Docker에는 레지스트리와 상호작용하기 위한 액세스 권한이 필요합니다. Linux 또는 Windows에서 Docker 보안 그룹에 Docker 명령어를 실행하는 데 사용할 사용자를 추가합니다. Docker Desktop은 가상 머신에서 루트 사용자로 실행되므로 macOS에서는 이 단계가 필요하지 않습니다.
Linux의 경우 사용자를 추가합니다.
sudousermod-a-GdockerUSER
Windows:
netlocalgroupdocker-usersDOMAIN\USER/add
USER을 추가할 사용자 이름으로 바꿉니다.
Harbor 루트 CA를 신뢰하도록 Docker 구성
Docker 클라이언트를 사용하여 Harbor 인스턴스와 통신할 때는 조직의 루트 CA를 신뢰하도록 로컬 Docker 클라이언트를 구성해야 합니다.
루트 CA를 신뢰하도록 Docker 클라이언트를 구성하려면 조직 관리자에게 루트 CA의 .crt 파일을 요청하고 조직 루트 CA를 다음 위치에 복사합니다.
/etc/docker/certs.d/HARBOR_INSTANCE_URL/ca.crt
HARBOR_INSTANCE_URL을 Harbor 인스턴스의 URL로 바꿉니다. 예를 들면 harbor-1.org-1.zone1.google.gdc.test입니다.
이 명령어를 사용하면 Docker 클라이언트가 Harbor 인스턴스와 HTTPS 연결을 설정할 수 있습니다.
또는 gdcloud CLI를 사용하여 조직의 사용자 클러스터에 로그인하고 클러스터에 저장된 웹 CA를 복사합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Configure Docker to trust the Harbor root CA\n\nHarbor instances use Transport Layer Security (TLS) certificates issued by your\norganization's trusted root Certificate Authority (CA). This encrypts the\nconnection between your Docker client and Harbor registry to secure images from\nunauthorized access.\n\nBefore you begin\n----------------\n\nYou must perform these steps before managing your container\nimages:\n\n1. Install Docker if it is not already installed by following the instructions at \u003chttps://docs.docker.com/engine/install/ubuntu/\u003e. Docker is included in Cloud Shell.\n2. Docker requires privileged access to interact with registries. On Linux\n or Windows, add the user that you use to run Docker commands to the Docker\n security group. This step is not required on macOS since Docker Desktop\n runs on a virtual machine as the root user.\n\n 1. For Linux, add the user:\n\n sudo usermod -a -G docker \u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e\n\n 2. For Windows:\n\n net localgroup docker-users DOMAIN\\\u003cvar translate=\"no\"\u003eU\u003c/var\u003eSER /add\n\n Replace \u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e with the username you want to add.\n\nConfigure Docker to trust Harbor Root CA\n----------------------------------------\n\nYou must configure your local Docker client to trust your organization's root\nCA when using the Docker client to communicate with the Harbor instance.\n\nTo configure the Docker client to trust the root CA, request the `.crt` file of\nthe root CA from your organization administrator, and copy the organization root\nCA to: \n\n /etc/docker/certs.d/\u003cvar translate=\"no\"\u003eHARBOR_INSTANCE_URL\u003c/var\u003e/ca.crt\n\nReplace \u003cvar translate=\"no\"\u003eHARBOR_INSTANCE_URL\u003c/var\u003e with the URL of your Harbor instance. For\nexample, `harbor-1.org-1.zone1.google.gdc.test`.\n\nThis command allows your Docker client to establish a HTTPS connection with the Harbor\ninstance.\n\nAlternatively, use the gdcloud CLI to sign in to any user cluster in the organization,\nand copy the web CA saved in the cluster: \n\n export REGISTRY=\u003cvar translate=\"no\"\u003eHARBOR_INSTANCE_URL\u003c/var\u003e\n mkdir -p /etc/docker/certs.d/${REGISTRY} && \\echo $(kubectl get secret org-web-ca -n istio-system -o\n jsonpath='{.data.ca\\.crt}') | openssl base64 -A -d \u003e\n /etc/docker/certs.d/${REGISTRY}/ca.crt\n\nReplace \u003cvar translate=\"no\"\u003eHARBOR_INSTANCE_URL\u003c/var\u003e with the URL of your Harbor instance. For\nexample, `harbor-1.org-1.zone1.google.gdc.test`.\n\nIf the configuration is unsuccessful, you see the following error message: \n\n Error response from daemon: Get \"https://\u003cHARBOR_INSTANCE_URL\u003e\": x509: certificate signed by unknown authority\n\nRepeat the steps to solve this issue, and escalate to GDC engineering if\nnecessary."]]
