<p>I've been looking at different references on how to enable k3s (running on my pi) to pull docker images from a private registry on my home network (server laptop on my network). If someone can please point my head in the right direction? This is my approach:</p>
<ol>
<li>Created the docker registry on my server (and making accessible via port 10000):</li>
</ol>
<pre><code>docker run -d -p 10000:5000 --restart=always --local-docker-registry registry:2
</code></pre>
<p>This worked, and was able to push-pull images to it from the &quot;server pc&quot;. I didn't add authentication TLS etc. yet...</p>
<p>(viewing the images via docker plugin on VS Code).</p>
<p><a href="https://i.stack.imgur.com/8zhgy.png" rel="noreferrer"><img src="https://i.stack.imgur.com/8zhgy.png" alt="registry docker image" /></a></p>
<ol start="2">
<li>Added the inbound firewall rule on my laptop server, and tested that the registry can be 'seen' from my pi (so this also works):</li>
</ol>
<pre><code>$ curl -ks http://&lt;server IP&gt;:10000/v2/_catalog
{&quot;repositories&quot;:[&quot;tcpserialpassthrough&quot;]}
</code></pre>
<ol start="3">
<li>Added the registry link to k3s (k3s running on my pi) in registries.yaml file, and restarted k3s and the pi</li>
</ol>
<pre><code>$ cat /etc/rancher/k3s/registries.yaml
mirrors:
  pwlaptopregistry:
    endpoint:
      - &quot;http://&lt;host IP here&gt;:10000&quot;
</code></pre>
<ol start="4">
<li>Putting the registry prefix to my image endpoint on a deployment manifest:</li>
</ol>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: tcpserialpassthrough
spec:
  selector:
    matchLabels:
      app: tcpserialpassthrough
  replicas: 1
  template:
    metadata:
      labels:
        app: tcpserialpassthrough
    spec:
      containers:
      - name: tcpserialpassthrough
        image: pwlaptopregistry/tcpserialpassthrough:vers1.3-arm
        resources:
          limits:
            memory: &quot;128Mi&quot;
            cpu: &quot;500m&quot;
        ports:
        - containerPort: 8001
          hostPort: 8001
          protocol: TCP
        command: [&quot;dotnet&quot;, &quot;/app/TcpConnector.dll&quot;]
</code></pre>
<p>However, when I check the deployment startup sequence, it's still not able to pull the image (and possibly also still referencing docker hub?):</p>
<pre><code>kubectl get events -w
LAST SEEN   TYPE      REASON             OBJECT                                      MESSAGE
8m24s       Normal    SuccessfulCreate   replicaset/tcpserialpassthrough-88fb974d9   Created pod: tcpserialpassthrough-88fb974d9-b88fc
8m23s       Warning   FailedScheduling   pod/tcpserialpassthrough-88fb974d9-b88fc    0/1 nodes are available: 1 node(s) didn't have free ports for the requested pod ports.
8m23s       Warning   FailedScheduling   pod/tcpserialpassthrough-88fb974d9-b88fc    0/1 nodes are available: 1 node(s) didn't have free ports for the requested pod ports.
8m21s       Normal    Scheduled          pod/tcpserialpassthrough-88fb974d9-b88fc    Successfully assigned default/tcpserialpassthrough-88fb974d9-b88fc to raspberrypi
6m52s       Normal    Pulling            pod/tcpserialpassthrough-88fb974d9-b88fc    Pulling image &quot;pwlaptopregistry/tcpserialpassthrough:vers1.3-arm&quot;
6m50s       Warning   Failed             pod/tcpserialpassthrough-88fb974d9-b88fc    Error: ErrImagePull
6m50s       Warning   Failed             pod/tcpserialpassthrough-88fb974d9-b88fc    Failed to pull image &quot;pwlaptopregistry/tcpserialpassthrough:vers1.3-arm&quot;: rpc error: code = Unknown desc = failed to pull and unpack image &quot;docker.io/pwlaptopregistry/tcpserialpassthrough:vers1.3-arm&quot;: failed to resolve reference &quot;docker.io/pwlaptopregistry/tcpserialpassthrough:vers1.3-arm&quot;: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
6m3s        Normal    BackOff            pod/tcpserialpassthrough-88fb974d9-b88fc    Back-off pulling image &quot;pwlaptopregistry/tcpserialpassthrough:vers1.3-arm&quot;
3m15s       Warning   Failed             pod/tcpserialpassthrough-88fb974d9-b88fc    Error: ImagePullBackOff

</code></pre>
<p>Wondered if the issue is with authorization, and added based on basic auth, following <a href="https://www.youtube.com/watch?v=r15S2tBevoE&amp;ab_channel=JustmeandOpensource" rel="noreferrer">this youtube guide</a>, but the same issue persists.
Also noted that that <strong>/etc/docker/daemon.json</strong> must be edited to allow unauthorized, non-TLS connections, via:</p>
<pre><code>{
  &quot;Insecure-registries&quot;: [ &quot;&lt;host IP&gt;:10000&quot; ]
}
</code></pre>
<blockquote>
<p>but seemed that this needs to be done on node side, whereas nodes don't have docker cli installed??</p>
</blockquote>

<p>... this is so stupid, have no idea why a domain name and port needs to be specified as the &quot;name&quot; of your referred registry, but anyway this solved my issue (for reference):</p>
<pre><code>$cat /etc/rancher/k3s/registries.yaml
mirrors:
  &quot;&lt;host IP&gt;:10000&quot;:
    endpoint:
      - &quot;http://&lt;host IP&gt;:10000&quot;
</code></pre>
<blockquote>
<p>and restarting k3s:</p>
<p>systemctl restart k3s</p>
</blockquote>
<p>Then in your deployment, referring to that in your image path as:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: tcpserialpassthrough
spec:
  selector:
    matchLabels:
      app: tcpserialpassthrough
  replicas: 1
  template:
    metadata:
      labels:
        app: tcpserialpassthrough
    spec:
      containers:
      - name: tcpserialpassthrough
        image: &lt;host IP&gt;:10000/tcpserialpassthrough:vers1.3-arm
        resources:
          limits:
            memory: &quot;128Mi&quot;
            cpu: &quot;500m&quot;
        ports:
        - containerPort: 8001
          hostPort: 8001
          protocol: TCP
        command: [&quot;dotnet&quot;, &quot;/app/TcpConnector.dll&quot;]
      imagePullSecrets:
      - name: mydockercredentials
</code></pre>
<blockquote>
<p>referring to registry's basic auth details saved as a secret:</p>
<p>$ kubectl create secret docker-registry <strong>mydockercredentials</strong> --docker-server <em>host IP</em>:10000 --docker-username <em>username</em> --docker-password <em>password</em></p>
</blockquote>
<p>You'll be able to verify the pull process via</p>
<blockquote>
<p>$ kubectl get events -w</p>
</blockquote>
