From 4f414407de483254c28b78dbe591b95a7326a34c Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Wed, 2 Sep 2026 16:26:00 +0530 Subject: [PATCH] Mark harbor-core as an insecure registry for dockerd MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit docker push was hanging: "Client.Timeout exceeded while awaiting headers" doing a TLS handshake against harbor-core.harbor.svc.cluster.local, which only ever speaks plain HTTP (TLS disabled cluster-wide by design). Docker defaults to HTTPS for any bare registry hostname regardless of network path — that default has nothing to do with whether traffic routes through Contour/Ingress, contrary to what an earlier pending-items note assumed. Adds --insecure-registry to the dind container's dockerd startup args. --- resources/org/homelab/dind-pod.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/resources/org/homelab/dind-pod.yaml b/resources/org/homelab/dind-pod.yaml index 0704cad..f6a3d33 100644 --- a/resources/org/homelab/dind-pod.yaml +++ b/resources/org/homelab/dind-pod.yaml @@ -15,6 +15,16 @@ spec: image: docker:27-dind securityContext: privileged: true + # Harbor's harbor-core Service serves plain HTTP internally (TLS is + # disabled cluster-wide by design — see claude.md's "everything is + # plain HTTP" note). Docker still defaults to attempting HTTPS + # against any bare registry hostname regardless of whether the + # network path actually involves TLS anywhere — that default isn't + # about routing through Contour/Ingress, it's just the client's own + # convention. Without this flag, `docker push` hangs doing a TLS + # handshake against a server that's only ever spoken HTTP. + args: + - "--insecure-registry=harbor-core.harbor.svc.cluster.local" env: - name: DOCKER_TLS_CERTDIR value: ""