Rules_docker: unable to use container_push with local docker repository

[Zaspire]

Traceback (most recent call last):
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/ava/../containerregistry/tools/fast_pusher_.py", line 149, in <module>
    main()
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/ava/../containerregistry/tools/fast_pusher_.py", line 130, in main
    with docker_session.Push(name, creds, transport, threads=_THREADS) as session:
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/containerregistry/client/v2_2/docker_session_.py", line 71, in __init__
    name, creds, transport, docker_http.PUSH)
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/containerregistry/client/v2_2/docker_http_.py", line 192, in __init__
    self._Ping()
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/containerregistry/client/v2_2/docker_http_.py", line 218, in _Ping
    headers=headers)
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/containerregistry/transport/transport_pool_.py", line 62, in request
    return transport.request(*args, **kwargs)
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/httplib2/__init__.py", line 1659, in request
    (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/httplib2/__init__.py", line 1399, in _request
    (response, content) = self._conn_request(conn, request_uri, method, body, headers)
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/httplib2/__init__.py", line 1319, in _conn_request
    conn.connect()
  File "/home/zaspire/.cache/bazel/_bazel_zaspire/1010357ee0e0c546a5a0c1dee8f8184b/execroot/ava/bazel-out/local-fastbuild/bin/n1/push_main.runfiles/httplib2/__init__.py", line 1092, in connect
    raise SSLHandshakeError(e)
httplib2.SSLHandshakeError: [SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:661)

[mattmoor]

Can you share a little more about what your container_push rule looks like?

[Zaspire]

container_push(
   name = "push_main",
   image = ":main",
   format = "Docker",
   registry = "127.0.0.1:5000",
   repository = "main",
   tag = "dev",
)

I tried multiple values for registry e.g. hostname:port, ip:port.
neither of them works.

[promiseofcake]

Have you attempted forcing the protocol as http, it seems like it's expecting HTTPS but not getting it.

[Zaspire]

I tried http://domain:port as registry value as well. But fast_pusher complains about it

[mattmoor]

What if you use localhost?

[Zaspire]

What if you use localhost?

localhost:5000 does work.

But pushing to registry installed in local kubernetes instance does not work.
e.g. vm_hostname:5000 does not work (with registry exposed on this port).

[mattmoor]

Support was recently added for properly handling .local domain names, which should apply to more fully-qualified K8s service names.

[mattmoor]

I just wanted to follow up and see if that resolved your problem? If not, I'd like to better understand what changes we need.

thanks for reaching out.

[Zaspire]

Support was recently added for properly handling .local domain names

I am running minikube(local k8s) on same machine.
just adding .local prefix to hostname in registry field did not worked.

httplib2.ServerNotFoundError: Unable to find the server at minikube.local

adding "minikube.local" to /etc/hosts helped.

[mattmoor]

Local registries are a funny corner case with these rules because the image URIs may not always be the same in the context of pushing and pulling.

We want to have better support for minikube (/cc @dlorenc @r2d4), but my expectation has been that this will come through some sort of magic to side-load the Docker images into the minikube Docker daemon to avoid the push/pull (since AIUI minikube does not always have a registry).

[mattmoor]

Sorry, my comment above was thinking this was an issue on the rules_k8s repo, which is where we plan to put any more specialized logic for minikube.

[mattmoor]

I am going to resolve this in favor of this which tracks a better minikube development flow.

[emcfarlane]

@mattmoor is .local required? Using dockers docker.for.mac.localhost:5000 gives httplib2.SSLHandshakeError: [SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:661) for the contrib push-all rule.

[mattmoor]

It looks like the person who sent us the patch just added .local, see the regex.

[emcfarlane]

@mattmoor I patch the regex to work with .localhost https://github.com/google/containerregistry/pull/43 . Is there a nicer way to do this with an insecure flag of some sort?

[margic]

insecure flag would be really useful and in keeping with docker and minikube

[lioramilbaum]

The following code doesn't push the image to local registry:

container_push(
name = "publish",
image = ":image3",
format = "Docker",
registry = "localhost:5000",
repository = "image3"
)

what am I doing wrong?
Running 'docker images' on my mac laptop should have shown image3. Right?

[mattmoor]

docker images shows what's in your daemon, not a registry. If you want it in your registry bazel run :image3 should do it.