cf docker-push using local docker registry failing

[tee33]

Creating container

Successfully created container

Staging...

Staging process started ...

Failed to talk to docker registry: Get https://mybox1:5000/v2/: dial tcp: lookup mybox1: no such host

Failed to talk to docker registry: Get http://mybox1:5000/v2/: dial tcp: lookup mybox1: no such host

Staging process failed: Exit trace for group:

builder exited with error: failed to fetch metadata from [ubuntu] with tag [latest] and insecure registries [] due to Get http://mybox1:5000/v2/: dial tcp: lookup mybox1: no such host

Exit status 2

Staging Failed: Exited with status 2

FAILED

StagingError

TIP: use 'cf logs ubuntu --recent' for more information

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/106906080.

[tee33]

actually, it would failed even when i use localhost. "getting connection refused", but i am able to telnet to the port 5000 locally.

[emalm]

Hi, @tee33,

My apologies, I could have sworn I responded to this a while ago. It looks like you're unable to resolve the domain name for your registry from within the container. Sending a request to localhost wouldn't work, either, as it would try the loopback device inside the container, not elsewhere on your system. Can you access the registry via its IP address on your system? That might end up being an easier way to address it. If you need to experiment from inside a Diego container, I'd recommend pushing an app and then using cf ssh to get an interactive session inside of its instance container. To communicate with the registry from there, you may also need to set up a security group in Cloud Controller that covers your registry's IP and port and then bind that security group to the app's space for staging and/or running.

Best,
Eric

[emalm]

Closing due to inactivity.

[LaynePeng]

Hi, @tee33 have you solved the problem。 I got the same problem, which report connection refused. However, the cell vm can access the registry.

[emalm]

Hi, @LaynePeng,

If you're seeing a 'connection refused' error when staging a Docker image as a CF app from an internal private registry, it may be that you haven't created and bound a CF security group so that the staging-task container can communicate with the registry. If you still see errors after trying that, please feel free to open a new issue with log output, details of your CF, Diego, and Docker registry deployments, and any other detailed information you think would be helpful in debugging.

Thanks,
Eric, CF Runtime Diego PM

[LaynePeng]

Ya! it is caused by not setting the staging sg. It work after I create and bind the staging sg. One more question, is there any suggestion I put self-sign ca? I found there is a TrustedSystemCertificationsPath setting to /etc/cf-system-certificates. Is it need to build into rootfses? Or somewhere else I can put and garden help me to copy into container?

[emalm]

Hi, @LaynePeng,

CF uses the cflinuxfs2 rootfs for Docker staging tasks, so if you're using Diego 0.1454.0 or later, you can add the self-signed CA to the diego.rootfs_cflinuxfs2.trusted_certs property in the Diego manifest. After you deploy with that manifest change, that CA cert will be installed in the default trust store for all containers based on cflinuxfs2. The builder process that runs in the staging task container will then load it with the other certs in the trust store and make it available when communicating with the Docker registry.

Thanks,
Eric

[LaynePeng]

Okay, This is the answer I waiting for! Thanks for your quick response!

[tee33]

@ematpl @LaynePeng - I think i left it as is, but thank you for the info, i will try again to see if i can it working. @LaynePeng if you get it to work, can you post it, and let me know. thank you.

[LaynePeng]

@tee33 I have get it worked with private insecure registry, and will try self-signed case tmr. To get a insecure registry work, you need:

1. create a sg, add the ip and port to this sg;
2. bind the sg to staging-security-group;
3. add insecureDockerRegistry parameter to both stager and garden components.

[emalm]

Thanks, @LaynePeng and @tee33. I've updated the Diego v0.1454.0 release notes to include more detail on how to use that new property to install the trusted certs.

Best,
Eric

[somashekarg]

somashekar@somashekar:~/Desktop/mssql$ heroku container:push --app mssql-test
Sending build context to Docker daemon 371 MB
Step 1/7 : FROM heroku/heroku:16
---> cc0caac6a5c5
Step 2/7 : FROM microsoft/mssql-server-linux:latest
---> aa104c338ea3
Step 3/7 : EXPOSE 1433
---> Using cache
---> 3e89f2aabd0b
Step 4/7 : ARG user
---> Using cache
---> 80b32c2af42e
Step 5/7 : WORKDIR /var/opt/mssql
---> Using cache
---> 869aa05a0587
Step 6/7 : VOLUME /var/opt/mssql/data /var/opt/mssql/data
---> Using cache
---> 6add8a1f42f3
Step 7/7 : CMD /opt/mssql/bin/sqlservr
---> Using cache
---> 68537ddb86c3
Successfully built 68537ddb86c3
The push refers to a repository [registry.heroku.com/mssql-test/web]
02d9d2901297: Retrying in 1 second
588e319013ef: Retrying in 1 second
7e20a5da50cf: Retrying in 5 seconds
3da04e6301f6: Retrying in 5 seconds
f1e60b0cfe77: Retrying in 1 second
cc31aa8aca7d: Waiting
668724d35c59: Waiting
d7c22be21371: Waiting
c1bd37d01c89: Waiting
943edb549a83: Waiting
bf6751561805: Waiting
f934e33a54a6: Waiting
e7ebc6e16708: Waiting
received unexpected HTTP status: 500 Internal Server Error
! Error: docker push exited with 1
While pushing to heroku private space i am getting this error