Does func support TLS-enabled docker hosts?

[riverar]

When attempting to deploy a function to a remote Docker daemon, func attempts to send an HTTP request to an HTTPS-only endpoint. Specifically, the following error is output:

> func version
v1.9.1

> func deploy -v --registry xxx
Building function image
Pulling image gcr.io/paketo-buildpacks/builder:base
Error: failed to fetch builder image 'gcr.io/paketo-buildpacks/builder:base': Error response from daemon: Client sent an HTTP request to an HTTPS server.

My DOCKER_HOST is set to tcp://redacted.host:2376 and DOCKER_TLS_VERIFY is set. I've verified normal docker commands (e.g. docker ls work correctly.)

Windows 10.0.25314.1010

[lance]

@riverar what happens when you docker pull gcr.io/paketo-buildpacks/builder:base?

[riverar]

Hm. I replied too quickly. It previously ran but that's erroring out too.

> docker pull gcr.io/paketo-buildpacks/builder:base
Error response from daemon: Client sent an HTTP request to an HTTPS server

Let me go check on the daemon. This is looking like operator error, apologies.

[matejvasek]

I'll look at this.

[riverar]

OK, I have gotten my system back into the originally reported state.

> docker pull gcr.io/paketo-buildpacks/builder:base
...
f6dca84f435e: Pull complete
72ad9888618d: Pull complete
4f4fb700ef54: Pull complete
Digest: sha256:d7870b73e331d2ba58de0d642a40777284def3c75bd4d90268202b2538028755
Status: Downloaded newer image for gcr.io/paketo-buildpacks/builder:base
gcr.io/paketo-buildpacks/builder:base

> kn-func deploy -v --registry xxx
Building function image
Pulling image gcr.io/paketo-buildpacks/builder:base
Error: failed to fetch builder image 'gcr.io/paketo-buildpacks/builder:base': Error response from daemon: Client sent an HTTP request to an HTTPS server.

Happy to spin up a machine or help with this live/over a call if you don't have Windows resources readily available. Thanks!

[matejvasek]

@riverar does func build work?

[matejvasek]

This is bug in func I think.
RE: DOCKER_TLS_VERIFY -- this only tell to verify or not verify server certificate.

[matejvasek]

@riverar if you are on Linux you can workaround this by using socat.

[matejvasek]

func also support ssh connections

[riverar]

@riverar does func build work?

Sadly no.

kn-func build

   Building function image

2023/03/15 11:06:58.646235 DEBUG:  Pulling image gcr.io/paketo-buildpacks/builder:base

Error: failed to build the function: failed to fetch builder image 'gcr.io/paketo-buildpacks/builder:base': Error response from daemon: Client sent an HTTP request to an HTTPS server.    

Thanks for confirming. socat tcp-listen:2372,fork,reuseaddr openssl:0.0.0.0:2376 is an easy workaround for private use.

[matejvasek]

It seems that the pack CLI also suffers from this too.
Docker client created by client.NewClientWithOpts(client.FromEnv) doesn't seems to work properly with tls.
The Docker CLI must do some more sophisticated initialization.

[matejvasek]

TBH I would expect client.NewClientWithOpts(client.FromEnv) to initialise everything all right.

[riverar]

Agreed. Am I reading this correctly? They only attempt to configure TLS if my DOCKER_HOST is configured without a scheme? https://github.com/docker/docker-ce/blob/master/components/engine/client/client.go#L141-L153

[matejvasek]

From my testing it seems that you need to set DOCKER_TLS_VERIFY. It may be true or false, but it must be set. Then TLS is used with TCP.

[matejvasek]

Also existence of ~/.docker/ca.pem may play a part.