Skip to content

Commit 41ceb29

Browse files
AkihiroSudaAkihiroSuda
authored
Merge pull request #790 from Zheaoli/manjusaka/fix-775
Fix --insecure-registry not working in some circumstances for #775
2 parents ff70188 + 60e5857 commit 41ceb29

File tree

9 files changed

+63
-13
lines changed

9 files changed

+63
-13
lines changed

‎cmd/nerdctl/image_encrypt_linux_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ func TestImageEncryptJWE(t *testing.T) {
7474
defer keyPair.cleanup()
7575
base := testutil.NewBase(t)
7676
tID := testutil.Identifier(t)
77-
reg := testregistry.NewPlainHTTP(base)
77+
reg := testregistry.NewPlainHTTP(base, 5000)
7878
defer reg.Cleanup()
7979
base.Cmd("pull", testutil.CommonImage).AssertOK()
8080
encryptImageRef := fmt.Sprintf("127.0.0.1:%d/%s:encrypted", reg.ListenPort, tID)

‎cmd/nerdctl/multi_platform_linux_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ func TestMultiPlatformBuildPush(t *testing.T) {
5757
testutil.RequireExecPlatform(t, "linux/amd64", "linux/arm64", "linux/arm/v7")
5858
base := testutil.NewBase(t)
5959
tID := testutil.Identifier(t)
60-
reg := testregistry.NewPlainHTTP(base)
60+
reg := testregistry.NewPlainHTTP(base, 5000)
6161
defer reg.Cleanup()
6262

6363
imageName := fmt.Sprintf("localhost:%d/%s:latest", reg.ListenPort, tID)
@@ -80,7 +80,7 @@ func TestMultiPlatformPullPushAllPlatforms(t *testing.T) {
8080
testutil.DockerIncompatible(t)
8181
base := testutil.NewBase(t)
8282
tID := testutil.Identifier(t)
83-
reg := testregistry.NewPlainHTTP(base)
83+
reg := testregistry.NewPlainHTTP(base, 5000)
8484
defer reg.Cleanup()
8585

8686
pushImageName := fmt.Sprintf("localhost:%d/%s:latest", reg.ListenPort, tID)

‎cmd/nerdctl/pull_linux_test.go

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"os"
2222
"os/exec"
2323
"path/filepath"
24+
"strings"
2425
"testing"
2526

2627
"github.com/containerd/nerdctl/pkg/testutil"
@@ -67,7 +68,7 @@ func TestImageVerifyWithCosign(t *testing.T) {
6768
defer keyPair.cleanup()
6869
base := testutil.NewBase(t)
6970
tID := testutil.Identifier(t)
70-
reg := testregistry.NewPlainHTTP(base)
71+
reg := testregistry.NewPlainHTTP(base, 5000)
7172
defer reg.Cleanup()
7273
localhostIP := "127.0.0.1"
7374
t.Logf("localhost IP=%q", localhostIP)
@@ -88,6 +89,28 @@ CMD ["echo", "nerdctl-build-test-string"]
8889
base.Cmd("pull", testImageRef, "--verify=cosign", "--cosign-key="+keyPair.publicKey).AssertOK()
8990
}
9091

