for-win icon indicating copy to clipboard operation
for-win copied to clipboard
verified publisher icon docker

containerd image store doesn't respect configuration setting

Open teeks99 opened this issue 9 months ago • 2 comments

Description

When running Docker Desktop on windows for version >=4.34.0 with the option Use containerd for pulling and storing images checked a setting, specifically insecure-registries, I put in the daemon.json file via the Settings -> Docker Engine page, doesn't seem to respect the setting.

Reproduce

Docker Desktop > 4.34.0

  1. Ensure option Use containerd for pulling and storing images is checked
  2. Edit the daemon.json via Settings -> Docker Engine to include an insecure-registries similar to: 
    {
  "builder": {
    "gc": {
      "defaultKeepStorage": "20GB",
      "enabled": true
    }
  },
  "experimental": false,
  "insecure-registries": [
    "my-registry1.place.com:3050",
    "my-registry1.place.com:3033",
    "my-registry2.place.com:3000"
  ]
}
  3. Apply and restart
  4. do a docker login for one of the registries in insecure-registries e.g. docker login my-registry1.place.com:3050
  5. Attempt to do a pull from that registry docker pull my-registry1.place.com:3050/image:latest
  6. See the unexpected certificate error: 
     Error response from daemon: failed to resolve reference "my-registry1.place.com:3050/image:latest": failed to authorize: failed to fetch oauth token: Post "https://my-registry1.place.com:3050/api/docker/docker-remote/v2/token": tls: failed to verify certificate: x509: certificate signed by unknown authority

Expected behavior

The docker pull should not attempt to verify the x509 TLS certificate.

docker version

>docker version
Client:
 Version:           27.5.1
 API version:       1.47
 Go version:        go1.22.11
 Git commit:        9f9e405
 Built:             Wed Jan 22 13:41:44 2025
 OS/Arch:           windows/amd64
 Context:           desktop-linux

Server: Docker Desktop 4.38.0 (181591)
 Engine:
  Version:          27.5.1
  API version:      1.47 (minimum version 1.24)
  Go version:       go1.22.11
  Git commit:       4c9b3b0
  Built:            Wed Jan 22 13:41:17 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.25
  GitCommit:        bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e946
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

>docker info
Client:
 Version:    27.5.1
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  ai: Ask Gordon - Docker Agent (Docker Inc.)
    Version:  v0.7.3
    Path:     C:\Program Files\Docker\cli-plugins\docker-ai.exe
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.20.1-desktop.2
    Path:     C:\Program Files\Docker\cli-plugins\docker-buildx.exe
  compose: Docker Compose (Docker Inc.)
    Version:  v2.32.4-desktop.1
    Path:     C:\Program Files\Docker\cli-plugins\docker-compose.exe
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.38
    Path:     C:\Program Files\Docker\cli-plugins\docker-debug.exe
  desktop: Docker Desktop commands (Beta) (Docker Inc.)
    Version:  v0.1.4
    Path:     C:\Program Files\Docker\cli-plugins\docker-desktop.exe
  dev: Docker Dev Environments (Docker Inc.)
    Version:  v0.1.2
    Path:     C:\Program Files\Docker\cli-plugins\docker-dev.exe
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.27
    Path:     C:\Program Files\Docker\cli-plugins\docker-extension.exe
  feedback: Provide feedback, right in your terminal! (Docker Inc.)
    Version:  v1.0.5
    Path:     C:\Program Files\Docker\cli-plugins\docker-feedback.exe
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.4.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-init.exe
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-sbom.exe
  scout: Docker Scout (Docker Inc.)
    Version:  v1.16.1
    Path:     C:\Program Files\Docker\cli-plugins\docker-scout.exe

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 0
 Server Version: 27.5.1
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2 nvidia
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
 runc version: v1.1.12-0-g51d5e946
 init version: de40ad0
 Security Options:
  seccomp
   Profile: unconfined
 Kernel Version: 5.15.167.4-microsoft-standard-WSL2
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 7.572GiB
 Name: docker-desktop
 ID: ea5f12ca-c996-45b9-bcee-db0b2ca30d86
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=npipe://\\.\pipe\docker_cli
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  sres.web.boeing.com:5033
  sres.web.boeing.com:5050
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No blkio throttle.read_bps_device support
WARNING: No blkio throttle.write_bps_device support
WARNING: No blkio throttle.read_iops_device support
WARNING: No blkio throttle.write_iops_device support
WARNING: daemon is not using the default seccomp profile

Diagnostics ID

N/A - This is an isolated network.

Additional Info

No response

teeks99 avatar Mar 06 '25 15:03 teeks99

My theory on this is that the containerd image store doesn't use the settings from daemon.json. Maybe there is a workaround to configure this somewhere else?

I'm not positive this is an actual but, as it may be by-design. If so, maybe some documentation on how to accomplish this in containerd image store?

teeks99 avatar Mar 06 '25 15:03 teeks99

I was having the same issue. I was able to perform a docker login after adding my certs to the ~/.docker/certs.d/<our_instance_of_gitlab> folder, but was not able to do a docker push/pull. Said something about certificates required even though login was able to find it. Push/pull were able to succeed after disabling the "Use containerd for pulling and storing images" setting, restarting docker, and rebuilding/tagging my image. I have Docker Desktop 4.38.0 installed.

ElCapitanTerra avatar Mar 19 '25 22:03 ElCapitanTerra

I was having the same issue. I was able to perform a docker login after adding my certs to the ~/.docker/certs.d/<our_instance_of_gitlab> folder, but was not able to do a docker push/pull. Said something about certificates required even though login was able to find it. Push/pull were able to succeed after disabling the "Use containerd for pulling and storing images" setting, restarting docker, and rebuilding/tagging my image. I have Docker Desktop 4.38.0 installed.

I have the the same issue when using version 4.40 ， how to solve the problem？ Is this a bug ？

xiaomizhg avatar Apr 22 '25 08:04 xiaomizhg