Support for HTTP about containerregistry HOT 6 CLOSED

Indeed, would be really nice to support http for non-localhost.

from containerregistry.

I'm also generally supportive of being able to use HTTP if desired, since in a service mesh, we might know that all connections are TLS, even if that's transparent to the applications.

That being said for any future users that might drop in here, I found that our specific use case of pointing to a k8s pod hostname via http works as long as the fully-qualified hostname is used (e.g. foo.foo-ns.svc.cluster.local). Seems like somebody has come across this before. :) https://github.com/google/containerregistry/blob/master/client/v2_2/docker_http_.py#L443-L450

from containerregistry.

I also encountered this problem. Some local kubernetes stacks create a virtual node inside a docker container and run everything in there. The kubelets can't access the "localhost" registry from outside their sandbox, but both can access the node IP. If I run a private registry there it has 192.168.9.2 which docker_http.py assumes is HTTPS and I get an odd error message

CRITICAL:root:Error publishing provided image: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:727)

Would it be possible to fix the code so that it first tries https, catches the error, then falls back to http? A properly set up registry should fail http so there should be no security problem that is opened up.

from containerregistry.

After thinking about this, falling back to http would introduce an attack vector. A man-in-the-middle could claim the dns record for some domain, hoping to catch cases where the https failed and the subsequent http request with to this bad guy, who could then deliver an infected image.
Assumming that is the case we should have a way to specify the schema. Consider detecting if http:// or https:// is a prefix on the image name and use in talking to the registry but stripping it for image name purposes, much like is done when specifying a domain other than dockerhub.com

from containerregistry.

Same issue! We also utilize private registry(Harbor) to distribution image or store our project base docker image in internal project. For convenience, Harbor is deployed with HTTP.

And since rules_docker(https://github.com/bazelbuild/rules_docker/blob/master/container/pull.bzl) relies heavily it, if I want to pull internal image to usage, it will fail because of parse scheme and try ping

... ...
(04:06:01) ERROR: Analysis of target '//cmd/webhook:image' failed; build aborted: no such package '@static_base//image': Pull command failed: F0301 04:06:01.489578  378089 __main__.py:147] Error pulling and saving image 192.168.20.38/build/debian:stretch: [Errno 111] Connection refused

My ugly workaround to bind 192.168.20.38 to localhost in /etc/hosts, and update field registry = 'localhost:80' in WORKSPACE file.

Looking forward to support it

from containerregistry.

jeb2239, can you provide justification for closing this. I still would like this feature added

from containerregistry.