# devopsgym / codegen__containerd__containerd-10109 - taskset: [devopsgym](https://harnessreport.com/tasks/devopsgym.md) - difficulty: hard - category: code-generation - language: - runnable from the site: no - agent timeout: 3000s ## Results by harness _none yet_ ## Instruction ``` This is a code generation task. You are expected to write working code that solves the described problem. <issue> ### Description In [zarf](https://github.com/defenseunicorns/zarf) we run a localhost registry on a nodeport without TLS. We have seen and had failures reported on AKS, EKS, RKE2, and k3s because `config_path` in the containerd `config.toml` is being set to a default path (that may or may not actually exist). Relevant context: https://github.com/defenseunicorns/zarf/issues/592 Similar to: https://github.com/containerd/containerd/issues/7392 ### Steps to reproduce the issue 1. Run a k8s cluster w/ containerd 2. Use this config ```toml [plugins."io.containerd.grpc.v1.cri".registry] config_path = "/etc/containerd/certs.d" ``` 3. Run an insecure, plain HTTP registry as a pod in the cluster exposed via a nodeport and push an image to it 4. Run a pod that tries to pull/use an image from the in-cluster registry ### Describe the results you received and expected Expected result: containerd sends a plain HTTP request to pull the image and it succeeds. K8s logs and the `containerd.log` file show that containerd is sending an HTTPS request rather than a plain HTTP request when trying to pull an image from the insecure localhost registry. Here's a `containerd.log` file as a result of running `zarf init` on a linux/arm64 Ubuntu VM to create a k3s cluster and bootstrap a registry in the cluster: [containerd.log](https://github.com/containerd/containerd/files/14793215/containerd.log) Primary logs of interest: `"host will try HTTPS first since it is configured for HTTP with a TLS configuration, consider changing host to HTTPS or removing unused TLS configuration" host="127.0.0.1:30152"` https://github.com/containerd/containerd/blob/b0d00f86363f825ff2d3b55e563e28d3943b5b25/core/remotes/docker/config/hosts.go#L254 `"trying next host" error="failed to do request: Head \"https://127.0.0.1:30152/v2/library/registry/manifests/2.8.3\": net/http: TLS handshake timeout" host="127.0.0.1:30152"` It appears that there is supposed to be an HTTP fallback mechanism that doesn't seem to be working as expected: https://github.com/containerd/containerd/blob/b0d00f86363f825ff2d3b55e563e28d3943b5b25/core/remotes/docker/config/hosts.go#L256 ### What version of containerd are you using? `v1.7.11` ### Any other relevant information Versions affected appear to be `>=1.7.7` ### Show configuration if it is related to CRI plugin. ```toml # File generated by k3s. DO NOT EDIT. Use config.toml.tmpl instead. version = 2 [plugins."io.containerd.internal.v1.opt"] path = "/var/lib/rancher/k3s/agent/containerd" [plugins."io.containerd.grpc.v1.cri"] stream_server_address = "127.0.0.1" stream_server_port = "10010" enable_selinux = false enable_unprivileged_ports = true enable_unprivileged_icmp = true sandbox_image = "rancher/mirrored-pause:3.6" [plugins."io.containerd.grpc.v1.cri".containerd] snapshotter = "overlayfs" disable_snapshot_annotations = true [plugins."io.containerd.grpc.v1.cri".cni] bin_dir = "/var/lib/rancher/k3s/data/b239951455c1937c9a602d6f648eb66e85742877bacc677f28cb07c2962f9d3a/bin" conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d" [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] runtime_type = "io.containerd.runc.v2" [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options] SystemdCgroup = true [plugins."io.containerd.grpc.v1.cri".registry] config_path = "/var/lib/rancher/k3s/agent/etc/containerd/certs.d" ``` note that the `config_path` `"/var/lib/rancher/k3s/agent/etc/containerd/certs.d"` doesn't actually exist </issue> Focus on implementing the required functionality correctly and efficiently. Treat this as a programming challenge. You are not allowed to read git history. ``` --- Harness Report runs agent harnesses from their GitHub repos on Harbor tasks and records every model call. Every page is also `.md` and `.json`; index: https://harnessreport.com/llms.txt · MCP: https://harnessreport.com/mcp