How to pull image from private registry?

[hillbun]

I config config.toml.tmpl adding

[plugins.cri.registry.mirrors]
[plugins.cri.registry.mirrors."docker.xxx.cn"]
endpoint = ["http://docker.xxx.cn:5000"]

[plugins.cri.registry.configs."docker.xxx.cn".auth]
username = "xxxx"
password = "xxxxxxx"

when I pull

crictl pull docker.xxx.cn:5000/maxfaith/miop_ui:development

error returned:

FATA[2019-10-30T14:23:39.122757012+08:00] pulling image failed: rpc error: code = Unknown desc = failed to pull and unpack image "docker.xxx.cn:5000/maxfaith/miop_ui:development": failed to resolve reference "docker.xxx.cn:5000/maxfaith/miop_ui:development": failed to do request: Head https://docker.xxx.cn:5000/v2/maxfaith/miop_ui/manifests/development: x509: certificate has expired or is not yet valid

[AkihiroSuda]

You need to set up certs: https://github.com/containerd/cri/blob/master/docs/registry.md#configure-registry-tls-communication

Also make sure the certs are not expired.

[hillbun]

@AkihiroSuda

My private registry is insecure.

any similar configureation in docker to solve this problem?
"insecure-registries": ["docker.xxx.cn:5000"]

[fuweid]

Hi @hillbun please check the doc https://github.com/containerd/cri/blob/master/docs/registry.md#configure-registry-endpoint hope it can help you

[hillbun]

@fuweid

yes, I try this but failed

[plugins.cri.registry.mirrors]
[plugins.cri.registry.mirrors."docker.xxx.cn"]
endpoint = ["http://docker.xxx.cn:5000"]

[fuweid]

@hillbun I think you should add port, like [plugins.cri.registry.mirrors."docker.xxx.cn:5000"]

[hillbun]

@fuweid

[plugins.cri.registry.mirrors]
[plugins.cri.registry.mirrors."docker.xxx.cn:5000"]
endpoint = ["http://docker.xxx.cn:5000"]

[plugins.cri.registry.configs."docker.xxx.cn:5000".auth]
username = "myusername"
password = "mypassword"

crictl pull docker.xxx.cn:5000/maxfaith/miop_ui:development
FATA[2019-11-07T15:29:08.826492009+08:00] pulling image failed: rpc error: code = Unknown desc = failed to pull and unpack image "docker.xxx.cn:5000/maxfaith/miop_ui:development": failed to resolve reference "docker.xxx.cn:5000/maxfaith/miop_ui:development": failed to do request: Head http://docker.xxx.cn:5000/v2/maxfaith/miop_ui/manifests/development: net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x01\x00\x02\x02"

the errir occupied

[fuweid]

@hillbun I think it is not related to containerd side. maybe you didn't make proxy_pass or something right in nginx? please make sure your registry setting is correct.

[hillbun]

@fuweid

docker login with myusername and mypassword is correct.
and docker pull docker.xxx.cn:5000/maxfaith/miop_ui:development is correct

[fuweid]

@hillbun I still think it is configuration issue.

could you share your containerd configuration? and use ctr --debug image pull -u {username}:{password} --plain-http docker.xxx.cn:5000/maxfaith/miop_ui:development to check it?

Thanks

[hillbun]

@fuweid

[plugins.cri.registry.mirrors]
[plugins.cri.registry.mirrors."docker.xxx.cn:5000"]
endpoint = ["http://docker.xxx.cn:5000"]

[plugins.cri.registry.configs."docker.xxx:5000".auth]
username = "xxxxxx"
password = "xxxxxxxx"

[hillbun]

