# devopsgym / testgen__containerd__containerd-10109

- taskset: [devopsgym](https://harnessreport.com/tasks/devopsgym.md)
- difficulty: hard
- category: test-generation
- language: 
- runnable from the site: no
- agent timeout: 3000s

## Results by harness

_none yet_

## Instruction

```
The following text contains a user issue (in <issue/> brackets) posted at a repository. Further, you are provided with file contents of several files in the repository that contain relevant code (in <code> brackets). It may be necessary to use code from third party dependencies or files not contained in the attached documents however. Your task is to identify the issue and implement a test case that verifies a proposed solution to this issue. More details at the end of this text.
<issue>
      ### Description

In [zarf](https://github.com/defenseunicorns/zarf) we run a localhost registry on a nodeport without TLS. We have seen and had failures reported on AKS, EKS, RKE2, and k3s because `config_path` in the containerd `config.toml` is being set to a default path (that may or may not actually exist).

Relevant context: https://github.com/defenseunicorns/zarf/issues/592

Similar to: https://github.com/containerd/containerd/issues/7392

### Steps to reproduce the issue

1. Run a k8s cluster w/ containerd
2. Use this config

```toml
[plugins."io.containerd.grpc.v1.cri".registry]
   config_path = "/etc/containerd/certs.d"
```
3. Run an insecure, plain HTTP registry as a pod in the cluster exposed via a nodeport and push an image to it

4. Run a pod that tries to pull/use an image from the in-cluster registry


### Describe the results you received and expected

Expected result: containerd sends a plain HTTP request to pull the image and it succeeds.

K8s logs and the `containerd.log` file show that containerd is sending an HTTPS request rather than a plain HTTP request when trying to pull an image from the insecure localhost registry.

Here's a `containerd.log` file as a result of running `zarf init` on a linux/arm64 Ubuntu VM to create a k3s cluster and bootstrap a registry in the cluster:

[containerd.log](https://github.com/containerd/containerd/files/14793215/containerd.log)

Primary logs of interest:

`"host will try HTTPS first since it is configured for HTTP with a TLS configuration, consider changing host to HTTPS or removing unused TLS configuration" host="127.0.0.1:30152"`

https://github.com/containerd/containerd/blob/b0d00f86363f825ff2d3b55e563e28d3943b5b25/core/remotes/docker/config/hosts.go#L254

`"trying next host" error="failed to do request: Head \"https://127.0.0.1:30152/v2/library/registry/manifests/2.8.3\": net/http: TLS handshake timeout" host="127.0.0.1:30152"`

It appears that there is supposed to be an HTTP fallback mechanism that doesn't seem to be working as expected:

https://github.com/containerd/containerd/blob/b0d00f86363f825ff2d3b55e563e28d3943b5b25/core/remotes/docker/config/hosts.go#L256

### What version of containerd are you using?

`v1.7.11`

### Any other relevant information

Versions affected appear to be `>=1.7.7`

### Show configuration if it is related to CRI plugin.

```toml
# File generated by k3s. DO NOT EDIT. Use config.toml.tmpl instead.
version = 2

[plugins."io.containerd.internal.v1.opt"]
  path = "/var/lib/rancher/k3s/agent/containerd"
[plugins."io.containerd.grpc.v1.cri"]
  stream_server_address = "127.0.0.1"
  stream_server_port = "10010"
  enable_selinux = false
  enable_unprivileged_ports = true
  enable_unprivileged_icmp = true
  sandbox_image = "rancher/mirrored-pause:3.6"

[plugins."io.containerd.grpc.v1.cri".containerd]
  snapshotter = "overlayfs"
  disable_snapshot_annotations = true



[plugins."io.containerd.grpc.v1.cri".cni]
  bin_dir = "/var/lib/rancher/k3s/data/b239951455c1937c9a602d6f648eb66e85742877bacc677f28cb07c2962f9d3a/bin"
  conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d"


[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
  runtime_type = "io.containerd.runc.v2"

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
  SystemdCgroup = true

[plugins."io.containerd.grpc.v1.cri".registry]
  config_path = "/var/lib/rancher/k3s/agent/etc/containerd/certs.d"

```

note that the `config_path` `"/var/lib/rancher/k3s/agent/etc/containerd/certs.d"` doesn't actually exist

</issue>
Please generate test cases that check whether an implemented solution resolves the issue of the user (at the top, within <issue/> brackets).
You may apply changes to several files.
Apply as much reasoning as you please and see necessary.
Make sure to implement only test cases and don't try to fix the issue itself.
You are not allowed to read git history.
```
---
Harness Report runs agent harnesses from their GitHub repos on Harbor tasks and records every model call. Every page is also `.md` and `.json`; index: https://harnessreport.com/llms.txt · MCP: https://harnessreport.com/mcp