[image-rs] How to pull an image from local registries

[billionairiam]

Describe the bug

I want to create a pod that pulls an image from a local registry.

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: nginx
  name: nginx
  annotations:
    io.containerd.cri.runtime-handler: kata-qemu-tdx
spec:
  containers:
  - image: localhost:5000/nginx
    name: nginx
  dnsPolicy: ClusterFirst
  runtimeClassName: kata-qemu-tdx

It seems there are some credential issues.

  Normal   Scheduled  12s   default-scheduler  Successfully assigned default/nginx to ubuntu
  Normal   Pulling    5s    kubelet            Pulling image "localhost:5000/nginx"
  Warning  Failed     5s    kubelet            Failed to pull image "localhost:5000/nginx": failed to pull and unpack image "localhost:5000/nginx:latest": failed to resolve reference "localhost:5000/nginx:latest": pull access denied, repository does not exist or may require authorization: authorization failed: no basic auth credentials
  Warning  Failed     5s    kubelet            Error: ErrImagePull
  Normal   BackOff    5s    kubelet            Back-off pulling image "localhost:5000/nginx"
  Warning  Failed     5s    kubelet            Error: ImagePullBackOff

How to reproduce

I have read this, but I'm not sure how to proceed.

CoCo version information

v0.11.0

What TEE are you seeing the problem on

None

Failing command and relevant log output

No response

[fitzthum]

A few things to consider. First, pulling from localhost might not work from inside your guest because localhost inside the VM is not the host. Unless this is what you intend, you might try using an IP address here.

Second, pulling from local registries often means pulling from a registry with a self-signed cert. This can cause problems. You may need to set the cert via this config or by manually adding it to ca-certificates inside your guest.

[billionairiam]

You may need to set the cert via [this config](https://github.com/confidential-containers/guest-components/blob/main/image-rs/src/config.rs#L115) or by manually adding it to ca-certificates inside your guest. Could you provide an example of how to do this?

[fffmonkeyking-new]

A few things to consider. First, pulling from localhost might not work from inside your guest because localhost inside the VM is not the host. Unless this is what you intend, you might try using an IP address here.

Second, pulling from local registries often means pulling from a registry with a self-signed cert. This can cause problems. You may need to set the cert via this config or by manually adding it to ca-certificates inside your guest.

Hello,

Do you know how to configure kata-agent so that it knows that when pulling an image, the image is located in a local private http registry?

[Xynnn007]

A few things to consider. First, pulling from localhost might not work from inside your guest because localhost inside the VM is not the host. Unless this is what you intend, you might try using an IP address here.
Second, pulling from local registries often means pulling from a registry with a self-signed cert. This can cause problems. You may need to set the cert via this config or by manually adding it to ca-certificates inside your guest.

Hello,

Do you know how to configure kata-agent so that it knows that when pulling an image, the image is located in a local private http registry?

Now it does not support http registry and requires https registry. #896 will add a configuration file to allow specific registries to use http