[v0.13] It seems that "registry.insecure=true" doesn't work.

[SihengCui]

It seems that "registry.insecure=true" doesn't work.
My registry only supports HTTP protocol and 80 port.

But in v0.11.6 it works well.

[tonistiigi]

@vvoland Related to #4299 ?

[vvoland]

Hmm right, registry.insecure=true sets both "insecure https" and "http only" options which makes it use the http fallback.

buildkit/util/resolver/resolver.go

Lines 44 to 60 in 6acf12f

	if c.Insecure != nil && *c.Insecure {
	h2 := h
	var transport http.RoundTripper = httpsTransport
	if isHTTP {
	transport = &httpFallback{super: transport}
	}
	h2.Client = &http.Client{
	Transport: tracing.NewTransport(transport),
	}
	tc.InsecureSkipVerify = true
	return &h2, nil
	} else if isHTTP {
	h2 := h
	h2.Scheme = "http"
	return &h2, nil
	}

However, the http only kicks-in, if the https connection fails with a TLS error. In this case the error is different (connection refused), so the connection doesn't fallback to http.

[vvoland]

The http fallback in containerd also only checks for the tls error: https://github.com/containerd/containerd/blob/536608ef227e0825c7c49d59a71a698cc8039ff5/core/remotes/docker/resolver.go#L735

cc @dmcgowan

[profnandaa]

Cross-linking docker/buildx#2226, related?

[SihengCui]

@vvoland
Related to #4299 ?
I change buildkitd.toml

[registry."xxxx"]
  http = true
  insecure = true

to

[registry."xxxx"]
  http = true

and remove the buildctl option registry.insecure=true.
It works well.
Thx.

[tonistiigi]

The http fallback in containerd also only checks for the tls error:

@vvoland But that is not the behavior of moby, with host defined in insecure-registries, right?

[vvoland]

It is, but only with the containerd integration (because it uses the same resolver as buildkit).

It works fine with graphdrivers.