This was generated by AI during triage.
Summary
a3s-box push currently appears to force HTTPS for registry endpoints. Our production registry is intentionally exposed as plain HTTP behind an internal/edge nginx (10.12.111.133:49164, mirrored in-cluster as registry.a3s.io). The image build succeeds with A3S Box on Linux, but push fails before upload because the registry does not speak TLS.
Environment
- Host: Linux
master-1, linux/amd64
- A3S Box:
3.0.3
- Registry endpoint:
http://10.12.111.133:49164
curl http://10.12.111.133:49164/v2/ succeedscurl -k https://10.12.111.133:49164/v2/ fails with TLS wrong-version-number
Reproduction
a3s-box build --platform linux/amd64 \
-f docker/Dockerfile.web \
-t 10.12.111.133:49164/a3s/web:system-ui-02b60bc-20260709 \
.
a3s-box push 10.12.111.133:49164/a3s/web:system-ui-02b60bc-20260709
Observed:
Pushing 10.12.111.133:49164/a3s/web:system-ui-02b60bc-20260709...
Error: Registry error: 10.12.111.133:49164 - Failed to push image: error sending request for url (https://10.12.111.133:49164/v2/a3s/web/blobs/uploads/)
Expected
A supported way to push to trusted HTTP registries, for example one of:
a3s-box push --plain-http <image>a3s-box push --insecure-registry <host:port> <image>- config under
~/.a3s for trusted insecure registries
- honoring containerd-style
hosts.toml / Docker daemon insecure registry config if that is intended
Impact
This blocks A3S Box-only release flows for clusters whose internal registry is HTTP-only. We had to use the following workaround after building with A3S Box:
a3s-box save -o web.tar 10.12.111.133:49164/a3s/web:system-ui-02b60bc-20260709
ctr images import --no-unpack web.tar
ctr images push --plain-http --user '<registry-user:registry-password>' \
10.12.111.133:49164/a3s/web:system-ui-02b60bc-20260709
That workaround is not ideal because publishing leaves the A3S Box CLI path and requires separate registry auth handling.
Summary
a3s-box pushcurrently appears to force HTTPS for registry endpoints. Our production registry is intentionally exposed as plain HTTP behind an internal/edge nginx (10.12.111.133:49164, mirrored in-cluster asregistry.a3s.io). The image build succeeds with A3S Box on Linux, but push fails before upload because the registry does not speak TLS.Environment
master-1,linux/amd643.0.3http://10.12.111.133:49164curl http://10.12.111.133:49164/v2/succeedscurl -k https://10.12.111.133:49164/v2/fails with TLS wrong-version-numberReproduction
a3s-box build --platform linux/amd64 \ -f docker/Dockerfile.web \ -t 10.12.111.133:49164/a3s/web:system-ui-02b60bc-20260709 \ . a3s-box push 10.12.111.133:49164/a3s/web:system-ui-02b60bc-20260709Observed:
Expected
A supported way to push to trusted HTTP registries, for example one of:
a3s-box push --plain-http <image>a3s-box push --insecure-registry <host:port> <image>~/.a3sfor trusted insecure registrieshosts.toml/ Docker daemon insecure registry config if that is intendedImpact
This blocks A3S Box-only release flows for clusters whose internal registry is HTTP-only. We had to use the following workaround after building with A3S Box:
a3s-box save -o web.tar 10.12.111.133:49164/a3s/web:system-ui-02b60bc-20260709 ctr images import --no-unpack web.tar ctr images push --plain-http --user '<registry-user:registry-password>' \ 10.12.111.133:49164/a3s/web:system-ui-02b60bc-20260709That workaround is not ideal because publishing leaves the A3S Box CLI path and requires separate registry auth handling.