[Request]: Docker Mirrors Support

[qiqizjl]

Feature or enhancement request details

Due to the special network environment in China, we cannot directly access registry-1.docker.io. In DockerDestktop/orb, we can configure docker-mirrors. But the container does not support it.

Code of Conduct

• I agree to follow this project's Code of Conduct

[Cotch22]

second
+1

[adityaramani]

Can you please share some more information about this? We have a way to set the default registry in container via this command

container registry default set foo.bar

This will make it such that when you try to run a container

container run alpine uname

The image will be pulled from foo.bar/alpine:latest and not from docker.io

[nilIfNull]

Problems were encountered when running container run

container run hello-world
# or
container run docker.io/hello-world          

Error: unknown: "HTTPClientError.connectTimeout"

Previously, Docker was configured as follows.

Configure the Docker daemon

Either pass the --registry-mirror option when starting dockerd manually, or edit /etc/docker/daemon.json and add the registry-mirrors key and value, to make the change persistent.

{
  "registry-mirrors": ["https://<my-docker-mirror-host>"]
}

[qiqizjl]

The container registry default command looks different from Mirrors in Docker.
In Docker, it supports multiple configurations. It will request in order. If the request fails, it will request the next one. When all mirrors fail, it will automatically request the default one.
In addition, it is also different when downloading. It replaces docker.io, but the library still exists
eg:
Docker:
docker pull alpine
docker pull mirorrs/library/alpine

AppleContainer
container pull alpine
container pull mirrors/alpine

It seems that the library will be lost. So even if the default registry is configured, it will still have problems.
I hope to align the mirrors in Docker

[egernst]

@evil0th - are you able to run any container? I'm wondering if during container system start you were able to access artifacts which are hosted on ghcri (for guest initfs and kernel).

[nilIfNull]

@evil0th - are you able to run any container? I'm wondering if during container system start you were able to access artifacts which are hosted on ghcri (for guest initfs and kernel).

@egernst
Running the container system start command can be executed correctly, but it cannot pull any image. The default docker environment also cannot work because it is affected by GFW. However, it can be done after configuring the docker mirror registry.

> container system start
Verifying apiserver is running...
Installing base container filesystem...
⠇ [1/2] Fetching image 0% (3 of 4 blobs, 871 KB/164.1 MB, 6 KB/s) [1m 26s]    

Verifying apiserver is running...
Installing base container filesystem...

> container images pull docker.io/python:alpine

Error: unknown: "HTTPClientError.connectTimeout"

[egernst]

This one is similar to #304.

In this case, you should be able to setup a new default registry, and directly use that mirror to support this use case. Today we don't plan to support 'docker mirrors'

There are a couple of areas where people have questions, feature requests for registries, so I'm going to transfer this to a GitHub discussion t get more input, and help with best practices, workarounds.

[SpaceVector]

For Chinese developers, this is a very important feature.

[wang-silas]

It's a very nice feature for Chinese developers. Additional, from my point of view, it is better to use Podman's config because Podman supports to set registry-mirror for specific registry, for example, there is a config file under ~/.config/container/registry.conf:

[[registry]] # Set mirror for 'docker.io'
prefix = "docker.io"
location="somedockermirror.domain"
insecure=true
blocked=true

[[registry-mirrors]] # Set optional mirror for domain 'docker.io'
location="someotherdockermirror.domain"
insecure=true
blocked=true

[[registry]] # Set mirror for domain 'mcr.microsoft.com'
prefix="mcr.microsoft.com"
location="mirrorofmcrmicrosoft.domain/uri/path"

[jenningsbrad73-cyber]

[LsM97]

i am pretty sure this is why i cant build on my machine. Since the buildkit image cannot be fetched. It also seems that setting the registry.domain to a internal reachable one does not change this behaviour?

container builder start

Error: unknown: "StreamClosed(streamID: HTTP2StreamID(3), errorCode: HTTP2ErrorCode<0x7 Refused Stream>, location: "NIOHTTP2/HTTP2StreamChannel.swift:892")"