Sample Header Ad - 728x90

Connection refused for unsecure Gitlab container registry

0 votes
0 answers
1531 views
I'm hosting a gitlab-ce instance with runners on a Ubuntu 22.04.2 LTS server with docker compose :
version: '3.7'
services:
  web:
    image: 'gitlab/gitlab-ce:latest'
    restart: always
    hostname: 'localhost'
    container_name: gitlab-ce
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://192.168.123.178 '
    ports:
      - '80:80'
      - '8443:443'
    volumes:
      - '$GITLAB_HOME/config:/etc/gitlab'
      - '$GITLAB_HOME/logs:/var/log/gitlab'
      - '$GITLAB_HOME/data:/var/opt/gitlab'
    networks:
      - gitlab
  gitlab-runner:
    image: gitlab/gitlab-runner:alpine
    container_name: gitlab-runner
    restart: always
    depends_on:
      - web
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - '$GITLAB_HOME/gitlab-runner:/etc/gitlab-runner'
    networks:
      - gitlab

networks:
  gitlab:
    name: gitlab-network
I enabled container registry on port 5050 from within the gitlab.rb config file mounted to the container:
...
registry_external_url 'http://192.168.123.178:5050 '
...
I can confirm the container registry is enabled since I'm able to use the AutoDevOps feature per project on gitlab. I registered a runner to a project with the following command :
$ sudo docker exec -it gitlab-runner gitlab-runner register --url "http://gitlab-ce " --clone-url "http://gitlab-ce " --registration-token  --executor docker --description "Deployment Runner" --docker-image "docker:stable" --docker-privileged
It generates the following config.toml file :
[[runners]]
  name = "Deployment Runner"
  url = "http://gitlab-ce "
  id = 6
  token = ""
  token_obtained_at = 2023-04-28T13:39:30Z
  token_expires_at = 0001-01-01T00:00:00Z
  executor = "docker"
  clone_url = "http://gitlab-ce "
  [runners.cache]
    MaxUploadedArchiveSize = 0
  [runners.docker]
    tls_verify = false
    image = "docker:stable"
    privileged = true
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/cache"]
    shm_size = 0
    # manually added this
    network_mode = "gitlab-network"
Now I setup a simple html website hosted with an nginx container. This is the .gitlab-ci.yml file I use to test the continuous deployment workflow :
stages:
  - publish
  - deploy

variables:
  TAG_LATEST: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_NAME:latest
  TAG_COMMIT: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_NAME:$CI_COMMIT_SHORT_SHA
  DOCKER_HOST: tcp://docker:2375/
  DOCKER_TLS_CERTDIR: ""

publish:
  image: docker:latest
  stage: publish
  services:
    - name: docker:dind
      command: ["--insecure-registry=localhost:5050"]
      
  script:
    - docker build -t $TAG_COMMIT -t $TAG_LATEST .
    - docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN $CI_REGISTRY
    - docker push $TAG_COMMIT
    - docker push $TAG_LATEST

deploy:
  image: alpine:latest
  stage: deploy
  tags:
    - deployment
  script:
    - chmod og= $ID_RSA
    - apk update && apk add openssh-client
    - ssh -i $ID_RSA -o StrictHostKeyChecking=no $SERVER_USER@$SERVER_IP "docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN $CI_REGISTRY"
    - ssh -i $ID_RSA -o StrictHostKeyChecking=no $SERVER_USER@$SERVER_IP "docker pull $TAG_COMMIT"
    - ssh -i $ID_RSA -o StrictHostKeyChecking=no $SERVER_USER@$SERVER_IP "docker container rm -f my-app || true"
    - ssh -i $ID_RSA -o StrictHostKeyChecking=no $SERVER_USER@$SERVER_IP "docker run -d -p 80:80 --name my-app $TAG_COMMIT"
  environment:
    name: production
    url: http://192.168.123.178 
Although everything seems fine, it returns the following error in the build stage :
...
$ docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN $CI_REGISTRY
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get "https://[MASKED]:5050/v2/ ": dial tcp [MASKED]:5050: connect: connection refused
Cleaning up project directory and file based variables
ERROR: Job failed: exit code 1
## Edit: Forgot to mention that I also declared the unsecured container registry in /etc/docker/deamon.json in the server hosting the docker deamon as follows :
{ "insecure-registries": ["localhost:5050"] }
I don't know if I should do the same on the gitlab-runner containers. I don't know how either.
Asked by Baks (41 rep)
May 4, 2023, 01:31 PM
Last activity: Dec 15, 2023, 11:31 PM