一、故障环境
系统：Ubuntu（默认使用AppArmor，非SELinux）
Harbor版本：v2.13.1
部署方式：Docker Compose
数据存储目录：
/opt/mirror/.harbor_data
二、初始故障现象
1. 容器状态异常
harbor-db（数据库）、redis 容器持续 Unhealthy，其余组件正常健康。
2. Redis 日志报错
核心报错：Permission denied
保存RDB持久化文件失败：
Failed opening the temp RDB file temp-1.rdb for saving: Permission denied启动写入PID文件失败：
Failed to write PID file: Permission denied容器关闭时无法正常落盘数据，反复异常重启
3. PostgreSQL 数据库日志报错
核心报错：initdb: error: could not create directory "/var/lib/postgresql/data/pg15": Permission denied
数据库初始化时，无法在挂载目录创建pg15数据目录，数据库启动失败、健康检查失败。
三、故障根因分析（核心4点）
1. 全局挂载存在 SELinux 专属 :z 标签（Ubuntu 致命问题）
:z 是SELinux安全上下文标签，仅适用于CentOS/RHEL系统。Ubuntu使用AppArmor，挂载目录加 :z 会触发seccomp拦截，导致容器内非root进程读写目录权限被拦截，产生间歇性权限拒绝。
原始配置中所有服务（log、registry、core、jobservice、proxy、postgresql）挂载卷均带多余 :z 标记。
2. PostgreSQL 缺少 Linux 权限能力 FOWNER
原postgresql配置仅添加 CHOWN、DAC_OVERRIDE、SETGID、SETUID 权限，缺失 FOWNER。
数据库initdb初始化时需要无视文件原有属主、修改目录权限，无FOWNER能力会导致目录创建、权限变更失败。
3. 数据目录宿主UID与容器运行用户不匹配
Harbor-db容器内postgres进程UID=999
宿主机database目录默认属主为10000:10000（Harbor核心组件用户）
UID不匹配，即便放开容器权限，依旧无法读写目录
4. 目录残留旧权限文件
历史部署残留的数据库、缓存文件属主混乱，仅修改外层目录权限无法生效，持续报权限错误。
四、完整修复方案（最终生效配置+操作）
1. 配置文件整改（docker-compose.yml 最终正确版本）
核心修改点：
✅ 移除所有挂载卷末尾的 :z 标签（全服务适配Ubuntu AppArmor）
✅ postgresql新增
FOWNER权限能力✅ 保留privileged: true注释兜底，异常时可开启特权模式
✅ redis配置保持纯净，无多余权限、标签
最终完整可用配置：
services:
log:
image: goharbor/harbor-log:v2.13.1
container_name: harbor-log
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- DAC_OVERRIDE
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_log/:/var/log/docker/
- type: bind
source: ./common/config/log/logrotate.conf
target: /etc/logrotate.d/logrotate.conf
- type: bind
source: ./common/config/log/rsyslog_docker.conf
target: /etc/rsyslog.d/rsyslog_docker.conf
ports:
- 127.0.0.1:1514:10514
networks:
- harbor
registry:
image: goharbor/registry-photon:v2.13.1
container_name: registry
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/registry:/storage
- ./common/config/registry/:/etc/registry/
- type: bind
source: /opt/mirror/.harbor_data/secret/registry/root.crt
target: /etc/registry/root.crt
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "registry"
registryctl:
image: goharbor/harbor-registryctl:v2.13.1
container_name: registryctl
env_file:
- ./common/config/registryctl/env
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/registry:/storage
- ./common/config/registry/:/etc/registry/
- type: bind
source: ./common/config/registryctl/config.yml
target: /etc/registryctl/config.yml
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "registryctl"
postgresql:
image: goharbor/harbor-db:v2.13.1
container_name: harbor-db
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- DAC_OVERRIDE
- SETGID
- SETUID
- FOWNER
# privileged: true # 兜底选项，数据库依然报Permission denied时，取消注释启用
volumes:
- /opt/mirror/.harbor_data/database:/var/lib/postgresql/data
networks:
harbor:
env_file:
- ./common/config/db/env
