Why nerdctl still falls back to registry-1.docker.io when configured to use a mirror registry?

[rgl]

Why nerdctl (0.22.0) still falls back to the registry-1.docker.io registry when configured to use a mirror registry? Is there a way to configure it to only use what is configured in the hosts.toml file?

My C:\ProgramData\containerd\certs.d\docker.io\hosts.toml file has this content:

[host."https://registry.test:5555"]
capabilities = ["pull", "resolve"]

Please note that https://registry.test:5555 does not really exist (it will return connection refused), its like that to test the nerdctl behavior.

Here's the --debug-full output, notice the trying next host lines (one for registry.test:5555 and a unexpected call to registry-1.docker.io):

PS C:\Users\vagrant> nerdctl pull --quiet docker.io/ruilopes/example-docker-buildx-go:v1.6.0 --debug-full
time="2022-07-30T10:58:59+01:00" level=debug msg="verification process skipped"
time="2022-07-30T10:58:59+01:00" level=debug msg="Found hosts dir \"C:\\\\ProgramData\\\\containerd\\\\certs.d\""
time="2022-07-30T10:58:59+01:00" level=debug msg="Ignoring hosts dir \"C:\\\\ProgramData\\\\docker\\\\certs.d\"" error="CreateFile C:\\ProgramData\\docker\\certs.d: The system cannot find the path specified."
time="2022-07-30T10:58:59+01:00" level=debug msg="The image will be unpacked for platform {\"amd64\" \"windows\" \"10.0.17763\" [] \"\"}, snapshotter \"windows\"."
time="2022-07-30T10:58:59+01:00" level=debug msg=fetching image="docker.io/ruilopes/example-docker-buildx-go:v1.6.0"
time="2022-07-30T10:58:59+01:00" level=debug msg="loading host directory" dir="C:\\ProgramData\\containerd\\certs.d\\docker.io"
time="2022-07-30T10:58:59+01:00" level=debug msg=resolving host="registry.test:5555"
time="2022-07-30T10:58:59+01:00" level=debug msg="do request" host="registry.test:5555" request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/1.6.0+unknown request.method=HEAD url="https://registry.test:5555/v2/ruilopes/example-docker-buildx-go/manifests/v1.6.0?ns=docker.io"
time="2022-07-30T10:59:00+01:00" level=info msg="trying next host" error="failed to do request: Head \"https://registry.test:5555/v2/ruilopes/example-docker-buildx-go/manifests/v1.6.0?ns=docker.io\": dial tcp 10.0.0.3:5555: connectex: No connection could be made because the target machine actively refused it." host="registry.test:5555"
time="2022-07-30T10:59:00+01:00" level=debug msg=resolving host=registry-1.docker.io
time="2022-07-30T10:59:00+01:00" level=debug msg="do request" host=registry-1.docker.io request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/1.6.0+unknown request.method=HEAD url="https://registry-1.docker.io/v2/ruilopes/example-docker-buildx-go/manifests/v1.6.0"
time="2022-07-30T10:59:00+01:00" level=info msg="trying next host" error="failed to do request: Head \"https://registry-1.docker.io/v2/ruilopes/example-docker-buildx-go/manifests/v1.6.0\": dial tcp 44.207.51.64:443: connectex: An attempt was made to access a socket in a way forbidden by its access permissions." host=registry-1.docker.io
time="2022-07-30T10:59:00+01:00" level=fatal msg="failed to resolve reference \"docker.io/ruilopes/example-docker-buildx-go:v1.6.0\": failed to do request: Head \"https://registry.test:5555/v2/ruilopes/example-docker-buildx-go/manifests/v1.6.0?ns=docker.io\": dial tcp 10.0.0.3:5555: connectex: No connection could be made because the target machine actively refused it."

[fahedouch]

it try to pull from registry-1.docker.io because you pointing the image fetcher to docker.io ,
nerdctl pull --quiet registry.test:5555/ruilopes/example-docker-buildx-go:v1.6.0 --debug-full will no longer point to docker.io
FYI : by default containerd start by trying hosts.toml if != ok it fallback to the pull repo

[rgl]

Sorry, but I don't understand what you mean. I do not want to change the image name/location. I want to configure nerdctl/containerd to use my local registry as the mirror of the docker.io registry. And while doing that, I do not want nerdctl/containerd to connect anywhere else besides that mirror.

[fahedouch]

@rgl it is not possible to exit when mirror fails for the current containerd version. You confirme @AkihiroSuda ?

[fahedouch]

@rgl plz follow containerd/containerd#7240