Docker: tiempo de espera de apretón de manos TLS

Question

Dec 14, 2015, 09:10 AM

Docker: tiempo de espera de apretón de manos TLS

He creado mi propio registro privado (registro privado) pero no puedo insertar imágenes en él. De lo que me sale el siguiente error:

The push refers to a repository [private-registry:5000/ubuntu] (len: 1)
unable to ping registry endpoint https://private-registry:5000/v0/
v2 ping attempt failed with error: Get https://private-registry:5000/v2/: net/http: TLS handshake timeout
 v1 ping attempt failed with error: Get https://private-registry:5000/v1/_ping: net/http: TLS handshake timeout

Los registros del registro en ejecución muestran lo siguiente:

time="2015-12-14T07:59:21Z" level=warning msg="No HTTP secret provided - generated random secret. This may cause problems with uploads if multiple registries are behind a load-balancer. To provide a shared secret, fill in http.secret in the configuration file or set the REGISTRY_HTTP_SECRET environment variable." go.version=go1.5.2 instance.id=a77e1955-3688-4fe3-a06e-0341787f8d0f version=v2.2.1 
time="2015-12-14T07:59:21Z" level=info msg="redis not configured" go.version=go1.5.2 instance.id=a77e1955-3688-4fe3-a06e-0341787f8d0f version=v2.2.1 
time="2015-12-14T07:59:21Z" level=info msg="using inmemory blob descriptor cache" go.version=go1.5.2 instance.id=a77e1955-3688-4fe3-a06e-0341787f8d0f version=v2.2.1 
time="2015-12-14T07:59:21Z" level=info msg="listening on [::]:5000, tls" go.version=go1.5.2 instance.id=a77e1955-3688-4fe3-a06e-0341787f8d0f version=v2.2.1 
time="2015-12-14T07:59:21Z" level=info msg="Starting upload purge in 47m0s" go.version=go1.5.2 instance.id=a77e1955-3688-4fe3-a06e-0341787f8d0f version=v2.2.1

No puedo curvar mi registro (tiempo de espera). Estos son los pasos que realicé:

Primero he creado certificados autofirmados:

mkdir -p certs && openssl req \
  -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
  -x509 -days 365 -out certs/domain.crt

He creado mi registro, que utilizará estos certificados:

docker run -d -p 5000:5000 --restart=always --name private-registry \
  -v `pwd`/certs:/certs \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=certs/domain.crt \
  -e REGISTRY_HTTP_TLS_KEY=certs/domain.key \
  registry:2

Le di los permisos correctos:

chcon -Rt svirt_sandbox_file_t ~certs/

He creado:/etc/docker/etc.d/private-registry:5000/ Y copié midomain.crt en eso. He editado mi/etc/hosts y agregado:10.0.0.X private-registry (mi ip interna y el nombre de mi registro)

También reinicié docker y mi registro.

EDITAR:

[centos@ ~]$ curl -v private-registry:5000
* About to connect() to private-registry port 5000 (#0)
*   Trying 10.0.0.xx...
* Connected to private-registry (10.0.0.xx) port 5000 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: private-registry:5000
> Accept: */*
> 

* Connection #0 to host private-registry left intact
[centos@~]$ curl -v https://private-registry:5000
* About to connect() to private-registry port 5000 (#0)
*   Trying 10.0.0.xx...
* Connected to private-registry (10.0.0.xx) port 5000 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
      CApath: none
    * NSS error -5990 (PR_IO_TIMEOUT_ERROR)
* I/O operation timed out
* Closing connection 0
curl: (35) I/O operation timed out