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "postgresql"
shm_size: '1gb'
core:
image: goharbor/harbor-core:v2.13.1
container_name: harbor-core
env_file:
- ./common/config/core/env
restart: always
cap_drop:
- ALL
cap_add:
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/ca_download/:/etc/core/ca/
- /opt/mirror/.harbor_data/:/data/
- ./common/config/core/certificates/:/etc/core/certificates/
- type: bind
source: ./common/config/core/app.conf
target: /etc/core/app.conf
- type: bind
source: /opt/mirror/.harbor_data/secret/core/private_key.pem
target: /etc/core/private_key.pem
- type: bind
source: /opt/mirror/.harbor_data/secret/keys/secretkey
target: /etc/core/key
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
harbor:
depends_on:
- log
- registry
- redis
- postgresql
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "core"
portal:
image: goharbor/harbor-portal:v2.13.1
container_name: harbor-portal
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
- NET_BIND_SERVICE
volumes:
- type: bind
source: ./common/config/portal/nginx.conf
target: /etc/nginx/nginx.conf
networks:
- harbor
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "portal"
jobservice:
image: goharbor/harbor-jobservice:v2.13.1
container_name: harbor-jobservice
env_file:
- ./common/config/jobservice/env
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/job_logs:/var/log/jobs
- type: bind
source: ./common/config/jobservice/config.yml
target: /etc/jobservice/config.yml
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
depends_on:
- core
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "jobservice"
redis:
image: goharbor/redis-photon:v2.13.1
container_name: redis
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/redis:/var/lib/redis
networks:
harbor:
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "redis"
proxy:
image: goharbor/nginx-photon:v2.13.1
container_name: nginx
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
- NET_BIND_SERVICE
volumes:
- ./common/config/nginx:/etc/nginx
- /opt/mirror/.harbor_data/secret/cert:/etc/cert
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
ports:
- 8080:8080
- 8443:8443
depends_on:
- registry
- core
- portal
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "proxy"
networks:
harbor:
external: false2. 目录权限彻底修复命令
# 停止所有Harbor容器
cd /home/shitou/harbor
sudo docker compose down
# 清空数据库旧残留文件，避免权限遗留问题
sudo rm -rf /opt/mirror/.harbor_data/database/*
# 修正数据库目录属主为postgres容器UID 999:999
sudo chown -R 999:999 /opt/mirror/.harbor_data/database
sudo chmod 700 /opt/mirror/.harbor_data/database
# 重启服务
sudo docker compose up -d五、修复验证结果
1. 容器状态
所有Harbor容器全部 Up (healthy)，无异常重启、无unhealthy状态。
2. 数据库日志正常
最终关键正常输出：database system is ready to accept connections，数据库初始化完成，正常提供服务。
3. Redis服务正常
无权限拒绝报错，可正常读写、持久化数据，健康检查通过。
六、Ubuntu部署Harbor关键避坑总结（永久适用）
Ubuntu绝对禁止挂载卷加 :z/:Z 标签，仅CentOS SELinux环境需要，Ubuntu会触发权限拦截
