<p>Trying to add insecure registry to containerd config as below:</p>
<pre><code>[plugins.&quot;io.containerd.grpc.v1.cri&quot;.cni]
      bin_dir = &quot;/opt/cni/bin&quot;
      conf_dir = &quot;/etc/cni/net.d&quot;
      max_conf_num = 1
      conf_template = &quot;&quot;
    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]
      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]
        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;docker.io&quot;]
          endpoint = [&quot;https://registry-1.docker.io&quot;]
        [plugin.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;test.http-registry.io&quot;]
          endpoint = [&quot;http://v048011.dom600.lab:5000&quot;]
</code></pre>
<p>Even after adding it to <code>config.toml</code>, when pulling image from the insecure registry, it fails:</p>
<pre><code>sudo ctr image pull v048011.dom600.lab:5000:5000/myjenkins:latest

ctr: failed to resolve reference &quot;v048011.dom600.lab:5000/myjenkins:latest&quot;: failed to do request: Head https://v048011.dom600.lab:5000:5000/v2/myjenkins/manifests/latest: http: server gave HTTP response to HTTPS client
</code></pre>
<p>In <code>docker</code> we could just add the <code>insecure registry</code> to <code>daemon.json</code> file and docker would pull images from it, how can i achieve the same in <code>containerd</code> ?
Replacing docker as runtime in k8s cluster.</p>

<p><code>ctr</code> <strong>does not</strong> read the <code>/etc/containerd/config.toml</code>  config  file, this config is used by cri, which means <code>kubectl</code> or <code>crictl</code> would use it.</p>
<p>The error log <code>http: server gave HTTP response to HTTPS client</code>, shows that the registry is using http, but <code>ctr</code> is trying to connect it using https.  So if you want to pull the image from http, you should add the param <code>--plain-http</code> with <code>ctr</code> like this:</p>
<pre><code>$ ctr i pull --plain-http &lt;image&gt;
</code></pre>
<p>The registry config doc is <a href="https://github.com/containerd/containerd/blob/master/docs/cri/registry.md" rel="noreferrer">here</a>.</p>
<p>You should be able to pull the image with <code>crictl</code>, remember to restart containerd.</p>
<pre><code>$ sudo crictl -r /run/containerd/containerd.sock pull &lt;image&gt;

# or config runntime once for all
$ sudo crictl config runtime-endpoint /run/containerd/containerd.sock
$ sudo crictl pull &lt;image&gt;
</code></pre>
<p>Config example:</p>
<pre><code># /etc/containerd/config.toml
# change &lt;IP&gt;:5000 to your registry url

[plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]
  [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]
    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;&lt;IP&gt;:5000&quot;]
      endpoint = [&quot;http://&lt;IP&gt;:5000&quot;]
  [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs]
    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs.&quot;&lt;IP&gt;:5000&quot;.tls]
      insecure_skip_verify = true
</code></pre>
<p>Restart the service after configuration modification.</p>
<pre class="lang-bash prettyprint-override"><code>$ sudo systemctl restart containerd
</code></pre>
