Docker login to Gitlab Registry fails with "http: server gave HTTP response to HTTPS client"

Question

I have 2 EC2s, one with Gitlab-ee installed, another with Docker installed and running Gitlab-Runner and a Registry container.

Gitlab-Runner is working, and picks up the commit to Gitlab, shipping it to docker for it's build phase. However during the build phase when the docker container attempts to login to the Registry container it errors with "http: server gave HTTP response to HTTPS client"

Docker Login code: docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY

Troubleshooting done:

• If I ssh into the server, I can login with sudo docker login localhost:5000
• The same error occurs if the registry is referenced with $CI_REGISTRY / localhost / DNS name
• I ensured the CI_REGISTRY is set in gitlab.rb
• I saw some mentions online about needing to use the --insecure-registries flag in the docker.service Exec line, and I did that as well and get the same error.
• This works if the docker installation is on the same server, but I'm trying to decouple the two applications from each other so they can be managed separately.

Software verions:

• Docker Version: 19.03.6
• Gitlab-ee Version: 12.8.1
• Gitlab-Runner Version: 12.8.0

If anyone could help me on this, it would be greatly appreciated! I've been banging my head against it for 2 days.

Answer 1

I believe this question is lack of details to give you exactly the solution you need. Anyway, I'll try to outline some of issues you might faced.

Registry is configured with HTTP-only

The message "http: server gave HTTP response to HTTPS client" exactly tells that HTTPS client (that is docker login) is expecting TLS (HTTPS) server on socket localhost:5000.

However your registry server is configured with HTTP only and doesn't support TLS. So that's why you server returns HTTP response to HTTPS client.

To solve that follow this official docker guide.

Container's localhost is different from host's localhost

This case is worth to read if you use docker executor in gitlab-runner. It means that your gitlab-runner creates new container for every incoming job.

You didn't share the value of CI_REGISTRY variable. However, I suppose it might be equal to localhost or domain name. Please, note that localhost in container is different from host's localhost because they're located in different network namespaces.

If you set a value of domain name, be sure this domain name is resolvable in container namespace.

Container's Docker daemon is running without insecure-registries flag

You marked that you've tried --insecure-registries flag but with no success. Be sure you've configured it for container's Docker daemon, not host's Docker.

It's exactly the truth if you go along with Docker-in-Docker image for jobs which basically runs a separate Docker daemon.

Hope this information would be useful to anyone who still stuggles...