# 创建证书目录
$ mkdir -p /data/cert
$ cd /data/cert

# 生成CA私钥
$ openssl genrsa -out ca.key 4096

输出示例如下：
Generating RSA private key, 4096 bit long modulus (2 primes)
………………………………………++++
…………..++++
e is 65537 (0x010001)

# 生成CA证书
$ openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj “/C=CN/ST=Beijing/L=Beijing/O=fgedu/OU=IT/CN=harbor.fgedu.net.cn” \
-key ca.key \
-out ca.crt

# 生成服务器私钥
$ openssl genrsa -out harbor.fgedu.net.cn.key 4096

# 生成证书签名请求
$ openssl req -sha512 -new \
-subj “/C=CN/ST=Beijing/L=Beijing/O=fgedu/OU=IT/CN=harbor.fgedu.net.cn” \
-key harbor.fgedu.net.cn.key \
-out harbor.fgedu.net.cn.csr

# 生成x509 v3扩展文件
$ cat > harbor.fgedu.net.cn.ext << EOF authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1=harbor.fgedu.net.cn DNS.2=harbor IP.1=192.168.1.51 EOF # 生成服务器证书 $ openssl x509 -req -sha512 -days 3650 \ -extfile harbor.fgedu.net.cn.ext \ -CA ca.crt -CAkey ca.key -CAcreateserial \ -in harbor.fgedu.net.cn.csr \ -out harbor.fgedu.net.cn.crt 输出示例如下： Signature ok subject=C = CN, ST = Beijing, L = Beijing, O = fgedu, OU = IT, CN = harbor.fgedu.net.cn Getting CA Private Key

步骤2：配置Docker信任证书

# 创建Docker证书目录
$ mkdir -p /etc/docker/certs.d/harbor.fgedu.net.cn

# 复制证书文件
$ cp /data/cert/harbor.fgedu.net.cn.crt /etc/docker/certs.d/harbor.fgedu.net.cn/
$ cp /data/cert/ca.crt /etc/docker/certs.d/harbor.fgedu.net.cn/

# 重启Docker服务
$ systemctl restart docker

# 验证证书配置
$ ls -la /etc/docker/certs.d/harbor.fgedu.net.cn/

输出示例如下：
total 16
drwxr-xr-x 2 root root 4096 Mar 15 10:00 .
drwxr-xr-x 3 root root 4096 Mar 15 10:00 ..
-rw-r–r– 1 root root 2049 Mar 15 10:00 ca.crt
-rw-r–r– 1 root root 2049 Mar 15 10:00 harbor.fgedu.net.cn.crt

# 登录Harbor仓库
$ docker login harbor.fgedu.net.cn

输出示例如下：
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded

# 查看登录状态
$ cat ~/.docker/config.json

输出示例如下：
{
“auths”: {
“harbor.fgedu.net.cn”: {
“auth”: “YWRtaW46SGFyYm9yQDEyMzQ1”
}
}
}

步骤2：推送镜像

# 拉取测试镜像
$ docker pull nginx:alpine

输出示例如下：
alpine: Pulling from library/nginx
abc123d: Pull complete
def456g: Pull complete
Digest: sha256:abc123def456789012345678901234567890123456789012345678901234
Status: Downloaded newer image for nginx:alpine
docker.io/library/nginx:alpine

# 标记镜像
$ docker tag nginx:alpine harbor.fgedu.net.cn/library/nginx:alpine

# 推送镜像到Harbor
$ docker push harbor.fgedu.net.cn/library/nginx:alpine

输出示例如下：
The push refers to repository [harbor.fgedu.net.cn/library/nginx]
abc123d: Pushed
def456g: Pushed
alpine: digest: sha256:abc123def456789012345678901234567890123456789012345678901234 size: 1234

# 查看推送的镜像
$ curl -k -u admin:Harbor@12345 https://harbor.fgedu.net.cn/api/v2.0/projects/library/repositories

输出示例如下：
[
{
“id”: 1,
“name”: “library/nginx”,
“project_id”: 1,
“description”: “”,
“creation_time”: “2026-03-15T10:00:00.000Z”,
“update_time”: “2026-03-15T10:00:00.000Z”
}
]

步骤3：拉取镜像

# 删除本地镜像
$ docker rmi nginx:alpine
$ docker rmi harbor.fgedu.net.cn/library/nginx:alpine

# 从Harbor拉取镜像
$ docker pull harbor.fgedu.net.cn/library/nginx:alpine

输出示例如下：
alpine: Pulling from library/nginx
abc123d: Pull complete
def456g: Pull complete
Digest: sha256:abc123def456789012345678901234567890123456789012345678901234
Status: Downloaded newer image for harbor.fgedu.net.cn/library/nginx:alpine
harbor.fgedu.net.cn/library/nginx:alpine

