor实例：

# 通过API创建复制策略
curl -X POST "https://registry.example.com/api/v2.0/replication/policies" \
  -H "Content-Type: application/json" \
  -u admin:Harbor12345 \
  -d '{
    "name": "prod-sync",
    "src_registry": {"id": 1},
    "dest_registry": {"id": 2},
    "replication_mode": "async",
    "trigger": {"type": "scheduled", "trigger_settings": {"cron": "0 2 * * * *"}},
    "filters": [
      {"type": "repository", "value": "prod/*"},
      {"type": "tag", "value": "v*"}
    ],
    "deletion": false,
    "override": true
  }'

复制策略支持基于仓库、Tag和Label的过滤规则，按Cron表达式定时同步，也支持事件驱动模式（镜像推送后立即触发复制）。

CI/CD流水线集成Harbor

在GitLab CI中集成Harbor，实现代码提交后自动构建镜像并推送到Harbor：

# .gitlab-ci.yml
stages:
  - build
  - push
  - scan

variables:
  HARBOR_REGISTRY: registry.example.com
  HARBOR_PROJECT: dev
  IMAGE_NAME: $HARBOR_REGISTRY/$HARBOR_PROJECT/$CI_PROJECT_NAME

build_image:
  stage: build
  image: docker:24.0
  script:
    - docker build -t $IMAGE_NAME:$CI_COMMIT_SHORT_SHA .
    - docker tag $IMAGE_NAME:$CI_COMMIT_SHORT_SHA $IMAGE_NAME:latest

push_image:
  stage: push
  image: docker:24.0
  before_script:
    - echo $HARBOR_PASSWORD | docker login $HARBOR_REGISTRY -u $HARBOR_USER --password-stdin
  script:
    - docker push $IMAGE_NAME:$CI_COMMIT_SHORT_SHA
    - docker push $IMAGE_NAME:latest
  only:
    - main

check_scan:
  stage: scan
  image: curlimages/curl:latest
  script:
    - sleep 30
    - |
      RESULT=$(curl -s -u $HARBOR_USER:$HARBOR_PASSWORD \
        "$HARBOR_REGISTRY/api/v2.0/projects/$HARBOR_PROJECT/repositories/$CI_PROJECT_NAME/artifacts/$CI_COMMIT_SHORT_SHA/additions/vulnerabilities")
      CRITICAL=$(echo $RESULT | jq '.severity' | grep -i critical)
      if [ -n "$CRITICAL" ]; then
        echo "Critical vulnerabilities found, deployment blocked"
        exit 1
      fi
  only:
    - main

Harbor运维与存储清理

Harbor使用Redis缓存和PostgreSQL存储元数据，镜像层数据存储在本地磁盘或S3/OSS对象存储。长期运行后需要定期清理无引用的镜像层。配置垃圾回收：

# 停止Harbor并执行垃圾回收
cd /opt/harbor
docker compose down
docker run --rm -v /opt/harbor/data/registry:/registry \
  -v /opt/harbor/common/config/registry/config.yml:/etc/registry/config.yml \
  goharbor/registry-photon:v2.9.0 garbage-collect /etc/registry/config.yml
docker compose up -d

# 查看垃圾回收结果
docker logs harbor-core | grep "garbage"

生产环境建议将镜像存储迁移到S3兼容对象存储（如MinIO、阿里云OSS），通过修改harbor.yml的storage_service配置切换存储后端，避免本地磁盘成为瓶颈。