pulling localhost:5000 are forced to https only?

[liyimeng]

There is a private registry running http at localhost, crictl pull images there result failing as below:

Normal   Scheduled  <unknown>             default-scheduler  Successfully assigned default/vm-0 to iserver
  Warning  Failed     39m (x2 over 40m)     kubelet, iserver   Failed to pull image "localhost:5000/vm-runner:dev": rpc error: code = Unknown desc = failed to pull and unpack image "localhost:5000/vm-runner:dev": failed to resolve reference "localhost:5000/vm-runner:dev": failed to do request: Head https://localhost:5000/v2/vm-runner/manifests/dev: http: server gave HTTP response to HTTPS client

iserver [~]$ crictl -v
crictl github.com/rancher/containerd v1.16.1-k3s.1 

Is crictl behave differently from docker?, that is forcing to run https on localhost as well?

[Random-Liu]

The CRI plugin use https by default. If you want to use http, you need to explicitly configure it, see https://github.com/containerd/cri/blob/master/docs/registry.md#configure-registry-endpoint

But maybe we can use http by default for localhost. Let's see how Docker handle this.

[liyimeng]

Thanks a lot @Random-Liu! The info is really helpful! could be nice to allow fallback into http on localhost. Since int many cases, especially in a development env. people want a quick and work solution.

[thaJeztah]

Let's see how Docker handle this.

Docker automatically adds 127.0.0.0/8 as insecure registries;

 Insecure Registries:
  127.0.0.0/8

Whether or not that was a good decision is another discussion (it had been going back-and-forth for a long time, and initially was rejected moby/moby#2687 (comment), moby/moby#5817 (comment), after which it finally got added in moby/moby#9124).

For most uses, I guess that's ok, but there could be situations where you want to have that range to use a secure connection as well. I don't think that's currently possible (as it will always add that range to the list of insecure registries).

[Random-Liu]

For the CRI plugin, we can make localhost insecure by default to keep consistency with Docker, but allow making it https.