Harbor 常见问题排查

装 Harbor 时遇到的几个问题和解法:端口占用、http/https 混用、改端口后证书路径、日志容器权限。

端口被占用

启动时 http 端口被占,改 harbor.yml 里的 http 端口,比如改成 8081:

http:
  port: 8081

重新加载配置、重启 docker、重启 Harbor:

sudo ./prepare
sudo systemctl restart docker
sudo docker-compose down -v
sudo docker-compose up -d

之后访问 http://IP:8081。

server gave HTTP response to HTTPS client

Harbor 是 http 模式,但 Docker 客户端默认走 https,于是报:

Error response from daemon: Get "https://<harbor-host>:8081/v2/": http: server gave HTTP response to HTTPS client

在需要连 Harbor 的机器上编辑 /etc/docker/daemon.json(没有就新建):

{
    "insecure-registries":["harbor 的 ip 地址:端口号"]
}

然后:

sudo systemctl daemon-reload
sudo systemctl restart docker
cd /usr/local/harbor/
sudo docker-compose down -v
sudo docker-compose up -d

之后 sudo docker login <harbor-host>:8080 就能登录了。

改 HTTPS 端口后证书路径不匹配

改 harbor.yml 里 https 端口,比如 8444:

https:
  port: 8444

重新加载并重启(同上)。验证登录若报 certificate signed by unknown authority,是因为证书目录默认对应 443 端口,改了端口要把目录也带上端口号:

sudo docker login <harbor-host>:8444

# 默认目录不带端口号对应 443,改端口后要重命名
sudo mv /etc/docker/certs.d/<harbor-host>/ /etc/docker/certs.d/<harbor-host>:8444/

harbor-log 容器启动失败

报错:

ERROR: for harbor-portal  Cannot start service portal: failed to initialize logging driver:
dial tcp 127.0.0.1:1514: connect: connection refused

docker ps 看到 harbor-log 容器启动失败,docker logs harbor-log 里是 sudo 配置文件权限问题:

sudo: /etc/sudo.conf is world writable
sudo: /usr/lib/sudo/sudoers.so must be only be writable by owner

写个 Dockerfile 把相关文件权限改成 440,重新 build harbor-log 镜像:

FROM goharbor/harbor-log:v2.3.4
RUN chmod 440 /etc/sudo.conf
RUN chmod 440 /usr/lib/sudo/sudoers.so
RUN chmod 440 /etc/sudoers
RUN chmod 440 /etc/sudoers.d

docker build -t harbor-log:test .

改 Harbor 的 docker-compose.yml,把 log 服务的镜像换成新的:

  log:
    image: harbor-log:test
    container_name: harbor-log
    restart: always

按新配置重启:

sudo docker-compose down -v
sudo docker-compose -f docker-compose-test.yml up -d