使用containerd拉取非安全Harbor镜像仓库镜像报连接拒绝问题

问题复现 #

执行拉取命令：

sudo crictl pull 192.168.12.10/calculator/app2:new

核心报错日志：

FATA[0000] pulling image: rpc error: code = Unknown desc = failed to pull and unpack image "192.168.12.10/calculator/app2:asdf": failed to resolve reference "192.168.12.10/calculator/app2:asdf": failed to do request: Head https://192.168.12.10/v2/calculator/app2/manifests/asdf: dial tcp 192.168.12.10:443: connect: connection refused

根因 #

现有containerd配置中的所有仓库规则都只匹配192.168.12.10:80（带80端口）的地址，但拉取镜像时传入的仓库地址是192.168.12.10（不带端口），containerd对不带端口的仓库地址默认走HTTPS 443端口请求，完全匹配不到已配置的非安全仓库规则，因此直接请求443端口被拒绝。

注意：Docker的insecure-registries配置会自动匹配同IP的所有端口，containerd的仓库规则是严格字符串匹配镜像地址中的host:port段，逻辑不通用，不能直接照搬Docker配置方案。

修复步骤 #

1. 修改/etc/containerd/config.toml配置，将所有仓库匹配项从192.168.12.10:80改为192.168.12.10，修正后的registry配置段如下：

[plugins."io.containerd.grpc.v1.cri".registry]
  config_path = ""

  [plugins."io.containerd.grpc.v1.cri".registry.auths]
  [plugins."io.containerd.grpc.v1.cri".registry.configs]    
    [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.12.10".tls]
      insecure_skip_verify = true    
    [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.12.10".auth]
      username = "admin12"
      password = "Hada123213"
      auth = "YWRtaW4xMjpIYWRhMTIzMjEzCg=="

  [plugins."io.containerd.grpc.v1.cri".registry.headers]

  [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."192.168.12.10"]
      endpoint = ["http://192.168.12.10:80"]

HTTP模式部署的Harbor，endpoint必须明确写http://前缀和实际监听端口，不能省略。
2. 重启containerd加载配置：

sudo systemctl daemon-reload
sudo systemctl restart containerd

3. 重新执行拉取命令验证即可。

排查补充 #

• 若配置修正后仍报错，先在节点执行curl http://192.168.12.10:80/v2/测试连通性：返回401 Unauthorized说明端口连通、鉴权逻辑正常；返回连接拒绝则检查Harbor节点防火墙规则、Harbor服务运行状态、实际监听端口是否为80。
• containerd 1.4+版本推荐使用更轻量的config_path配置方式：在/etc/containerd/certs.d/下新建对应仓库名目录，创建hosts.toml写入规则，修改后无需重启containerd即可生效，配置示例：

# 路径 /etc/containerd/certs.d/192.168.12.10/hosts.toml
server = "http://192.168.12.10:80"

[host."http://192.168.12.10:80"]
  skip_verify = true
  capabilities = ["pull", "resolve", "push"]
  [host."http://192.168.12.10:80".auth]
    username = "admin12"
    password = "Hada123213"

内容的提问来源于stack exchange，提问作者kuber ansible