unable to use build --pull with private insecure-registries

[nlg521]

dockefile

# syntax = docker/dockerfile:1.0-experimental
FROM  registry-local.com/library/busybox:latest as build

when use
DOCKER_BUILDKIT=1 docker build .
error

$ docker build . -f Dockerfile1
[+] Building 1.7s (8/8) FINISHED                                                                                                                                                 
 => [internal] load .dockerignore                                                                                                                                           0.0s
 => => transferring context: 2B                                                                                                                                             0.0s
 => [internal] load build definition from Dockerfile                                                                                                               0.0s
 => => transferring dockerfile: 164B                                                                                                                                        0.0s
 => resolve image config for docker.io/docker/dockerfile:1.0-experimental                                                                                                   1.0s
 => CACHED docker-image://docker.io/docker/dockerfile:1.0-experimental@sha256:cbd6491240cc8894d25e366ba83da19df1187f975dc3a5c2f88ce888ca696174                              0.0s
 => [internal] load build definition from Dockerfile1                                                                                                                       0.0s
 => => transferring dockerfile: 164B                                                                                                                                        0.0s
 => [internal] load .dockerignore                                                                                                                                           0.0s
 => ERROR [internal] load metadata for registry-local.com/library/busybox:latest                                                                                                 0.0s
 => ERROR [1/1] FROM  registry-local.com/library/busybox:latest                                                                                                                   0.0s
 => => resolve registry-local.com/library/busybox:latest                                                                                                                         0.0s
------
 > [internal] load metadata for registry-local.com/library/busybox:latest:
------
------
 > [1/1] FROM registry-local.com/library/busybox:latest:
------
failed to solve with frontend dockerfile.v0: failed to solve with frontend gateway.v0: rpc error: code = Unknown desc = failed to build LLB: failed to load cache key: failed to do request: Head https://registry-local.com/v2/library/busybox/manifests/latest: Service Unavailable
 

if I remove # syntax=docker/dockerfile:experimental or do not use the buildkit it works fine ie. DOCKER_BUILDKIT=0 docker build .

also, if i manually pull the image with docker pullharbor.abc.com/library/busybox:latest , and then run the build as DOCKER_BUILDKIT=1 docker build . it works correctly

docker --version
Docker version 19.03.5, build 633a0ea 

$ docker version
Client: Docker Engine - Community
 Version:           19.03.5
 API version:       1.40
 Go version:        go1.12.12
 Git commit:        633a0ea
 Built:             Wed Nov 13 07:22:34 2019
 OS/Arch:           darwin/amd64
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          19.03.5
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.12.12
  Git commit:       633a0ea
  Built:            Wed Nov 13 07:29:19 2019
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          v1.2.10
  GitCommit:        b34a5c8af56e510852c35414db4c1f4fa6172339
 runc:
  Version:          1.0.0-rc8+dev
  GitCommit:        3e425f80a8c931f88e6d94a8c831b9d5aa481657
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

 cat ~/.docker/config.json
{
	"auths": {
	  "registry-local.com": {
	    "auth": "base 64 "
           }
        },
	"HttpHeaders": {
		"User-Agent": "Docker-Client/19.03.5 (darwin)"
	},
	"credsStore": "desktop",
	"experimental": "enabled",
	"stackOrchestrator": "swarm"
}

cat ~/.docker/daemon.json
{
  "insecure-registries" : [
    "registry-local.com"
  ],
  "debug" : true,
  "experimental" : true
}

[tonistiigi]

Not enough info to understand what registry configuration you are actually using. If this was custom tls or insecure self signed tls then support for that was added in #1410 moby/moby#40814