Does skopeo support local docker registry?

[gouyang]

[root@localhost ~]# docker tag docker.io/busybox localhost:5000/skopeo/busybox
[root@localhost ~]# docker push localhost:5000/skopeo/busybox
The push refers to a repository [localhost:5000/skopeo/busybox]
0271b8eebde3: Pushed 
latest: digest: sha256:91ef6c1c52b166be02645b8efee30d1ee65362024f7da41c404681561734c465 size: 527

[root@localhost ~]# skopeo copy docker-daemon:docker.io/busybox:latest docker://localhost:5000/skopeo/busybox
Getting image source signatures
FATA[0000] Error checking for blob sha256:0271b8eebde3fa9a6126b1f2335e170f902731ab4942f9f1914e77016540c7bb at destination: pinging docker registry returned: Get https://localhost:5000/v2/: http: server gave HTTP response to HTTPS client 

[giuseppe]

do you need --dest-tls-verify=false?

[mtrmac]

Yes, please verify whether --dest-tls-verify=false works.

It might be the right think for skopeo, or c/image, to use c/image/pkg/sysregistries by default—but first we need to know that this is indeed the difference.

[gouyang]

# skopeo copy --dest-tls-verify=false docker-daemon:docker.io/busybox:latest docker://localhost:5000/skopeo/busybox
Getting image source signatures
Copying blob sha256:0271b8eebde3fa9a6126b1f2335e170f902731ab4942f9f1914e77016540c7bb
 1.28 MB / 1.28 MB [========================================================] 0s
Copying config sha256:6ad733544a6317992a6fac4eb19fe1df577d4dec7529efec28a5bd0edad0fd30
 1.46 KB / 1.46 KB [========================================================] 0s
Writing manifest to image destination
Storing signatures

It works.

[mtrmac]

@baude Do you think containers/image should automatically use c/image/pkg/sysregistries to configure insecure registries?

[duritong]

I think this would make sense and then it could still be overwritten by cli-flags.

[akram]

The answer 👍
skopeo copy --dest-tls-verify=false docker-daemon:docker.io/busybox:latest docker://localhost:5000/skopeo/busybox

works great, maybe you can close the issue

[HectorB-2020]

Hello @giuseppe and @mtrmac!
I guess this command line parameter has been changed to --tls-verify=false.
At least it aided me in overcoming the well-known registry error 'http: server gave HTTP response to HTTPS client' while dealing with local registry:2.

At the same time the help page is not obvious

--tls-verify          require HTTPS and verify certificates when talking to the container registry or daemon

Probably it makes sense to add something (default: true).
What would you say?

[HectorB-2020]

My bad, I beg you pardon. Different commands have different parameters indeed.
It is --tls-verify for inspect but --src-tls-verify and --dest-tls-verify for copy.
Still in my view it makes sense to add something like (default: true) to all the help pages.

[mtrmac]

@HectorB-2020 The default is not actually specifically true, the default depends on registries.conf settings from that registry. The man page does say that (somewhat…); it doesn’t fit well into --help.

[HectorB-2020]

I see, thanks very much!