INFO：The nerdctl command does not support Containerd proxy configuration

[skycyan]

The ctr and nerdctl commands are not compatible with the containerd proxy configuration. Currently only the crictl command is supported.

CentOS 7.9
containerd 1.5.7

# cat /usr/lib/systemd/system/containerd.service.d/proxy.conf 
[Service]
Environment="HTTPS_PROXY=http://<IP>:<port>"

# systemctl status containerd.service 
● containerd.service - containerd container runtime
   Loaded: loaded (/usr/lib/systemd/system/containerd.service; enabled; vendor preset: disabled)
  Drop-In: /usr/lib/systemd/system/containerd.service.d           
           └─proxy.conf               ######### The proxy file has been loaded, but it does not take effect

#### Execution failed
# nerdctl --namespace k8s.io pull k8s.gcr.io/kube-apiserver:v1.22.3
k8s.gcr.io/kube-apiserver:v1.22.3: resolving      |--------------------------------------| 
elapsed: 2.9 s                     total:   0.0 B (0.0 B/s)                                         
INFO[0003] trying next host                              error="failed to do request: Head \"https://k8s.gcr.io/v2/kube-apiserver/manifests/v1.22.3\": dial tcp 142.251.8.82:443: connect: connection timed out" host=k8s.gcr.io
FATA[0003] failed to resolve reference "k8s.gcr.io/kube-apiserver:v1.22.3": failed to do request: Head "https://k8s.gcr.io/v2/kube-apiserver/manifests/v1.22.3": dial tcp 142.251.8.82:443: connect: connection timed out



#### Execution failed
# ctr images pull k8s.gcr.io/kube-apiserver:v1.22.3
k8s.gcr.io/kube-apiserver:v1.22.3: resolving      |--------------------------------------| 
elapsed: 2.9 s                     total:   0.0 B (0.0 B/s)                                         
INFO[0003] trying next host                              error="failed to do request: Head \"https://k8s.gcr.io/v2/kube-apiserver/manifests/v1.22.3\": dial tcp 142.251.8.82:443: connect: connection timed out" host=k8s.gcr.io
ctr: failed to resolve reference "k8s.gcr.io/kube-apiserver:v1.22.3": failed to do request: Head "https://k8s.gcr.io/v2/kube-apiserver/manifests/v1.22.3": dial tcp 142.251.8.82:443: connect: connection timed out


#### Execution succeed
# crictl --debug pull k8s.gcr.io/kube-apiserver:v1.22.3
DEBU[0000] get image connection                         
DEBU[0000] connect using endpoint 'unix:///run/containerd/containerd.sock' with '10s' timeout 
DEBU[0000] connected successfully using endpoint: unix:///run/containerd/containerd.sock 
DEBU[0000] PullImageRequest: &PullImageRequest{Image:&ImageSpec{Image:k8s.gcr.io/kube-apiserver:v1.22.3,Annotations:map[string]string{},},Auth:nil,SandboxConfig:nil,} 
DEBU[0073] PullImageResponse: &PullImageResponse{ImageRef:sha256:53224b502ea4de7925ca5ed3d8a43dd4b500b2e8e4872bf9daea1fc3fec05edc,} 
Image is up to date for sha256:53224b502ea4de7925ca5ed3d8a43dd4b500b2e8e4872bf9daea1fc3fec05edc

[AkihiroSuda]

Because pulling happens on the client side, not on the daemon side.

Please try setting the env var for nerdctl, not just for containerd.