92+
func TestImagePullPlainHttpWithDefaultPort(t *testing.T) {
93+
testutil.DockerIncompatible(t)
94+
testutil.RequiresBuild(t)
95+
base := testutil.NewBase(t)
96+
reg := testregistry.NewPlainHTTP(base, 80)
97+
defer reg.Cleanup()
98+
testImageRef := fmt.Sprintf("%s/%s:%s",
99+
reg.IP.String(), testutil.Identifier(t), strings.Split(testutil.CommonImage, ":")[1])
100+
t.Logf("testImageRef=%q", testImageRef)
101+
t.Logf("testImageRef=%q", testImageRef)
102+
dockerfile := fmt.Sprintf(`FROM %s
103+
CMD ["echo", "nerdctl-build-test-string"]
104+
`, testutil.CommonImage)
105+
106+
buildCtx, err := createBuildContext(dockerfile)
107+
assert.NilError(t, err)
108+
defer os.RemoveAll(buildCtx)
109+
base.Cmd("build", "-t", testImageRef, buildCtx).AssertOK()
110+
base.Cmd("--insecure-registry", "push", testImageRef).AssertOK()
111+
base.Cmd("--insecure-registry", "pull", testImageRef).AssertOK()
112+
}
113+
91114
func TestImageVerifyWithCosignShouldFailWhenKeyIsNotCorrect(t *testing.T) {
92115
if _, err := exec.LookPath("cosign"); err != nil {
93116
t.Skip()
@@ -99,7 +122,7 @@ func TestImageVerifyWithCosignShouldFailWhenKeyIsNotCorrect(t *testing.T) {
99122
defer keyPair.cleanup()
100123
base := testutil.NewBase(t)
101124
tID := testutil.Identifier(t)
102-
reg := testregistry.NewPlainHTTP(base)
125+
reg := testregistry.NewPlainHTTP(base, 5000)
103126
defer reg.Cleanup()
104127
localhostIP := "127.0.0.1"
105128
t.Logf("localhost IP=%q", localhostIP)

‎cmd/nerdctl/push.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,8 @@ func pushAction(cmd *cobra.Command, args []string) error {
183183
return err
184184
}
185185
if err = pushFunc(resolver); err != nil {
186-
if !imgutil.IsErrHTTPResponseToHTTPSClient(err) {
186+
// In some circumstance (e.g. people just use 80 port to support pure http), the error will contain message like "dial tcp <port>: connection refused"
187+
if !imgutil.IsErrHTTPResponseToHTTPSClient(err) && !imgutil.IsErrConnectionRefused(err) {
187188
return err
188189
}
189190
if insecure {

‎cmd/nerdctl/push_linux_test.go

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ import (
2828

2929
func TestPushPlainHTTPFails(t *testing.T) {
3030
base := testutil.NewBase(t)
31-
reg := testregistry.NewPlainHTTP(base)
31+
reg := testregistry.NewPlainHTTP(base, 5000)
3232
defer reg.Cleanup()
3333

3434
base.Cmd("pull", testutil.CommonImage).AssertOK()
@@ -46,7 +46,7 @@ func TestPushPlainHTTPFails(t *testing.T) {
4646

4747
func TestPushPlainHTTPLocalhost(t *testing.T) {
4848
base := testutil.NewBase(t)
49-
reg := testregistry.NewPlainHTTP(base)
49+
reg := testregistry.NewPlainHTTP(base, 5000)
5050
defer reg.Cleanup()
5151
localhostIP := "127.0.0.1"
5252
t.Logf("localhost IP=%q", localhostIP)
@@ -65,7 +65,7 @@ func TestPushPlainHTTPInsecure(t *testing.T) {
6565
testutil.DockerIncompatible(t)
6666

6767
base := testutil.NewBase(t)
68-
reg := testregistry.NewPlainHTTP(base)
68+
reg := testregistry.NewPlainHTTP(base, 5000)
6969
defer reg.Cleanup()
7070

7171
base.Cmd("pull", testutil.CommonImage).AssertOK()
@@ -77,6 +77,23 @@ func TestPushPlainHTTPInsecure(t *testing.T) {
7777
base.Cmd("--insecure-registry", "push", testImageRef).AssertOK()
7878
}
7979

