fix interacting with insecure HTTPS registries #2028
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The Docker daemon allows to interact with insecure registries served through plain HTTP or served through HTTPS with self-signed certificates, when the target registry is included inside
insecureRegistries
. In this library it should be possible to interact with insecure registries likewise by using thename.Insecure
option when creating references.Nonetheless it's currently not possible to interact with insecure registries served with HTTPS and self-signed certificates, since the TLS certificate is checked anyway and an "invalid certificate" error is returned.
A common workaround consists into passing a
tls.Config
withInsecureSkipVerify
set to true, but this disables TLS validation for every HTTP request, while the desired behavior is disabling TLS validation only whenname.Insecure
is in use.This patch changes the default
remote
options in order to provide a defaulttls.Config
withInsecureSkipVerify
set to true if and only ifname.Insecure
is in use.This also fixes bugs in dependent tools like Skaffold, that are passing
name.Insecure
and notInsecureSKipVerify
as arguments to this library and are expecting to be able to interact with insecure HTTPS registries anyway.Sample code:
I am expecting this to work when
my.insecure.registry
is either a plain HTTP server or a self-signed HTTPS server, but it works only in the former case.