[v0.13] It seems that "registry.insecure=true" doesn't work. about buildkit HOT 7 OPEN

@vvoland Related to #4299 ?

from buildkit.

Hmm right, registry.insecure=true sets both "insecure https" and "http only" options which makes it use the http fallback.

However, the http only kicks-in, if the https connection fails with a TLS error. In this case the error is different (connection refused), so the connection doesn't fallback to http.

from buildkit.

The http fallback in containerd also only checks for the tls error: https://github.com/containerd/containerd/blob/536608ef227e0825c7c49d59a71a698cc8039ff5/core/remotes/docker/resolver.go#L735

cc @dmcgowan

from buildkit.

Cross-linking docker/buildx#2226, related?

from buildkit.

@vvoland
Related to #4299 ?
I change buildkitd.toml

[registry."xxxx"]
  http = true
  insecure = true

to

[registry."xxxx"]
  http = true

and remove the buildctl option registry.insecure=true.
It works well.
Thx.

from buildkit.

The http fallback in containerd also only checks for the tls error:

@vvoland But that is not the behavior of moby, with host defined in insecure-registries, right?

from buildkit.

It is, but only with the containerd integration (because it uses the same resolver as buildkit).

It works fine with graphdrivers.

from buildkit.