Buildkit not pulling from an insecure registry

[kj3moraes]

• I am trying to use buildkit to build a Docker image and push to a locally hosted HTTP registry
• However even the base image is hosted on this locally hosted registry and this
• I get the following error when I run the job

error: failed to solve: femarketplace-registry-service:5000/febasebuild/ubuntu:22.04: failed to resolve source metadata for femarketplace-registry-service:5000/febasebuild/ubuntu:22.04: failed to do request: Head "https://femarketplace-registry-service:5000/v2/febasebuild/ubuntu/manifests/22.04": http: server gave HTTP response to HTTPS client

• the following code is using the Kubernetes python library to programatically start a build job.

{
                          "name": f"basebuild-construction-{slug}",
                          "image": "moby/buildkit:master",
                          "command": ["buildctl-daemonless.sh"],
                          "args": [
                              "build",
                              "--frontend",
                              "dockerfile.v0",
                              "--local",
                              "context=/workspace",
                              "--local",
                              "dockerfile=/workspace",
                              "--opt",
                              f"build-arg:BASE_IMG={basebuild_base_img}",
                              "--opt",
                              f"platform=linux/{platform_arch}",
                              "--output",
                              f"type=image,name={full_image_name},push=true,registry.insecure=true" 
                          ],
                          "securityContext": {
                              "privileged": True,  # Required for Docker in Docker
                          },
                          "env": [
                              {
                                  "name": "BUILDKIT_HOST",
                                  "value": "docker-container://buildkitd"
                              },
                              {
                                  "name": "DOCKER_CONFIG",
                                  "value": "/workspace/.docker"
                              },
                              {
                                  "name": "REGISTRY_USERNAME",
                                  "valueFrom": {
                                      "secretKeyRef": {
                                          "name": "registry-auth-secret",
                                          "key": "username",
                                      }
                                  },
                              },
                              {
                                  "name": "REGISTRY_PASSWORD",
                                  "valueFrom": {
                                      "secretKeyRef": {
                                          "name": "registry-auth-secret",
                                          "key": "password",
                                      }
                                  },
                              },
                          ],
                          "volumeMounts": [
                              {
                                  "name": "workspace",
                                  "mountPath": "/workspace",
                              },
                              {
                                  "name": "buildkit-cache",
                                  "mountPath": "/var/lib/buildkit"
                              },
                              {
                                  "name": "registry-config",
                                  "mountPath": "/root/.docker",
                              }
                          ],
                          "resources": {
                              "requests": {
                                  "memory": "2Gi",
                                  "cpu": "1000m"
                              },
                              "limits": {
                                  "memory": "4Gi",
                                  "cpu": "2000m"
                              }
                          }
                      }

• How do I ensure that buildkit can pull from insecure registries just like how it pushes to insecure registries.

[tonistiigi]

You need to define the insecure (or http) registries in the buildkitd toml config https://github.com/moby/buildkit/blob/master/docs/buildkitd.toml.md

[mike-michel]

Same Probleme here:

• Running a Nexus Mirror on http
• run buildkitd --config /etc/buildkitd.toml --debug inside docker
• run buildctl build --frontend dockerfile.v0 --local context=. --local dockerfile=. --output type=image,name=mikemichel/test,push=true

Tried both variants of /etc/buildkitd.toml

# https://docs.docker.com/build/buildkit/toml-configuration/
# [registry."docker.io"]
#   mirrors = ["my.mirror.com:8083"]
#   http = true

# optionally mirror configuration can be done by defining it as a registry.
[registry."my.mirror.com:8083"]
  http = true

Output:
DEBU[2025-09-22T09:30:02Z] session started spanID=aef16962a69ac68c traceID=9a178ace88afebdbf366c73745467325 DEBU[2025-09-22T09:30:02Z] resolve exporter image with map[name:mikemichel/test push:true] spanID=d8e46bcc7dcc3ae1 traceID=9a178ace88afebdbf366c73745467325 DEBU[2025-09-22T09:30:02Z] reusing ref for local: wzehg1jyd7r2h902cd0crd5wm span="[internal] load build definition from Dockerfile" spanID=0260c53dc16d1922 traceID=9a178ace88afebdbf366c73745467325 DEBU[2025-09-22T09:30:02Z] diffcopy took: 4.157209ms span="[internal] load build definition from Dockerfile" spanID=27d0f9bde59da37b traceID=9a178ace88afebdbf366c73745467325 DEBU[2025-09-22T09:30:02Z] checked for cached auth handler namespace cached=false key="docker.io/library/busybox::pull" name=docker.io/library/busybox scope=pull DEBU[2025-09-22T09:30:02Z] resolving span="resolving docker.io/library/busybox:latest" spanID=2653d84470cb1a72 traceID=9a178ace88afebdbf366c73745467325 DEBU[2025-09-22T09:30:02Z] do request request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=buildkit/v0.24 request.method=HEAD span="resolving docker.io/library/busybox:latest" spanID=2653d84470cb1a72 traceID=9a178ace88afebdbf366c73745467325 INFO[2025-09-22T09:30:02Z] trying next host error="failed to do request: Head \"https://my.mirror.com:8083/v2/library/busybox/manifests/latest?ns=docker.io\": http: server gave HTTP response to HTTPS client" span="resolving docker.io/library/busybox:latest" spanID=2653d84470cb1a72 traceID=9a178ace88afebdbf366c73745467325

It's using https instead of http.
buildkitd github.com/moby/buildkit v0.24.0 b772c318368090fb2ffc9c0fed92e0a35bf82389