Doesn't seem to work with registry

[tpitman]

I am trying to use a local docker registry to hold my challenges.

I added this to my docker-compose.yml that you provided:

  registry:
      image: registry:2
      ports:
        - "12982:5000" # Maps host port 12982 to container port 5000

I then built and pushed a challenge from StormCTF to this repository and that works great.

I then ensured that my host's docker is available and CTFd can contact it. I went through quite a day getting that all working, but it seems to work.

Now I am getting this set of errors when I try to hit submit on the docker_challenges admin site:

nginx-1     | 172.18.0.3 - - [29/Oct/2025:21:48:44 +0000] "GET /images/json?all=1 HTTP/1.1" 404 2590 "-" "python-requests/2.32.4"
ctfd-1      | 172.18.0.3 - - [29/Oct/2025:21:48:44 +0000] "GET /images/json?all=1 HTTP/1.0" 404 10190 "-" "python-requests/2.32.4"
ctfd-1      | Traceback (most recent call last):
ctfd-1      |   File "/opt/venv/lib/python3.11/site-packages/requests/models.py", line 976, in json
ctfd-1      |     return complexjson.loads(self.text, **kwargs)
ctfd-1      |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ctfd-1      |   File "/usr/local/lib/python3.11/json/__init__.py", line 346, in loads
ctfd-1      |     return _default_decoder.decode(s)
ctfd-1      |            ^^^^^^^^^^^^^^^^^^^^^^^^^^
ctfd-1      |   File "/usr/local/lib/python3.11/json/decoder.py", line 337, in decode
ctfd-1      |     obj, end = self.raw_decode(s, idx=_w(s, 0).end())
ctfd-1      |                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ctfd-1      |   File "/usr/local/lib/python3.11/json/decoder.py", line 355, in raw_decode
ctfd-1      |     raise JSONDecodeError("Expecting value", s, err.value) from None
ctfd-1      | json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
ctfd-1      | 
ctfd-1      | During handling of the above exception, another exception occurred:
ctfd-1      | 
ctfd-1      | Traceback (most recent call last):
ctfd-1      |   File "/opt/CTFd/CTFd/plugins/docker_challenges/__init__.py", line 145, in docker_config
ctfd-1      |     repos = get_repositories(docker)
ctfd-1      |             ^^^^^^^^^^^^^^^^^^^^^^^^
ctfd-1      |   File "/opt/CTFd/CTFd/plugins/docker_challenges/__init__.py", line 268, in get_repositories
ctfd-1      |     for i in r.json():
ctfd-1      |              ^^^^^^^^
ctfd-1      |   File "/opt/venv/lib/python3.11/site-packages/requests/models.py", line 980, in json
ctfd-1      |     raise RequestsJSONDecodeError(e.msg, e.doc, e.pos)
ctfd-1      | requests.exceptions.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
ctfd-1      | 192.168.65.1 - - [29/Oct/2025:21:48:44 +0000] "GET /admin/docker_config HTTP/1.1" 200 7791 "http://localhost:8000/admin/config?" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36"
c

Gemini seems to think this is an issue with the compatibility between the repository and your plugin, but we all know AI can give false responses.

I don't know enough myself, so I am asking here.

[offsecginger]

I'm just on my phone currently but from what I can see the traceback starts because it was expecting a JSON response and didn't get one. I'd swap that to `r.content` (or print it above the r.json() call) if you wanna do some crude debugging to see what it's receiving. There are definitely better ways to do it but it's what I'd probably do to initially troubleshoot.

