[24.0 backport] Fix insecure registries reload#45571
Conversation
|
@corhere @neersighted PTAL |
|
integration got stuck twice after it failed to stop a daemon; should not be related, but worth looking why it gets stuck and/or id there's something to improve elsewhere |
|
TestDockerSwarmSuite is happy now; the |
|
Now that I have updated Docker to 24, insecure registries no longer works at all. Whatever I have in my daemon.json is ignored and never shows up in docker info and thus, I can no longer operate my datacenter since using a cert for a private repo on a private datacenter only leads us to fail once a year and do extra work to secure nothing inside our already secured datacenter. Only seeing a few complaints about it and this is the only code update I see about messing with the insecure registry. Not sure its related but this all worked on this machine, prior to this update. |
|
|
|
insecure-registries is also not working for me. /etc/docker/daemon.json after restarting the service "sudo systemctl restart docker", the insecure registry is not showing on "docker info" |
|
@sheenilim08 I'm not able to reproduce; if you have steps to reproduce, please open a ticket with details instead. cat /etc/docker/daemon.json
cat: /etc/docker/daemon.json: No such file or directory
docker info --format '{{json .RegistryConfig}}' | jq .
{
"AllowNondistributableArtifactsCIDRs": null,
"AllowNondistributableArtifactsHostnames": null,
"InsecureRegistryCIDRs": [
"127.0.0.0/8"
],
"IndexConfigs": {
"docker.io": {
"Name": "docker.io",
"Mirrors": [],
"Secure": true,
"Official": true
}
},
"Mirrors": null
}With a daemon.json and insecure registries; mkdir -p /etc/docker
echo '{"insecure-registries":["123.456.789.1:5000", "123.123.123.0/24", "foo.example.com:123"]}' > /etc/docker/daemon.json
systemctl reload docker
docker info --format '{{json .RegistryConfig}}' | jq .
{
"AllowNondistributableArtifactsCIDRs": null,
"AllowNondistributableArtifactsHostnames": null,
"InsecureRegistryCIDRs": [
"123.123.123.0/24",
"127.0.0.0/8"
],
"IndexConfigs": {
"123.456.789.1:5000": {
"Name": "123.456.789.1:5000",
"Mirrors": [],
"Secure": false,
"Official": false
},
"docker.io": {
"Name": "docker.io",
"Mirrors": [],
"Secure": true,
"Official": true
},
"foo.example.com:123": {
"Name": "foo.example.com:123",
"Mirrors": [],
"Secure": false,
"Official": false
}
},
"Mirrors": null
} |
+1, the same os and docker version. Reinstall still has this issue. |
|
@pytimer Note that the 24.0 release is no longer maintained (see BRANCHES-AND-TAGS.md). So far (see above) we have not been able to reproduce the issue. If you have a system to test on, are able to provide exact reproduction steps on a current version, feel free to open a ticket with details (as requested in the issue template when you open a ticket). |
- What I did
Fixed a small bug where when both
insecure-registriesandregistry-mirrorsare set indaemon.json, when executing a daemon reload (such as withsystemctl reload docker) the insecure registries are no longer in the daemon's loaded configuration.- How I did it
Reordered the loading of the insecure registries to occur after the loading of the mirrors. This matches a newly started daemon's configuration loading order.
The overwriting occurs because
loadMirrors()creates a new map forconfig.IndexConfigs.I added a mirror to the unit test to demonstrate this.
- How to verify it
Through the unit tests:
daemon/reload_test.gomake test-unitmake test-unitIndependently on Linux:
daemon.jsonthat has bothinsecure-registriesandregistry-mirrorsdockerddaemondocker infosystemctl reload dockerorkill -s HUP <pid>)docker infowill not show the registries are loaded. With it, it will.- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)