Failed to pull image use proxy

[bhy7]

Description

When nerdctl pulls the image through the proxy, It's mention

INFO[0000] trying next host                              error="failed to do request: Head \"https://registry-1.docker.io/v2/library/hello-world/manifests/latest\": proxyconnect tcp: dial tcp 127.0.0.1:7890: connect: connection refused" host=registry-1.docker.io
ERRO[0000] server "docker.io" does not seem to support HTTPS  error="failed to resolve reference \"docker.io/library/hello-world:latest\": failed to do request: Head \"https://registry-1.docker.io/v2/library/hello-world/manifests/latest\": proxyconnect tcp: dial tcp 127.0.0.1:7890: connect: connection refused"
INFO[0000] Hint: you may want to try --insecure-registry to allow plain HTTP (if you are in a trusted network) 
FATA[0000] failed to resolve reference "docker.io/library/hello-world:latest": failed to do request: Head "https://registry-1.docker.io/v2/library/hello-world/manifests/latest": proxyconnect tcp: dial tcp 127.0.0.1:7890: connect: connection refused 

Steps to reproduce the issue

1.Set environment variable:

export http_proxy="socks5://127.0.0.1:7890"
export https_proxy="socks5://127.0.0.1:7890"
export HTTP_PROXY="socks5://127.0.0.1:7890"
export HTTPS_PROXY="socks5://127.0.0.1:7890"
export all_proxy="socks5://127.0.0.1:7890"
export ALL_PROXY="socks5://127.0.0.1:7890"

2. run nerdctl run hello-world

Describe the results you received and expected

Success pull image

What version of nerdctl are you using?

nerdctl version 0.21.0

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

No response

Host information

Client:
Namespace: default
Debug Mode: false

Server:
Server Version: v1.6.6
Storage Driver: overlayfs
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Log: fluentd journald json-file
Storage: native overlayfs
Security Options:
seccomp
Profile: default
cgroupns
rootless
Kernel Version: 5.18.9-arch1-1
Operating System: Arch Linux
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 15.51GiB
Name: tonytp
ID: f67a3e9f-5477-4924-8c26-a50b7929d4f0

[Zheaoli]

the message in your description has some like this proxyconnect tcp: dial tcp 127.0.0.1:7890: connect: connection refused .
Maybe you need to double-check the proxy setting right or not

[AkihiroSuda]

Rootless has different view of 127.0.0.1.
Please use non-loopback address or rootful

[fahedouch]

In this stage we are pulling the image so we are accessing the host loopback address from the host there is no container yet. So why Rootless has different view of host loopback address 127.0.0.1 ?

[AkihiroSuda]

Pulling happens in the namespace. Not ideal though.

[fahedouch]

OK got it, may be there is a way to bind the proxy to the slirp4netns loopback address!

[snowshoes]

so what's the correct way to config the proxy in rootless mode, is there any example ?

[0400H]

[AkihiroSuda]

#2091 is for nerdctl build with rootful while #1195 is for nerdctl pull with rootles, so I don't see any similarity.

[0400H]

#2091 is for nerdctl build with rootful while #1195 is for nerdctl pull with rootles, so I don't see any similarity.

But how to deal with it?

[fahedouch]

https://github.com/containerd/nerdctl/blob/main/docs/registry.md#accessing-127001-from-rootless-nerdctl