PostgreSQL容器必须添加 FOWNER 权限，否则initdb初始化必然权限失败
严格区分Harbor组件UID：数据库999、核心服务10000，对应目录必须匹配对应属主
权限报错优先清空旧数据残留、修正目录UID，其次再开启privileged特权兜底
首先登陆服务器，查看服务状态
shitou@shitou:~$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1e5dd6b85bb5 goharbor/nginx-photon:v2.13.1 "nginx -g 'daemon of…" 2 days ago Up 2 days (healthy) 0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp, 0.0.0.0:8443->8443/tcp, [::]:8443->8443/tcp nginx
836fe7df3cf7 goharbor/harbor-jobservice:v2.13.1 "/harbor/entrypoint.…" 2 days ago Up 2 days (healthy) harbor-jobservice
8922b9fd2e50 goharbor/harbor-registryctl:v2.13.1 "/home/harbor/start.…" 2 days ago Up 2 days (healthy) registryctl
2af60904b4e7 goharbor/harbor-core:v2.13.1 "/harbor/entrypoint.…" 2 days ago Up 2 days (healthy) harbor-core
3131ad00a95f goharbor/harbor-portal:v2.13.1 "nginx -g 'daemon of…" 2 days ago Up 2 days (healthy) harbor-portal
b420ccb819dd goharbor/registry-photon:v2.13.1 "/home/harbor/entryp…" 9 days ago Up 2 days (healthy) registry
fa2d3447743a goharbor/redis-photon:v2.13.1 "redis-server /etc/r…" 9 days ago Up 2 days (unhealthy) redis
e9dc6f9436a7 goharbor/harbor-db:v2.13.1 "/docker-entrypoint.…" 9 days ago Up 2 days (unhealthy) harbor-db
00678e20adb1 goharbor/harbor-log:v2.13.1 "/bin/sh -c /usr/loc…" 9 days ago Up 2 days (healthy) 127.0.0.1:1514->10514/tcp harbor-log
64f4bbc41364 blinkospace/blinko:latest "docker-entrypoint.s…" 20 months ago Up 2 days (unhealthy) 0.0.0.0:2600->1111/tcp, [::]:2600->1111/tcp blinko-website
bfabae2cca70 postgres:latest "docker-entrypoint.s…" 20 months ago Up 2 days (healthy) 0.0.0.0:5435->5432/tcp, [::]:5435->5432/tcp blinko-postgres
查看日志报错
shitou@shitou:~$ sudo tail -n 50 /var/log/harbor/redis.log
[sudo] password for shitou:
Aug 7 14:03:54 172.18.0.1 redis[1430]: |`-._`-...-` __...-.``-._|'` _.-'| Port: 6379
Aug 7 14:03:54 172.18.0.1 redis[1430]: | `-._ `._ / _.-' | PID: 1
Aug 7 14:03:54 172.18.0.1 redis[1430]: `-._ `-._ `-./ _.-' _.-'
Aug 7 14:03:54 172.18.0.1 redis[1430]: |`-._`-._ `-.__.-' _.-'_.-'|
Aug 7 14:03:54 172.18.0.1 redis[1430]: | `-._`-._ _.-'_.-' | https://redis.io
Aug 7 14:03:54 172.18.0.1 redis[1430]: `-._ `-._`-.__.-'_.-' _.-'
Aug 7 14:03:54 172.18.0.1 redis[1430]: |`-._`-._ `-.__.-' _.-'_.-'|
Aug 7 14:03:54 172.18.0.1 redis[1430]: | `-._`-._ _.-'_.-' |
Aug 7 14:03:54 172.18.0.1 redis[1430]: `-._ `-._`-.__.-'_.-' _.-'
Aug 7 14:03:54 172.18.0.1 redis[1430]: `-._ `-.__.-' _.-'
Aug 7 14:03:54 172.18.0.1 redis[1430]: `-._ _.-'
Aug 7 14:03:54 172.18.0.1 redis[1430]: `-.__.-'
Aug 7 14:03:54 172.18.0.1 redis[1430]: 1:M 07 Aug 2026 14:03:54.273 * Server initialized
Aug 7 14:03:54 172.18.0.1 redis[1430]: 1:M 07 Aug 2026 14:03:54.275 * Ready to accept connections tcp
Aug 7 18:25:54 172.18.0.1 redis[1430]: 1:signal-handler (1786127154) Received SIGTERM scheduling shutdown...
Aug 7 18:25:54 172.18.0.1 redis[1430]: 1:M 07 Aug 2026 18:25:54.549 * User requested shutdown...