…

On Wed, Oct 29, 2025, 5:59 PM tpitman ***@***.***> wrote: *tpitman* created an issue (offsecginger/CTFd-Docker-Challenges#38) <#38> I am trying to use a local docker registry to hold my challenges. I added this to my docker-compose.yml that you provided: registry: image: registry:2 ports: - "12982:5000" # Maps host port 12982 to container port 5000 I then built and pushed a challenge from StormCTF to this repository and that works great. I then ensured that my host's docker is available and CTFd can contact it. I went through quite a day getting that all working, but it seems to work. Now I am getting this set of errors when I try to hit submit on the docker_challenges admin site: nginx-1 | 172.18.0.3 - - [29/Oct/2025:21:48:44 +0000] "GET /images/json?all=1 HTTP/1.1" 404 2590 "-" "python-requests/2.32.4" ctfd-1 | 172.18.0.3 - - [29/Oct/2025:21:48:44 +0000] "GET /images/json?all=1 HTTP/1.0" 404 10190 "-" "python-requests/2.32.4" ctfd-1 | Traceback (most recent call last): ctfd-1 | File "/opt/venv/lib/python3.11/site-packages/requests/models.py", line 976, in json ctfd-1 | return complexjson.loads(self.text, **kwargs) ctfd-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ctfd-1 | File "/usr/local/lib/python3.11/json/__init__.py", line 346, in loads ctfd-1 | return _default_decoder.decode(s) ctfd-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^ ctfd-1 | File "/usr/local/lib/python3.11/json/decoder.py", line 337, in decode ctfd-1 | obj, end = self.raw_decode(s, idx=_w(s, 0).end()) ctfd-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ctfd-1 | File "/usr/local/lib/python3.11/json/decoder.py", line 355, in raw_decode ctfd-1 | raise JSONDecodeError("Expecting value", s, err.value) from None ctfd-1 | json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) ctfd-1 | ctfd-1 | During handling of the above exception, another exception occurred: ctfd-1 | ctfd-1 | Traceback (most recent call last): ctfd-1 | File "/opt/CTFd/CTFd/plugins/docker_challenges/__init__.py", line 145, in docker_config ctfd-1 | repos = get_repositories(docker) ctfd-1 | ^^^^^^^^^^^^^^^^^^^^^^^^ ctfd-1 | File "/opt/CTFd/CTFd/plugins/docker_challenges/__init__.py", line 268, in get_repositories ctfd-1 | for i in r.json(): ctfd-1 | ^^^^^^^^ ctfd-1 | File "/opt/venv/lib/python3.11/site-packages/requests/models.py", line 980, in json ctfd-1 | raise RequestsJSONDecodeError(e.msg, e.doc, e.pos) ctfd-1 | requests.exceptions.JSONDecodeError: Expecting value: line 1 column 1 (char 0) ctfd-1 | 192.168.65.1 - - [29/Oct/2025:21:48:44 +0000] "GET /admin/docker_config HTTP/1.1" 200 7791 "http://localhost:8000/admin/config?" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" c Gemini seems to think this is an issue with the compatibility between the repository and your plugin, but we all know AI can give false responses. I don't know enough myself, so I am asking here. — Reply to this email directly, view it on GitHub <#38>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKDBESICF7L6W6RHCDMJFD32E2FRAVCNFSM6AAAAACKTGHRE6VHI2DSMVQWIX3LMV43ASLTON2WKOZTGU3DQMBWGA3DKMI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[tpitman]

Thank you for your response.

It looks like I don't have the correct docker setup to be able to query the right thing.

I am getting HTML back.

I am not sure how to set up the connection to the right docker thing.

On a fresh install of CTFd and docker_challenges I tried just going into the docker challenges config and in the host field put localhost. That wasn't able to query anything.

I am trying to use a local registry, so I added the above registry to the docker compose file and that is a working registry.

I guess I just don't have the right way of setting the connection to it.

In the docker-compose.yml I have this:

DOCKER_HOST=unix:///var/run/docker.sock

and this in volumes:

/var/run/docker.sock:/var/run/docker.sock

What is the proper way to connect to docker and get the images?

If I do the following on the command line in my mac terminal:

curl --unix-socket /var/run/docker.sock 'http://localhost/v1.44/images/json?all=1'

I get JSON, so that is the correct location.

I am sure I am just setting up something wrong. Please advise.

[tpitman]

Turns out the whole issue was that I wanted to have a local repository embedded in the docker compose that could contain the challenges. I didn't want to have to load the challenges into the host docker. This way I could encapsulate everything in one place.

Not knowing anything about CTFd and your plugin I didn't understand what all was going on.

Now that I have dug into it I see what is going on. Your plugin has to be talking to the host docker all the way through.

I am now just trying to figure out the best way to do that on Mac because docker desktop on mac doesn't seem to expose itself to http. It only exposes itself to a socket.

Thank you for the great plugin. I got it working to where it can list all of the repos. I am getting errors when trying to start up a challenge, but should be able to work through it.

[offsecginger]

It may take a source code change, but you should be able to point the plugin to the socket and have similar results but I don't know if the docker daemon on the local socket will respond via json, plus all the plugin stuff is done through the requests module so it's all HTTP.