# 验证镜像
$ docker images | grep nginx

输出示例如下：
harbor.fgedu.net.cn/library/nginx alpine abc123def456 2 weeks ago 23.5MB

# 通过Web界面配置
# 访问 https://harbor.fgedu.net.cn
# 系统管理 -> 仓库管理 -> 新建目标

# 或使用API配置
$ curl -k -X POST -H “Content-Type: application/json” \
-u admin:Harbor@12345 \
https://harbor.fgedu.net.cn/api/v2.0/registries \
-d ‘{
“name”: “backup-harbor”,
“type”: “harbor”,
“url”: “https://backup.fgedu.net.cn”,
“credential”: {
“type”: “basic”,
“access_key”: “admin”,
“access_secret”: “Harbor@12345”
},
“insecure”: true
}’

输出示例如下：
201 Created

# 查看复制目标
$ curl -k -u admin:Harbor@12345 \
https://harbor.fgedu.net.cn/api/v2.0/registries

输出示例如下：
[
{
“id”: 1,
“name”: “backup-harbor”,
“type”: “harbor”,
“url”: “https://backup.fgedu.net.cn”,
“status”: “healthy”
}
]

步骤2：创建复制规则

# 创建复制规则
$ curl -k -X POST -H “Content-Type: application/json” \
-u admin:Harbor@12345 \
https://harbor.fgedu.net.cn/api/v2.0/replication/policies \
-d ‘{
“name”: “backup-all”,
“description”: “Backup all images”,
“src_registry”: {
“id”: 1
},
“dest_registry”: null,
“dest_namespace”: “backup”,
“trigger”: {
“type”: “scheduled”,
“trigger_settings”: {
“cron”: “0 0 2 * * *”
}
},
“filters”: [
{
“type”: “name”,
“value”: “**”
}
],
“deletion”: false,
“enabled”: true,
“override”: true,
“speed”: -1
}’

输出示例如下：
201 Created

# 手动触发复制
$ curl -k -X POST \
-u admin:Harbor@12345 \
https://harbor.fgedu.net.cn/api/v2.0/replication/executions \
-d ‘{
“policy_id”: 1
}’

输出示例如下：
201 Created

# 进入Harbor数据库容器
$ docker exec -it harbor-db /bin/bash

# 执行数据库备份
$ pg_dump -U postgres registry > /tmp/harbor_db_backup.sql

# 退出容器
$ exit

# 复制备份文件到主机
$ docker cp harbor-db:/tmp/harbor_db_backup.sql /backup/

# 查看备份文件
$ ls -la /backup/harbor_db_backup.sql

输出示例如下：
-rw-r–r– 1 root root 123456 Mar 15 10:00 /backup/harbor_db_backup.sql

步骤2：数据目录备份

# 停止Harbor服务
$ cd /root/harbor
$ docker compose down

输出示例如下：
[+] Running 13/13
✔ Container nginx Removed 1.0s
✔ Container harbor-core Removed 1.1s
✔ Container harbor-portal Removed 1.2s
✔ Container harbor-jobservice Removed 1.3s
✔ Container registryctl Removed 1.4s
✔ Container registry Removed 1.5s
✔ Container harbor-db Removed 1.6s
✔ Container redis Removed 1.7s
✔ Container trivy-adapter Removed 1.8s
✔ Container chartmuseum Removed 1.9s
✔ Container harbor-exporter Removed 2.0s
✔ Container harbor-log Removed 2.1s
✔ Network harbor_harbor Removed 2.2s

# 备份数据目录
$ tar -czf /backup/harbor_data_$(date +%Y%m%d).tar.gz /data/harbor

# 备份配置文件
$ tar -czf /backup/harbor_config_$(date +%Y%m%d).tar.gz /root/harbor

# 查看备份文件
$ ls -la /backup/

输出示例如下：
total 1258240
-rw-r–r– 1 root root 1288490188 Mar 15 10:00 harbor_data_20260315.tar.gz
-rw-r–r– 1 root root 12345 Mar 15 10:00 harbor_config_20260315.tar.gz
-rw-r–r– 1 root root 123456 Mar 15 10:00 harbor_db_backup.sql

步骤3：数据恢复

# 解压数据备份
$ tar -xzf /backup/harbor_data_20260315.tar.gz -C /

# 解压配置备份
$ tar -xzf /backup/harbor_config_20260315.tar.gz -C /

# 启动Harbor服务
$ cd /root/harbor
$ docker compose up -d

输出示例如下：
[+] Running 13/13
✔ Network harbor_harbor Created 0.1s
✔ Container harbor-log Started 1.0s
✔ Container harbor-db Started 2.0s
✔ Container redis Started 2.1s
✔ Container registryctl Started 2.8s
✔ Container registry Started 2.9s
✔ Container harbor-portal Started 3.5s
✔ Container harbor-core Started 3.9s
✔ Container harbor-jobservice Started 4.8s
✔ Container nginx Started 5.5s
✔ Container trivy-adapter Started 5.6s
✔ Container chartmuseum Started 5.7s
✔ Container harbor-exporter Started 5.8s

# 恢复数据库（如需要）
$ docker cp /backup/harbor_db_backup.sql harbor-db:/tmp/
$ docker exec -it harbor-db psql -U postgres registry -f /tmp/harbor_db_backup.sql