Allow plain HTTP for insecure-registry option

client/push.go

@@ -3,7 +3,9 @@ package client
 import (
 	"context"
 	"fmt"
+	"strings"
 
+	"github.com/containerd/containerd/remotes/docker"
 	"github.com/docker/distribution/reference"
 	"github.com/moby/buildkit/util/push"
 )
@@ -34,5 +36,31 @@ func (c *Client) Push(ctx context.Context, image string, insecure bool) error {
 	if err != nil {
 		return err
 	}
-	return push.Push(ctx, sm, opt.ContentStore, imgObj.Target.Digest, image, insecure, opt.RegistryHosts, false)
+
+	if err := push.Push(ctx, sm, opt.ContentStore, imgObj.Target.Digest, image, insecure, opt.RegistryHosts, false); err != nil {
+		if !isErrHTTPResponseToHTTPSClient(err) {
+			return err
+		}
+
+		if !insecure {
+			return err
+		}
+
+		return push.Push(ctx, sm, opt.ContentStore, imgObj.Target.Digest, image, insecure, registryHostsWithPlainHTTP(), false)
+	}
+	return nil
+}
+
+func isErrHTTPResponseToHTTPSClient(err error) bool {
+	// The error string is unexposed as of Go 1.13, so we can't use `errors.Is`.
+	// https://github.com/golang/go/issues/44855
+
+	const unexposed = "server gave HTTP response to HTTPS client"
+	return strings.Contains(err.Error(), unexposed)
+}
+
+func registryHostsWithPlainHTTP() docker.RegistryHosts {
+	return docker.ConfigureDefaultRegistries(docker.WithPlainHTTP(func(_ string) (bool, error) {
+		return true, nil
+	}))
 }