…

On Fri, Oct 31, 2025, 9:40 AM tpitman ***@***.***> wrote: *tpitman* left a comment (offsecginger/CTFd-Docker-Challenges#38) <#38 (comment)> Turns out the whole issue was that I wanted to have a local repository embedded in the docker compose that could contain the challenges. I didn't want to have to load the challenges into the host docker. This way I could encapsulate everything in one place. Not knowing anything about CTFd and your plugin I didn't understand what all was going on. Now that I have dug into it I see what is going on. Your plugin has to be talking to the host docker all the way through. I am now just trying to figure out the best way to do that on Mac because docker desktop on mac doesn't seem to expose itself to http. It only exposes itself to a socket. Thank you for the great plugin. I got it working to where it can list all of the repos. I am getting errors when trying to start up a challenge, but should be able to work through it. — Reply to this email directly, view it on GitHub <#38 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKDBEXYATTML23YIS7H42332NRDFAVCNFSM6AAAAACKTGHRE6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTINZTGEZTSOJQGQ> . You are receiving this because you commented.Message ID: ***@***.***>

[tpitman]

I noticed that. It is ok. I will figure it out.

Thanks!

[tpitman]

Sorry to bug you again. I am working through the changes to make my local copy compatible. I am at the point where it actually spins up a docker container with the image that I have pushed to docker.

UPDATE: I thought it was spinning up a container. There was a running container and I had never started one, so I am not sure where it came from. I stopped that container and started all over with a new challenge using the image and this time it isn't starting a container, but I am not getting any errors.

I then see this dialog:

I am not sure how to get to it so I can view the challenge that should be exposed.

I also see the container in docker, but it doesn't have any ports exposed and mapped to the container ports. Should it?

I don't know enough about your plugin or CTFd to know what I would do next. Should the challenge docker be embedded in a page in CTFd or should it open a separate browser tab / window or is the user supposed to use the information from the image above (host and ip/port) to open their own window?

Please let me know how it should work next and where to see what I need to change in the python code.

Thanks!

[offsecginger]

There have been a ton of changes done to this plugin by the community so there's some things I'd have to dig into but the synopsis is: It chooses a random port to expose. If that port is unavailable at spin up, it tries to choose another one. It should be tied to the team/player account depending on the ctfd config you selected. If it's not deploying with an exposed port it is likely skipping that step or erroring out but continuing on anyway. It should display to the player on the challenge card in the flag submission modal. I'm still just on my phone so I can't be too much more help but I hope this gives you a place to start looking

…

On Fri, Oct 31, 2025, 2:31 PM tpitman ***@***.***> wrote: *tpitman* left a comment (offsecginger/CTFd-Docker-Challenges#38) <#38 (comment)> Sorry to bug you again. I am working through the changes to make my local copy compatible. I am at the point where it actually spins up a docker container with the image that I have pushed to docker. I then see this dialog: image.png (view on web) <https://github.com/user-attachments/assets/69e68791-5786-42e3-b820-34a9f9ad197d> I am not sure how to get to it so I can view the challenge that should be exposed. I also see the container in docker, but it doesn't have any ports exposed and mapped to the container ports. Should it? I don't know enough about your plugin or CTFd to know what I would do next. Should the challenge docker be embedded in a page in CTFd or should it open a separate browser tab / window or is the user supposed to use the information from the image above (host and ip/port) to open their own window? Please let me know how it should work next and where to see what I need to change in the python code. Thanks! — Reply to this email directly, view it on GitHub <#38 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKDBEUIAA2YIQGLG5VMX4332OTJRAVCNFSM6AAAAACKTGHRE6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTINZUGM3DCMRTGY> . You are receiving this because you commented.Message ID: ***@***.***>

[tpitman]

No problem. I appreciate all the help.

To clarify: when you say it should display to the player, do you mean the actual UI of the container should show up in a frame in the modal?

Thanks

[offsecginger]

The host IP and target port should display in the challenge modal is what I meant 😁

…

On Fri, Oct 31, 2025, 4:12 PM tpitman ***@***.***> wrote: *tpitman* left a comment (offsecginger/CTFd-Docker-Challenges#38) <#38 (comment)> No problem. I appreciate all the help. To clarify: when you say it should display to the player, do you mean the actual UI of the container should show up in a frame in the modal? Thanks — Reply to this email directly, view it on GitHub <#38 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKDBEROVMEG6F5V4G5CHKD32O7CVAVCNFSM6AAAAACKTGHRE6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTINZUG4ZTMNBYGA> . You are receiving this because you commented.Message ID: ***@***.***>

[tpitman]

And then I assume the user is supposed to enter those in their browser and that should bring up a new tab with the challenge from the docker image that should be running on that IP and port.

Got it.

Thanks again