<p>I have a problem when I pull images from insecure registries(in my case, it is harbor). I receive a connection refused error when I use the command below.</p>
<pre><code>sudo crictl pull  192.168.12.10/calculator/app2:new

</code></pre>
<p>Below is the full error message:</p>
<pre><code>DEBU[0000] get image connection                         
DEBU[0000] connect using endpoint 'unix:///run/containerd/containerd.sock' with '2s' timeout 
DEBU[0000] connected successfully using endpoint: unix:///run/containerd/containerd.sock 
DEBU[0000] PullImageRequest: &amp;PullImageRequest{Image:&amp;ImageSpec{Image:192.168.12.10/calculator/app2:asdf,Annotations:map[string]string{},},Auth:nil,SandboxConfig:nil,} 
DEBU[0000] PullImageResponse: nil                       
FATA[0000] pulling image: rpc error: code = Unknown desc = failed to pull and unpack image &quot;192.168.12.10/calculator/app2:asdf&quot;: failed to resolve reference &quot;192.168.12.10/calculator/app2:asdf&quot;: failed to do request: Head https://192.168.12.10/v2/calculator/app2/manifests/asdf: dial tcp 192.168.12.10:443: connect: connection refused

</code></pre>
<p>Added configuration to '/etc/containerd/config.toml' like this</p>
<pre><code>    [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]
      config_path = &quot;&quot;

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.auths]
      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs]    
        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs.&quot;192.168.12.10:80&quot;.tls]
          insecure_skip_verify = true    
        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs.&quot;192.168.12.10:80&quot;.auth]
          username = &quot;admin12&quot;
          password = &quot;Hada123213&quot;
          auth = &quot;YWRtaW4xMjpIYWRhMTIzMjEzCg==&quot;

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.headers]

      [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]
        [plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;192.168.12.10:80&quot;]
          endpoint = [&quot;http://192.168.12.10:80&quot;]

</code></pre>
<p>To configure this file, I use the below like on stack overflow and github:</p>
<p><a href="https://rb.gy/o5axte" rel="nofollow noreferrer">source one</a></p>
<p><a href="https://rb.gy/ayzvck" rel="nofollow noreferrer">source two</a></p>
<p>In my search on the web, more than 95 percent of websites said to add the insecure registry to /etc/docker/daemon.json to resolve this problem.</p>
<p>but its about docker not contaierd.</p>

kuber ansible
<p>Per <a href="https://github.com/containerd/containerd/blob/main/docs/hosts.md" rel="nofollow noreferrer">https://github.com/containerd/containerd/blob/main/docs/hosts.md</a></p>
<blockquote>
<p>The old CRI config pattern for specifying registry.mirrors and registry.configs has been DEPRECATED. You should now point your registry config_path to the path where your hosts.toml files are located.</p>
</blockquote>
<p>The right way to setup should be (in my example <code>http://172.31.0.36</code> is the private insecure registry):</p>
<pre class="lang-bash prettyprint-override"><code>$ tree
.
├── certs.d
│   └── 172.31.0.36
│       └── hosts.toml
└── config.toml
</code></pre>
<p>where <code>config.toml</code> should include</p>
<pre class="lang-ini prettyprint-override"><code>version = 2

[plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry]
   config_path = &quot;/etc/containerd/certs.d&quot;
</code></pre>
<p>and in <code>hosts.toml</code>:</p>
<pre class="lang-ini prettyprint-override"><code>server = &quot;http://172.31.0.36&quot;

[host.&quot;http://172.31.0.36&quot;]
  skip_verify = true
</code></pre>
<p>Restart the <code>containerd</code> service:</p>
<pre class="lang-bash prettyprint-override"><code>$ sudo systemctl restart containerd
</code></pre>
<p>To confirm it works:</p>
<pre class="lang-bash prettyprint-override"><code>$ sudo crictl pull 172.31.0.36/newpathfly/hello-world
Image is up to date for sha256:feb5d9fea6a5e9606aa995e879d862b825965ba48de054caab5ef356dc6b3412
</code></pre>