Aug 7 18:25:54 172.18.0.1 redis[1430]: 1:M 07 Aug 2026 18:25:54.549 * Saving the final RDB snapshot before exiting.
Aug 7 18:25:54 172.18.0.1 redis[1430]: 1:M 07 Aug 2026 18:25:54.645 # Failed opening the temp RDB file temp-1.rdb (in server root dir /var/lib/redis) for saving: Permission denied
Aug 7 18:25:54 172.18.0.1 redis[1430]: 1:M 07 Aug 2026 18:25:54.645 # Error trying to save the DB, can't exit.
Aug 7 18:25:54 172.18.0.1 redis[1430]: 1:M 07 Aug 2026 18:25:54.645 # Errors trying to shut down the server. Check the logs for more information.
Aug 8 03:21:17 172.18.0.1 redis[393660]: 1:C 07 Aug 2026 19:21:17.338 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
Aug 8 03:21:17 172.18.0.1 redis[393660]: 1:C 07 Aug 2026 19:21:17.338 * Redis version=7.2.6, bits=64, commit=00000000, modified=0, pid=1, just started
Aug 8 03:21:17 172.18.0.1 redis[393660]: 1:C 07 Aug 2026 19:21:17.338 * Configuration loaded
Aug 8 03:21:17 172.18.0.1 redis[393660]: 1:M 07 Aug 2026 19:21:17.339 * monotonic clock: POSIX clock_gettime
Aug 8 03:21:17 172.18.0.1 redis[393660]: 1:M 07 Aug 2026 19:21:17.353 # Failed to write PID file: Permission denied
Aug 8 03:21:17 172.18.0.1 redis[393660]: _._
Aug 8 03:21:17 172.18.0.1 redis[393660]: _.-``__ ''-._
Aug 8 03:21:17 172.18.0.1 redis[393660]: _.-`` `. `_. ''-._ Redis 7.2.6 (00000000/0) 64 bit
Aug 8 03:21:17 172.18.0.1 redis[393660]: .-`` .-```. ```\/ _.,_ ''-._
Aug 8 03:21:17 172.18.0.1 redis[393660]: ( ' , .-` | `, ) Running in standalone mode
Aug 8 03:21:17 172.18.0.1 redis[393660]: |`-._`-...-` __...-.``-._|'` _.-'| Port: 6379
Aug 8 03:21:17 172.18.0.1 redis[393660]: | `-._ `._ / _.-' | PID: 1
Aug 8 03:21:17 172.18.0.1 redis[393660]: `-._ `-._ `-./ _.-' _.-'
Aug 8 03:21:17 172.18.0.1 redis[393660]: |`-._`-._ `-.__.-' _.-'_.-'|
Aug 8 03:21:17 172.18.0.1 redis[393660]: | `-._`-._ _.-'_.-' | https://redis.io
Aug 8 03:21:17 172.18.0.1 redis[393660]: `-._ `-._`-.__.-'_.-' _.-'
Aug 8 03:21:17 172.18.0.1 redis[393660]: |`-._`-._ `-.__.-' _.-'_.-'|
Aug 8 03:21:17 172.18.0.1 redis[393660]: | `-._`-._ _.-'_.-' |
Aug 8 03:21:17 172.18.0.1 redis[393660]: `-._ `-._`-.__.-'_.-' _.-'
Aug 8 03:21:17 172.18.0.1 redis[393660]: `-._ `-.__.-' _.-'
Aug 8 03:21:17 172.18.0.1 redis[393660]: `-._ _.-'
Aug 8 03:21:17 172.18.0.1 redis[393660]: `-.__.-'
Aug 8 03:21:17 172.18.0.1 redis[393660]: 1:M 07 Aug 2026 19:21:17.358 * Server initialized
Aug 8 03:21:17 172.18.0.1 redis[393660]: 1:M 07 Aug 2026 19:21:17.363 * Ready to accept connections tcp
Aug 8 03:21:48 172.18.0.1 redis[393660]: 1:signal-handler (1786130508) Received SIGTERM scheduling shutdown...
