crictl exec and dockershim only work with synchronous execution

[vrothberg]

crictl exec only works with dockershim.sock as an endpoint when the --sync flag is passed to execute the command synchronously. Otherwise, we receive the following error:

execing command in container failed: error sending request: Post http://127.0.0.1:10250/cri/exec/bhY76ttV: malformed HTTP response "\x15\x03\x01\x00\x02\x02\x16"

• kubelet version: Kubernetes v1.9.6
• crictl version: 1.0.0-alpha.0
• Docker version: 17.09.1-ce

Notice: we experience no issues with CRI-O.

[feiskyer]

@vrothberg Just tested with kubelet v1.9.6 and crictl 1.0.0-alpha.0 (downloaded from their releases page), both exec -s and exec -i -t work ok. Could you explain how do you set your environments?

[feiskyer]

By the way, I'm using docker v1.13.1

[Random-Liu]

@vrothberg This is a known issue in dockershim. We are discussing about a solution at kubernetes/kubernetes#36666 (comment).

We are going to address this in Kubernetes 1.11.

[feiskyer]

@Random-Liu @vrothberg Are you referring running kubelet without --experimental-dockershim? Then it won't work.

crictl only talks to http://127.0.0.1:10250 now and kubelet's dockershim serves at https with authz.

[vrothberg]

Thanks a lot, @feiskyer @Random-Liu, for the info. As it seems to be an issue in dockershim, feel free to close this issue.

[vrothberg]

@Random-Liu We're also facing issues with interactive execution. For instance, crictl exec -i -t ID /bin/sh does not work and seemingly "hangs".

Is there any chance, the fixes get backported to K8s 1.10?

[feiskyer]

Fixed in kubernetes/kubernetes#64006, which should be included in v1.11.

@Random-Liu Do you have any plan of porting this to v1.10?

[Random-Liu]

I don't think we can port it to 1.10. The fix is huge, and it is a new feature.

[vrothberg]

Closing as this issue has been fixed in the meantime.