无法创建docker注册表代理缓存:权限被拒绝

Question

我快疯了..。

[root@kube-1 ~]# cat config.yml
version: 0.1
log:
  fields:
    service: registry
storage:
  cache:
    blobdescriptor: inmemory
  filesystem:
    rootdirectory: /var/lib/registry
http:
  addr: :5000
  tls:
    certificate: /var/lib/registry/docker-registry.crt
    key: /var/lib/registry/docker-registry.key
  headers:
    X-Content-Type-Options: [nosniff]
health:
  storagedriver:
    enabled: true
    interval: 10s
    threshold: 3
proxy:
  remoteurl: https://registry-1.docker.io
[root@kube-1 ~]# ls -lah config.yml
-rw-rw-r--. 1 root root 476 Apr 17 07:00 config.yml

但是，当我启动它时：

[root@kube-1 ~]# docker run -p 5000:5000 --restart=always --name registry-mirror \
>              -v /var/lib/registry:/var/lib/registry \
>              -v `pwd`/config.yml:/etc/docker/registry/config.yml \
>              registry:2
configuration error: open /etc/docker/registry/config.yml: permission denied

Usage:
  registry serve <config> [flags]
Flags:
  -h, --help=false: help for serve


Additional help topics:

但是如果我删除我的自定义config.yml：

[root@kube-1 ~]# docker run -p 5000:5000 --restart=always --name registry-mirror \
>              -v /var/lib/registry:/var/lib/registry \
>              registry:2
time="2019-04-17T07:23:23.919744217Z" level=warning msg="No HTTP secret provided - generated random secret. This may cause problems with uploads if multiple registries are behind a load-balancer. To provide a shared secret, fill in http.secret in the configuration file or set the REGISTRY_HTTP_SECRET environment variable." go.version=go1.11.2 instance.id=ce2e25dd-e21f-4948-b0df-2bb1779c882c service=registry version=v2.7.1
time="2019-04-17T07:23:23.919857827Z" level=info msg="redis not configured" go.version=go1.11.2 instance.id=ce2e25dd-e21f-4948-b0df-2bb1779c882c service=registry version=v2.7.1
time="2019-04-17T07:23:23.919918115Z" level=info msg="Starting upload purge in 4m0s" go.version=go1.11.2 instance.id=ce2e25dd-e21f-4948-b0df-2bb1779c882c service=registry version=v2.7.1
time="2019-04-17T07:23:23.933503382Z" level=info msg="using inmemory blob descriptor cache" go.version=go1.11.2 instance.id=ce2e25dd-e21f-4948-b0df-2bb1779c882c service=registry version=v2.7.1
time="2019-04-17T07:23:23.934471121Z" level=info msg="listening on [::]:5000" go.version=go1.11.2 instance.id=ce2e25dd-e21f-4948-b0df-2bb1779c882c service=registry version=v2.7.1

如何使自定义配置与docker注册表一起工作？！

Answer 1

啊哈！

[centos@kube-1 registry]$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31

centos@kube-1注册表]$ sudo setenforce 0