Aug 8 03:21:48 172.18.0.1 redis[393660]: 1:M 07 Aug 2026 19:21:48.983 * User requested shutdown...
Aug 8 03:21:48 172.18.0.1 redis[393660]: 1:M 07 Aug 2026 19:21:48.983 * Saving the final RDB snapshot before exiting.
Aug 8 03:21:48 172.18.0.1 redis[393660]: 1:M 07 Aug 2026 19:21:48.984 # Failed opening the temp RDB file temp-1.rdb (in server root dir /var/lib/redis) for saving: Permission denied
Aug 8 03:21:48 172.18.0.1 redis[393660]: 1:M 07 Aug 2026 19:21:48.984 # Error trying to save the DB, can't exit.
Aug 8 03:21:48 172.18.0.1 redis[393660]: 1:M 07 Aug 2026 19:21:48.985 # Errors trying to shut down the server. Check the logs for more information.
shitou@shitou:~$ sudo tail -n 50 /var/log/harbor/postgresql.log
Aug 8 03:21:23 172.18.0.1 postgresql[393660]: LC_NUMERIC: C
Aug 8 03:21:23 172.18.0.1 postgresql[393660]: LC_TIME: C
Aug 8 03:21:23 172.18.0.1 postgresql[393660]: The default text search configuration will be set to "english".
Aug 8 03:21:23 172.18.0.1 postgresql[393660]: Data page checksums are disabled.
Aug 8 03:21:23 172.18.0.1 postgresql[393660]: creating directory /var/lib/postgresql/data/pg15 ...
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: init DB, DB version:15
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: The files belonging to this database system will be owned by user "postgres".
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: This user must also own the server process.
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: initdb: error: could not create directory "/var/lib/postgresql/data/pg15": Permission denied
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: The database cluster will be initialized with this locale configuration:
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: provider: libc
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: LC_COLLATE: en_US.UTF-8
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: LC_CTYPE: en_US.UTF-8
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: LC_MESSAGES: C
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: LC_MONETARY: C
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: LC_NUMERIC: C
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: LC_TIME: C
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: The default text search configuration will be set to "english".
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: Data page checksums are disabled.
Aug 8 03:21:26 172.18.0.1 postgresql[393660]: creating directory /var/lib/postgresql/data/pg15 ...
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: init DB, DB version:15
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: The files belonging to this database system will be owned by user "postgres".
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: This user must also own the server process.
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: The database cluster will be initialized with this locale configuration:
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: provider: libc
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: LC_COLLATE: en_US.UTF-8
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: LC_CTYPE: en_US.UTF-8
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: LC_MESSAGES: C
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: LC_MONETARY: C
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: LC_NUMERIC: C
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: LC_TIME: C
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: The default text search configuration will be set to "english".
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: Data page checksums are disabled.
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: initdb: error: could not create directory "/var/lib/postgresql/data/pg15": Permission denied
Aug 8 03:21:33 172.18.0.1 postgresql[393660]: creating directory /var/lib/postgresql/data/pg15 ...
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: init DB, DB version:15
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: The files belonging to this database system will be owned by user "postgres".
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: This user must also own the server process.
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: The database cluster will be initialized with this locale configuration:
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: provider: libc
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: LC_COLLATE: en_US.UTF-8
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: LC_CTYPE: en_US.UTF-8
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: LC_MESSAGES: C
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: LC_MONETARY: C
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: LC_NUMERIC: C
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: LC_TIME: C
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: The default text search configuration will be set to "english".
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: Data page checksums are disabled.