80+
func TestPushPlainHttpInsecureWithDefaultPort(t *testing.T) {
81+
// Skip docker, because "dockerd --insecure-registries" requires restarting the daemon
82+
testutil.DockerIncompatible(t)
83+
84+
base := testutil.NewBase(t)
85+
reg := testregistry.NewPlainHTTP(base, 80)
86+
defer reg.Cleanup()
87+
88+
base.Cmd("pull", testutil.CommonImage).AssertOK()
89+
testImageRef := fmt.Sprintf("%s/%s:%s",
90+
reg.IP.String(), testutil.Identifier(t), strings.Split(testutil.CommonImage, ":")[1])
91+
t.Logf("testImageRef=%q", testImageRef)
92+
base.Cmd("tag", testutil.CommonImage, testImageRef).AssertOK()
93+
94+
base.Cmd("--insecure-registry", "push", testImageRef).AssertOK()
95+
}
96+
8097
func TestPushInsecureWithLogin(t *testing.T) {
8198
// Skip docker, because "dockerd --insecure-registries" requires restarting the daemon
8299
testutil.DockerIncompatible(t)

‎cmd/nerdctl/run_verify_linux_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ func TestRunVerifyCosign(t *testing.T) {
3838
defer keyPair.cleanup()
3939
base := testutil.NewBase(t)
4040
tID := testutil.Identifier(t)
41-
reg := testregistry.NewPlainHTTP(base)
41+
reg := testregistry.NewPlainHTTP(base, 5000)
4242
defer reg.Cleanup()
4343
localhostIP := "127.0.0.1"
4444
t.Logf("localhost IP=%q", localhostIP)

‎pkg/imgutil/imgutil.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,8 @@ func EnsureImage(ctx context.Context, client *containerd.Client, stdout, stderr
144144

145145
img, err := PullImage(ctx, client, stdout, stderr, snapshotter, resolver, ref, ocispecPlatforms, unpack, quiet)
146146
if err != nil {
147-
if !IsErrHTTPResponseToHTTPSClient(err) {
147+
// In some circumstance (e.g. people just use 80 port to support pure http), the error will contain message like "dial tcp <port>: connection refused".
148+
if !IsErrHTTPResponseToHTTPSClient(err) && !IsErrConnectionRefused(err) {
148149
return nil, err
149150
}
150151
if insecure {
@@ -200,6 +201,13 @@ func IsErrHTTPResponseToHTTPSClient(err error) bool {
200201
return strings.Contains(err.Error(), unexposed)
201202
}
202203

204+
// IsErrConnectionRefused return whether err is
205+
// "connect: connection refused"
206+
func IsErrConnectionRefused(err error) bool {
207+
const errMessage = "connect: connection refused"
208+
return strings.Contains(err.Error(), errMessage)
209+
}
210+
203211
// PullImage pulls an image using the specified resolver.
204212
func PullImage(ctx context.Context, client *containerd.Client, stdout, stderr io.Writer, snapshotter string, resolver remotes.Resolver, ref string, ocispecPlatforms []ocispec.Platform, unpack *bool, quiet bool) (*EnsuredImage, error) {
205213
ctx, done, err := client.WithLease(ctx)

‎pkg/mountutil/mountutil.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ func ProcessFlagV(s string, volStore volumestore.VolumeStore) (*Processed, error
5353
src, dst string
5454
options []string
5555
)
56+
5657
split := strings.Split(s, ":")
5758
switch len(split) {
5859
case 1:

‎pkg/testutil/testregistry/testregistry_linux.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,12 @@ type TestRegistry struct {
4040
Logs func()
4141
}
4242

43-
func NewPlainHTTP(base *testutil.Base) *TestRegistry {
43+
func NewPlainHTTP(base *testutil.Base, port int) *TestRegistry {
4444
hostIP, err := nettestutil.NonLoopbackIPv4()
4545
assert.NilError(base.T, err)
4646
// listen on 0.0.0.0 to enable 127.0.0.1
4747
listenIP := net.ParseIP("0.0.0.0")
48-
const listenPort = 5000 // TODO: choose random empty port
48+
listenPort := port
4949
base.T.Logf("hostIP=%q, listenIP=%q, listenPort=%d", hostIP, listenIP, listenPort)
5050

5151
registryContainerName := "reg-" + testutil.Identifier(base.T)

0 commit comments

Comments
 (0)