Login to insecure corporate registry with http only fails

dschulten commented 4 days ago

Issue Description

I need to login to a corporate registry that functions as mirror for internet registries and only runs with http.

I have marked the registry as insecure by adding the following entry to /etc/containers/registries.conf:

[[registry]]
location = "repo.nexus.example.com:15050"
insecure = true

Login fails:

podman login repo.nexus.example.com:15050
Username: example-admin
Password:
Error: authenticating creds for "repo.nexus.example.com": pinging container registry repo.nexus.example.com:15050: Get "https://repo.nexus.example.com:15050/v2/": http: server gave HTTP response to HTTPS client

So it appears that marking a registry as insecure does not have the effect that the login communication switches to http only.

Pulling and running images also fails:

λ podman run --log-level=debug repo.nexus.example.com:15050/gvenzl/oracle-xe:21.3.0
time="2024-09-29T13:48:13+02:00" level=info msg="podman filtering at log level debug"
time="2024-09-29T13:48:13+02:00" level=debug msg="Called run.PersistentPreRunE(podman run --log-level=debug repo.nexus.example.com:15050/gvenzl/oracle-xe:21.3.0)"
time="2024-09-29T13:48:13+02:00" level=debug msg="SSH Ident Key \"C:\\\\Users\\\\itbc000257\\\\.local\\\\share\\\\containers\\\\podman\\\\machine\\\\machine\" SHA256:VsXcn0fGuftsd/ZpT9TOQ/vSyhf2cx/H/qwBOQrrXVg ssh-ed25519"
time="2024-09-29T13:48:14+02:00" level=debug msg="DoRequest Method: GET URI: http://d/v5.2.3/libpod/_ping"
time="2024-09-29T13:48:14+02:00" level=debug msg="Loading registries configuration \"/etc/containers/registries.conf\""
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials matching gitlab.registry.example.com:5050 found in C:\\Users\\itbc000257\\.config\\containers\\auth.json"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials matching gitlab.registry.example.com:5050 found in C:\\Users\\itbc000257\\.config\\containers\\auth.json"
time="2024-09-29T13:48:14+02:00" level=debug msg="Found an empty credential entry \"gitlab.registry.example.com:5050\" in \"C:\\\\Users\\\\itbc000257\\\\.docker\\\\config.json\" (an unhandled credential helper marker?), moving on"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials matching gitlab.registry.example.com:5050 found in C:\\Users\\itbc000257\\.dockercfg"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials for gitlab.registry.example.com:5050 found"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials matching docker.io found in C:\\Users\\itbc000257\\.config\\containers\\auth.json"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials matching docker.io found in C:\\Users\\itbc000257\\.config\\containers\\auth.json"
time="2024-09-29T13:48:14+02:00" level=debug msg="Found an empty credential entry \"https://index.docker.io/v1/\" in \"C:\\\\Users\\\\itbc000257\\\\.docker\\\\config.json\" (an unhandled credential helper marker?), moving on"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials matching docker.io found in C:\\Users\\itbc000257\\.dockercfg"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials for docker.io found"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials matching repo.nexus.example.com:15050 found in C:\\Users\\itbc000257\\.config\\containers\\auth.json"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials matching repo.nexus.example.com:15050 found in C:\\Users\\itbc000257\\.config\\containers\\auth.json"
time="2024-09-29T13:48:14+02:00" level=debug msg="Found an empty credential entry \"repo.nexus.example.com:15050\" in \"C:\\\\Users\\\\itbc000257\\\\.docker\\\\config.json\" (an unhandled credential helper marker?), moving on"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials matching repo.nexus.example.com:15050 found in C:\\Users\\itbc000257\\.dockercfg"
time="2024-09-29T13:48:14+02:00" level=debug msg="No credentials for repo.nexus.example.com:15050 found"
time="2024-09-29T13:48:14+02:00" level=debug msg="DoRequest Method: POST URI: http://d/v5.2.3/libpod/images/pull"
Trying to pull repo.nexus.example.com:15050/gvenzl/oracle-xe:21.3.0...
Error: initializing source docker://repo.nexus.example.com:15050/gvenzl/oracle-xe:21.3.0: pinging container registry repo.nexus.example.com:15050: received unexpected HTTP status: 503 Service Unavailable time="2024-09-29T13:52:13+02:00" level=debug msg="Shutting down engines"

The output above comes from the Windows Terminal Cmder, I have also tried pure cmd, same result.

Steps to reproduce the issue

Try podman login with insecure http registry

Describe the results you received

Login fails, it appears that podman tries to login with https in spite of the flag insecure registry

Describe the results you expected

Login success

podman info output

λ podman info
host:
  arch: amd64
  buildahVersion: 1.37.3
  cgroupControllers:
  - cpuset
  - cpu
  - cpuacct
  - blkio
  - memory
  - devices
  - freezer
  - net_cls
  - perf_event
  - net_prio
  - hugetlb
  - pids
  - rdma
  - misc
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: conmon-2.1.12-2.fc40.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.12, commit: '
  cpuUtilization:
    idlePercent: 99.71
    systemPercent: 0.18
    userPercent: 0.11
  cpus: 8
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: container
    version: "40"
  eventLogger: journald
  freeLocks: 2045
  hostname: SN602534
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 5.15.153.1-microsoft-standard-WSL2
  linkmode: dynamic
  logDriver: journald
  memFree: 15828119552
  memTotal: 16628350976
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.12.2-2.fc40.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.12.2
    package: netavark-1.12.2-1.fc40.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.12.2
  ociRuntime:
    name: crun
    package: crun-1.17-1.fc40.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.17
      commit: 000fa0d4eeed8938301f3bcf8206405315bc1017
      rundir: /run/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20240906.g6b38f07-1.fc40.x86_64
    version: |
      pasta 0^20240906.g6b38f07-1.fc40.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: true
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 4294967296
  swapTotal: 4294967296
  uptime: 0h 48m 52.00s
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  repo.nexus.example.com:15050:
    Blocked: false
    Insecure: true
    Location: repo.nexus.example.com:15050
    MirrorByDigestOnly: false
    Mirrors: null
    Prefix: repo.nexus.example.com:15050
    PullFromMirror: ""
  search:
  - docker.io
store:
  configFile: /usr/share/containers/storage.conf
  containerStore:
    number: 3
    paused: 0
    running: 0
    stopped: 3
  graphDriverName: overlay
  graphOptions:
    overlay.imagestore: /usr/lib/containers/storage
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 269427478528
  graphRootUsed: 1064656896
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 5.2.3
  Built: 1727136000
  BuiltTime: Tue Sep 24 02:00:00 2024
  GitCommit: ""
  GoVersion: go1.22.7
  Os: linux
  OsArch: linux/amd64
  Version: 5.2.3

Podman in a container

No

Privileged Or Rootless

Privileged

Upstream Latest Release

Yes

Additional environment details

None

Additional information

None

giuseppe commented 3 days ago

@mtrmac PTAL

Luap99 commented 3 days ago

AFAIK login happen on the client but your config is only on the server. So the login command has no idea the the registry is configured as insecure.

dschulten commented 2 days ago

Very interesting! Where do I configure an insecure registry on the client? From your answer I learn that I am configuring the server when I execute podman machine ssh - where is client configuration located?

containers / podman