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: initdb: error: could not create directory "/var/lib/postgresql/data/pg15": Permission denied
Aug 8 03:21:46 172.18.0.1 postgresql[393660]: creating directory /var/lib/postgresql/data/pg15 ...
shitou@shitou:~$ find / -name "harbor.yml" 2>/dev/null
/home/shitou/harbor/harbor.yml
/opt/harbor_backup/harbor.yml
shitou@shitou:~$ grep data_volume /home/shitou/harbor/harbor.yml
data_volume: /opt/mirror/.harbor_data
shitou@shitou:~$ ls -ld /opt/mirror/.harbor_data
drwxr-xr-x 9 shitou shitou 4096 Aug 8 03:33 /opt/mirror/.harbor_data
cat docker-compose.yml
services:
log:
image: goharbor/harbor-log:v2.13.1
container_name: harbor-log
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- DAC_OVERRIDE
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_log/:/var/log/docker/:z
- type: bind
source: ./common/config/log/logrotate.conf
target: /etc/logrotate.d/logrotate.conf
- type: bind
source: ./common/config/log/rsyslog_docker.conf
target: /etc/rsyslog.d/rsyslog_docker.conf
ports:
- 127.0.0.1:1514:10514
networks:
- harbor
registry:
image: goharbor/registry-photon:v2.13.1
container_name: registry
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/registry:/storage:z
- ./common/config/registry/:/etc/registry/:z
- type: bind
source: /opt/mirror/.harbor_data/secret/registry/root.crt
target: /etc/registry/root.crt
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "registry"
registryctl:
image: goharbor/harbor-registryctl:v2.13.1
container_name: registryctl
env_file:
- ./common/config/registryctl/env
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/registry:/storage:z
- ./common/config/registry/:/etc/registry/:z
- type: bind
source: ./common/config/registryctl/config.yml
target: /etc/registryctl/config.yml
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "registryctl"
postgresql:
image: goharbor/harbor-db:v2.13.1
container_name: harbor-db
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- DAC_OVERRIDE
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/database:/var/lib/postgresql/data:z
networks:
harbor:
env_file:
- ./common/config/db/env
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "postgresql"
shm_size: '1gb'
core:
image: goharbor/harbor-core:v2.13.1
container_name: harbor-core
env_file:
- ./common/config/core/env
restart: always
cap_drop:
- ALL
cap_add:
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/ca_download/:/etc/core/ca/:z
- /opt/mirror/.harbor_data/:/data/:z
- ./common/config/core/certificates/:/etc/core/certificates/:z
- type: bind
source: ./common/config/core/app.conf
target: /etc/core/app.conf
- type: bind
source: /opt/mirror/.harbor_data/secret/core/private_key.pem
target: /etc/core/private_key.pem
- type: bind
source: /opt/mirror/.harbor_data/secret/keys/secretkey
target: /etc/core/key
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
harbor:
depends_on:
- log
- registry
- redis
- postgresql
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "core"
portal:
image: goharbor/harbor-portal:v2.13.1
container_name: harbor-portal
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
- NET_BIND_SERVICE
volumes:
- type: bind
source: ./common/config/portal/nginx.conf
target: /etc/nginx/nginx.conf
networks:
- harbor
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "portal"
jobservice:
image: goharbor/harbor-jobservice:v2.13.1
container_name: harbor-jobservice
env_file:
- ./common/config/jobservice/env
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/job_logs:/var/log/jobs:z
- type: bind
source: ./common/config/jobservice/config.yml
target: /etc/jobservice/config.yml
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
depends_on:
- core
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "jobservice"
redis:
image: goharbor/redis-photon:v2.13.1
container_name: redis
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/redis:/var/lib/redis
networks:
harbor:
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "redis"
proxy:
image: goharbor/nginx-photon:v2.13.1
container_name: nginx
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
- NET_BIND_SERVICE
volumes:
- ./common/config/nginx:/etc/nginx:z
- /opt/mirror/.harbor_data/secret/cert:/etc/cert:z
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
ports:
- 8080:8080
- 8443:8443
depends_on:
