Unable to log in to private registry

[wzxmt]

Description

Cannot log in to private registry, but can log in through docker

Steps to reproduce the issue

1.nerdctl

[root@m1 ~]# cat /etc/containerd/certs.d/registry.wzxmt.com/hosts.toml
server = "https://registry.wzxmt.com"
[host."https://registry.wzxmt.com"]
capabilities = ["pull", "resolve", "push"]
skip_verify = true
[root@m1 ~]# nerdctl login -u admin -p admin --insecure-registry registry.wzxmt.com
WARN[0000] WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARN[0000] skipping verifying HTTPS certs for "registry.wzxmt.com:443"
ERRO[0000] failed to call tryLoginWithRegHost error="failed to call rh.Authorizer.AddResponses: expected acArg to be "registry.wzxmt.com:443", got "registry.wzxmt.com"" i=0
ERRO[0000] failed to call tryLoginWithRegHost error="failed to call rh.Authorizer.AddResponses: expected acArg to be "registry.wzxmt.com:443", got "registry.wzxmt.com"" i=1
FATA[0000] failed to call rh.Authorizer.AddResponses: expected acArg to be "registry.wzxmt.com:443", got "registry.wzxmt.com"

2.docker

[root@ad02 ~]# grep insecure-registries /etc/docker/daemon.json
"insecure-registries":["registry.wzxmt.com"],
[root@ad02 ~]# docker login -u admin -p admin registry.wzxmt.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

Describe the results you received and expected

none

What version of nerdctl are you using?

[root@m1 ~]# nerdctl version
Client:
Version: v2.0.3
OS/Arch: linux/amd64
Git commit: ce61fc4
buildctl:
Version: v0.18.2
GitCommit: e4da654b1251f91e914fab18eba33743aefd7080

Server:
containerd:
Version: v2.0.3
GitCommit: 06b99ca80cdbfbc6cc8bd567021738c9af2b36ce
runc:
Version: 1.2.4
GitCommit: v1.2.4-0-g6c52b3fc

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

[root@m1 ~]# nerdctl info
Client:
Namespace: k8s.io
Debug Mode: false

Server:
Server Version: v2.0.3
Storage Driver: overlayfs
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Log: fluentd journald json-file none syslog
Storage: native overlayfs
Security Options:
seccomp
Profile: builtin
cgroupns
Kernel Version: 5.14.0-427.13.1.el9_4.x86_64
Operating System: Rocky Linux 9.4 (Blue Onyx)
OSType: linux
Architecture: x86_64
CPUs: 6
Total Memory: 7.724GiB
Name: m1
ID: 3d928b70-dfb1-46b8-84ae-fa3e9800f163

[wzxmt]

It is possible to push the image through ctr login:

[root@m1 ~]# ctr images push -k --local --user admin registry.wzxmt.com/myapp:v2
Password:
manifest-sha256:85a2b81a62f09a414ea33b74fb8aa686ed9b168294b26b4c819df0be0712d358: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:fe78b5db7c4ec8860a5e211b9c7f1492f319ee4347cb6548728752179c609176: done |++++++++++++++++++++++++++++++++++++++|
config-sha256:54202d3f0f3593ea1083e1f2073821c8bad41704767756fad94f23304b057774: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:af3988949040d4843cce89896dbc55cc29c1ffabf917167ebabe4214e6e66233: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:d6642feac7289087182c44548776c392c5cf9ccc73289541335b4c4634670c70: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:550fe1bea624a5c62551cf09f3aa10886eed133794844af1dfb775118309387e: done |++++++++++++++++++++++++++++++++++++++|
layer-sha256:c20f0a205eaa02418dc50ce73e8f0dcd680aee77e04338b81b5d92117e6f9d49: done |++++++++++++++++++++++++++++++++++++++|
elapsed: 1.1 s

[PKizzle]

I can confirm that I am also not able to use nerdctl to login to a private registry and receive a weird 503 status code error even though the registry is accessible via curl perfectly fine.

Using either docker login or directly pushing using ctr works as expected.

[apostasie]

I can confirm that I am also not able to use nerdctl to login to a private registry and receive a weird 503 status code error even though the registry is accessible via curl perfectly fine.

Using either docker login or directly pushing using ctr works as expected.

Receiving a 503 is very likely a different issue (probably with your registry configuration).
I suggest you open a new ticket with appropriate details.

[PKizzle]

@apostasie I have opened #4050

[xianyuwu]

I've opened a fix for this: #5128. The strict acArg == host check in pkg/cmd/login/login.go breaks whenever Parse() appends the default :443 but the authorizer calls back with the port-less request host (same root cause as #3245).