@fuweid

DEBU[2019-11-08T10:42:10.053415944+08:00] ListImagesRequest: &ListImagesRequest{Filter:&ImageFilter{Image:&ImageSpec{Image:pull,},},}
DEBU[2019-11-08T10:42:10.055152624+08:00] ListImagesResponse: &ListImagesResponse{Images:[]*Image{&Image{Id:sha256:897ce3c5fc8ff8b1ad4fe1e74f725a0942e8e1dad0ee09096cfa7320da889a53,RepoTags:[docker.io/rancher/klipper-lb:v0.1.2],RepoDigests:[docker.io/rancher/klipper-lb@sha256:2fb97818f5d64096d635bc72501a6cb2c8b88d5d16bc031cf71b5b6460925e4a],Size_:2708293,Uid:nil,Username:,},&Image{Id:sha256:9d12f9848b99f4e5f5271b7cac02790de44ec12014762a83987cfff7f3c26106,RepoTags:[docker.io/rancher/local-path-provisioner:v0.0.11],RepoDigests:[docker.io/rancher/local-path-provisioner@sha256:0d60b97b101e432606035ab955c623604493e8956484af1cfa207753329bdf81],Size_:11999785,Uid:nil,Username:,},&Image{Id:sha256:da86e6ba6ca197bf6bc5e9d900febd906b133eaa4750e6bed647b0fbe50ed43e,RepoTags:[k8s.gcr.io/pause:3.1],RepoDigests:[k8s.gcr.io/pause@sha256:f78411e19d84a252e53bff71a4407a5686c46983a2c2eeed83929b888179acea],Size_:317164,Uid:nil,Username:,},&Image{Id:sha256:c4d3d16fe508ba08cc2dc9facfb44b88e0bf8ef5fa4fd09be1ac3a4692b3731e,RepoTags:[docker.io/coredns/coredns:1.6.3],RepoDigests:[docker.io/coredns/coredns@sha256:cfa7236dab4e3860881fdf755880ff8361e42f6cba2e3775ae48e2d46d22f7ba],Size_:14191001,Uid:nil,Username:,},&Image{Id:sha256:f12ee21b2b87282bdadd113b93cceb19b03f92f21978986c5e3ff4c4ce705d54,RepoTags:[docker.io/library/traefik:1.7.14],RepoDigests:[docker.io/library/traefik@sha256:e1e1b1dadfaab6d64f420f4352356e98e289fc7c8bf9f47387866f221c60e4e6],Size_:23626773,Uid:nil,Username:,},&Image{Id:sha256:c1e4f72eb676092165853936c755340653c951c78074ae3b9c6d4dde46095ce4,RepoTags:[docker.io/rancher/klipper-helm:v0.1.5],RepoDigests:[docker.io/rancher/klipper-helm@sha256:72690de1ae2259a41075e87ff453936a74e0f2dbf2ad1dd96a4f72136a48038d],Size_:27089525,Uid:nil,Username:,},},}
IMAGE TAG IMAGE ID SIZE
docker.io/coredns/coredns 1.6.3 c4d3d16fe508b 14.2MB
docker.io/library/traefik 1.7.14 f12ee21b2b872 23.6MB
docker.io/rancher/klipper-helm v0.1.5 c1e4f72eb6760 27.1MB
docker.io/rancher/klipper-lb v0.1.2 897ce3c5fc8ff 2.71MB
docker.io/rancher/local-path-provisioner v0.0.11 9d12f9848b99f 12MB
k8s.gcr.io/pause 3.1 da86e6ba6ca19 317kB

[fuweid]

@hillbun ctr command is ok for you?

[hillbun]

ctr --debug image pull -u xxx:xxxx --plain-http docker.xxx.cn:5000/maxfaith/miop_ui:development
DEBU[0000] fetching image="docker.xxx.cn:5000/maxfaith/miop_ui:development"
DEBU[0000] resolving
DEBU[0000] do request request.headers=map[Accept:[application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, *]] request.method=HEAD url="http://docker.xxx.cn:5000/v2/maxfaith/miop_ui/manifests/development"
ctr: failed to resolve reference "docker.xxx.cn:5000/maxfaith/miop_ui:development": failed to do request: Head http://docker.xxx.cn:5000/v2/maxfaith/miop_ui/manifests/development: net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x01\x00\x02\x02"

@fuweid

[fuweid]

@hillbun it is about your tls setting. I am not sure that what is your cert on server or client. docker cli can work because you set something in docker config /etc/docker/certs.d/.

please check it and I will close this issue.