- registry
- core
- portal
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "proxy"
networks:
harbor:
external: false
services:
log:
image: goharbor/harbor-log:v2.13.1
container_name: harbor-log
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- DAC_OVERRIDE
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_log/:/var/log/docker/
- type: bind
source: ./common/config/log/logrotate.conf
target: /etc/logrotate.d/logrotate.conf
- type: bind
source: ./common/config/log/rsyslog_docker.conf
target: /etc/rsyslog.d/rsyslog_docker.conf
ports:
- 127.0.0.1:1514:10514
networks:
- harbor
registry:
image: goharbor/registry-photon:v2.13.1
container_name: registry
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/registry:/storage
- ./common/config/registry/:/etc/registry/
- type: bind
source: /opt/mirror/.harbor_data/secret/registry/root.crt
target: /etc/registry/root.crt
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "registry"
registryctl:
image: goharbor/harbor-registryctl:v2.13.1
container_name: registryctl
env_file:
- ./common/config/registryctl/env
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/registry:/storage
- ./common/config/registry/:/etc/registry/
- type: bind
source: ./common/config/registryctl/config.yml
target: /etc/registryctl/config.yml
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "registryctl"
postgresql:
image: goharbor/harbor-db:v2.13.1
container_name: harbor-db
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- DAC_OVERRIDE
- SETGID
- SETUID
- FOWNER
# privileged: true # 兜底选项，数据库依然报Permission denied时，取消注释启用
volumes:
- /opt/mirror/.harbor_data/database:/var/lib/postgresql/data
networks:
harbor:
env_file:
- ./common/config/db/env
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "postgresql"
shm_size: '1gb'
core:
image: goharbor/harbor-core:v2.13.1
container_name: harbor-core
env_file:
- ./common/config/core/env
restart: always
cap_drop:
- ALL
cap_add:
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/ca_download/:/etc/core/ca/
- /opt/mirror/.harbor_data/:/data/
- ./common/config/core/certificates/:/etc/core/certificates/
- type: bind
source: ./common/config/core/app.conf
target: /etc/core/app.conf
- type: bind
source: /opt/mirror/.harbor_data/secret/core/private_key.pem
target: /etc/core/private_key.pem
- type: bind
source: /opt/mirror/.harbor_data/secret/keys/secretkey
target: /etc/core/key
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
harbor:
depends_on:
- log
- registry
- redis
- postgresql
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "core"
portal:
image: goharbor/harbor-portal:v2.13.1
container_name: harbor-portal
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
- NET_BIND_SERVICE
volumes:
- type: bind
source: ./common/config/portal/nginx.conf
target: /etc/nginx/nginx.conf
networks:
- harbor
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "portal"
jobservice:
image: goharbor/harbor-jobservice:v2.13.1
container_name: harbor-jobservice
env_file:
- ./common/config/jobservice/env
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/job_logs:/var/log/jobs
- type: bind
source: ./common/config/jobservice/config.yml
target: /etc/jobservice/config.yml
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
depends_on:
- core
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "jobservice"
redis:
image: goharbor/redis-photon:v2.13.1
container_name: redis
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
volumes:
- /opt/mirror/.harbor_data/redis:/var/lib/redis
networks:
harbor:
depends_on:
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "redis"
proxy:
image: goharbor/nginx-photon:v2.13.1
container_name: nginx
restart: always
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
- NET_BIND_SERVICE
volumes:
- ./common/config/nginx:/etc/nginx
- /opt/mirror/.harbor_data/secret/cert:/etc/cert
- type: bind
source: ./common/config/shared/trust-certificates
target: /harbor_cust_cert
networks:
- harbor
ports:
- 8080:8080
- 8443:8443
depends_on:
- registry
- core
- portal
- log
logging:
driver: "syslog"
options:
syslog-address: "tcp://localhost:1514"
tag: "proxy"
networks:
harbor:
external: false
===================================================================================================
原创
Harbor在Ubuntu系统权限报错完整排障修复总结
本文采用 CC BY-NC-SA 4.0 许可协议，转载请注明出处。
评论交流
欢迎留下你的想法