EOF error when pushing Docker images to Gitea 1.24.1 registry (works fine in 1.24.0)

[thethink3r]

Description

EOF error when pushing Docker images to Gitea 1.24.1 registry (works fine in 1.24.0)

Description

When pushing Docker images to the Gitea registry on version 1.24.1, the push fails with an unexpected EOF error. The same workflow works without issues on version 1.24.0.

Steps to reproduce

1. Build Docker image with docker build
2. Log in to the Gitea registry with docker login
3. Push the image using docker push
4. Push fails with ERROR: EOF

Expected behavior

Docker image should push successfully, as it does in Gitea 1.24.0.

Actual behavior

Push is interrupted by an unexpected EOF, resulting in incomplete upload.

Environment

• Gitea version 1.24.1 (failing)
• Gitea version 1.24.0 (working)
• Docker version 28.2.2
• Local network and storage, no MTU or network issues

Please investigate and fix this regression as it breaks CI/CD workflows relying on Docker image pushes.

Gitea Version

1.24.1

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

Version 1.24.1

Version 1.24.0

Git Version

No response

Operating System

Docker Linux x86

How are you running Gitea?

Docker Compose

Database

PostgreSQL

[navanshu]

Same issue here even pushing busy Box doesn't work, tried modifying traefik

[luke-else]

+1, I have also encountered the same issues. Can't seem to track down the reasoning why, going to do a bit more investigation now.

[wxiaoguang]

The only container related change is "Fix container range bug (#34725) (#34732)".

In theory it should fix some incorrect behaviors and fixed some problems reported by users.

[hiifong]

Please paste your nginx configurations

[thethink3r]

Tested NGINX Config (works for 1.24.0 )

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

Tried for v1.24.1 (dosent work)

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 0; # and tried client_max_body_size 512m to
proxy_read_timeout 600;
proxy_connect_timeout 600;
proxy_send_timeout 600;
send_timeout 600;

Do these snippets cover what's needed, or do you require the full NGINX server configuration block? (i use nginx proxy manager)

[Bevolus]

I have the same issues, already tried several changes to traefik. For testing, I also have set up a separate container registry, with the same traefik settings, which works fine.

[luke-else]

Traefik Config

Traefik

version: "3.8"
services:
  traefik:
    image: "traefik:latest"
    container_name: "traefik"
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.kafka.address=:9093"
      - "--entrypoints.mongo.address=:27017"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=contact@luke-else.co.uk"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
      - "27017:27017"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - proxy
    labels:
      - "traefik.enable=true"

      - "traefik.http.middlewares.redirect-web-secure.redirectscheme.scheme=https"
      - "traefik.http.routers.traefik-insecure.middlewares=redirect-web-secure"
      - "traefik.http.routers.traefik-insecure.rule=Host(`traefik.luke-else.co.uk`)"
      - "traefik.http.routers.traefik-insecure.entrypoints=web"

      - "traefik.http.routers.traefik.rule=Host(`traefik.luke-else.co.uk`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.tls.certresolver=myresolver" 
      - "traefik.http.routers.traefik.middlewares=traefik-auth"

    restart: unless-stopped

networks:
  proxy:
    name: proxy

And then exposing gitea through that proxy with the config below:

version: '3.8'

services:
  #gitea (222)
  gitea:
    image: gitea/gitea:latest
    container_name: gitea
    volumes:
      - ./gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      - proxy
    ports:
      - "222:22"
    environment:
      - APP_NAME="gitea"
      - USER_UID=1000
      - USER_GID=1000
      - USER=git
      - RUN_MODE=prod
      - DOMAIN=git.luke-else.co.uk
      - SSH_DOMAIN=git.luke-else.co.uk
      - HTTP_PORT=3000
      - ROOT_URL=https://git.luke-else.co.uk
      - SSH_PORT=222
      - SSH_LISTEN_PORT=22
      - DB_TYPE=sqlite3
      - GITEA_service_DISABLE_REGISTRATION=true
      - GITEA_server_LANDING_PAGE=/luke-else
    labels:
      ## Expose Gitea Through Trefik ##
      - "traefik.enable=true" # <== Enable traefik to proxy this container

      - "traefik.http.middlewares.redirect-web-secure.redirectscheme.scheme=https"
      - "traefik.http.routers.gitea-insecure.middlewares=redirect-web-secure"
      - "traefik.http.routers.gitea-insecure.rule=Host(`git.luke-else.co.uk`)"
      - "traefik.http.routers.gitea-insecure.entrypoints=web"

      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
      - "traefik.http.routers.gitea.rule=Host(`git.luke-else.co.uk`)"
      - "traefik.http.routers.gitea.entrypoints=websecure"
      - "traefik.http.routers.gitea.tls.certresolver=myresolver"
      - "traefik.http.routers.gitea.middlewares=cors-gitea"
    restart: unless-stopped

networks:
  proxy:
    external: true

[wxiaoguang]

Same issue here even pushing busy Box doesn't work, tried modifying traefik

IMO it's not related to reverse proxy. "even pushing busy Box doesn't work" do you have reproducible steps? I need to reproduce it on my side.

[thethink3r]

Steps to Reproduce

docker login <your-gitea-domain>/<user>/<repo>
docker pull busybox:latest
docker tag busybox:latest <your-gitea-domain>/<user>/<repo>/busybox:test
docker push <your-gitea-domain>/<user>/<repo>/busybox:test

[wxiaoguang]

Really strange ....

[luke-else]

I found it particularly to be on layers which do not already exist

Really strange ....

So in my case, when part of the image being built has changed, when pushing that it fails.

[thethink3r]

it does not matter if the image already exists on the server

[wxiaoguang]

Sorry for the inconvenience, it's still unclear to me how to reproduce or test .....

Are you able to build you own instance? If yes, could you try to revert some part of "Fix container range bug (#34725) (#34732)" to see which change caused the EOF?

Or, could you try the main nightly (1.25) https://hub.docker.com/r/gitea/gitea/tags?name=nightly ? It contains more container related fixes.