拉取registry.k8s.io 部分镜像失败

[muwn]

cat /etc/containerd/certs.d/registry.k8s.io/hosts.toml
server = "https://registry.k8s.io" # 原地址

[host."https://proxy.lll.com"] # 加速地址
  capabilities = ["pull", "resolve", "push"] # 支持能力
  skip_verify = true # 是否跳过证书验证, 加速地址为http时 false

通过配置containerd cert.d 配置后，拉取镜像
nerdctl pull registry.k8s.io/metrics-server/metrics-server:v0.8.0 失败
nerdctl pull registry.k8s.io/nginx 可以成功

日志

请求IP: 171.xxx.122 (提纯后: 171.xxx.122), X-Forwarded-For: 171.xxx.122, 162.xxx.98, X-Real-IP: 162.xxx.98
HEAD请求失败: HEAD https://registry-1.docker.io/v2/metrics-server/metrics-server/manifests/v0.8.0: unexpected status code 401 Unauthorized (HEAD responses have no body, use GET for details)
[GIN] 2026/01/07 - 03:26:48 | 404 |  917.282778ms | 171.xxx.122 | HEAD     "/v2/metrics-server/metrics-server/manifests/v0.8.0?ns=registry.k8s.io"
请求IP: 20.xxx.242 (提纯后: 20.xxx.242), X-Forwarded-For: 20.xxx.242, X-Real-IP: 20.xxx.242
[GIN] 2026/01/07 - 03:36:17 | 403 |      50.655µs |   20.xxx.242 | GET      "/version"
请求IP: 20.xxx.203 (提纯后: 20.xxx.203), X-Forwarded-For: 20.xxx.203, X-Real-IP: 20.xxx.203
[GIN] 2026/01/07 - 03:37:07 | 403 |     310.222µs |   20.xxx.203 | GET      "/owa/auth/x.js"

[sky22333]

加速地址应该是这样的格式https://proxy.lll.com/registry.k8s.io

[muwn]

加速地址应该是这样的格式https://proxy.lll.com/registry.k8s.io

不加前缀，通过配置 docker、containerd的代理加速可以吗

[sky22333]

我的意思就是配置里使用这个格式

[muwn]

我的意思就是配置里使用这个格式

同配置加速地址为

server = "https://registry.k8s.io" # 原地址

[host."https://proxy.lll.com/registry.k8s.io"] # 加速地址
  capabilities = ["pull", "resolve", "push"] # 支持能力
  skip_verify = true # 是否跳过证书验证, 加速地址为http时 false

nerdctl --debug=true pull registry.k8s.io/metrics-server/metrics-server:v0.8.0
拉取镜像时，日志如下，仍然不可用

DEBU[0000] verifying process skipped                    
DEBU[0000] The image will be unpacked for platform {"amd64" "linux" "" [] ""}, snapshotter "overlayfs". 
DEBU[0000] fetching                                      image="registry.k8s.io/metrics-server/metrics-server:v0.8.0"
DEBU[0000] remote introspection plugin filters           filters="[type==io.containerd.snapshotter.v1, id==overlayfs]"
DEBU[0000] loading host directory                        dir=/etc/containerd/certs.d/registry.k8s.io
DEBU[0000] resolving                                     host=proxy.lll.com
DEBU[0000] do request                                    host=proxy.lll.com request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/2.2.0+unknown request.method=HEAD url="https://proxy.lll.com/registry.k8s.io/v2/metrics-server/metrics-server/manifests/v0.8.0?ns=registry.k8s.io"
registry.k8s.io/metrics-server/metrics-server:v0.8.0: resolving      |--------------------------------------| 
elapsed: 1.6 s                                        total:   0.0 B (0.0 B/s)                                         
DEBU[0001] fetch response received                       host=proxy.lll.com response.header.alt-svc="h3=\":443\"; ma=86400" response.header.cf-cache-status=DYNAMIC response.header.cf-ray=9ba121a0bed08e2b-AMS response.header.connection=keep-alive response.header.content-length=12 response.header.content-type="text/plain; charset=utf-8" response.header.date="Wed, 07 Jan 2026 05:42:22 GMT" response.header.nel="{\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}" response.header.report-to="{\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mqHgV5v4QWvh6wnMWIN3jnw%2B9WJydGLXD5Qu383Y0K80JtaHmUPU99nhzOKxTjYyU6Tty8TpLd5Gx2yVQJOQ%2F9H%2FT%2BkpYSHoN1pjJvBG\"}]}" response.header.server=cloudflare response.status="403 Forbidden" url="https://proxy.lll.com/registry.k8s.io/v2/metrics-server/metrics-server/manifests/v0.8.0?ns=registry.k8s.io"
INFO[0001] trying next host after status: 403 Forbidden  host=proxy.lll.com
DEBU[0001] resolving                                     host=registry.k8s.io
registry.k8s.io/metrics-server/metrics-server:v0.8.0: resolving      |--------------------------------------| 
elapsed: 32.6s                                        total:   0.0 B (0.0 B/s)                                         
INFO[0032] fetch failed                                  error="failed to do request: Head \"https://europe-west3-docker.pkg.dev/v2/k8s-artifacts-prod/images/metrics-server/metrics-server/manifests/v0.8.0\": dial tcp 173.194.202.82:443: i/o timeout" host=registry.k8s.io
FATA[0032] failed to resolve reference "registry.k8s.io/metrics-server/metrics-server:v0.8.0": unexpected status from HEAD request to https://proxy.lll.com/registry.k8s.io/v2/metrics-server/metrics-server/manifests/v0.8.0?ns=registry.k8s.io: 403 Forbidden 

[sky22333]

好的，有空我看下

[sky22333]

你直接添加前缀手动拉这个镜像能可以拉吗？

[muwn]

你直接添加前缀手动拉这个镜像能可以拉吗？

nerdctl --debug=true pull proxy.lll.com/registry.k8s.io/metrics-server/metrics-server:v0.8.0

可以的, proxy.lll.com 是改过的其他域名

DEBU[0000] verifying process skipped                    
DEBU[0000] The image will be unpacked for platform {"amd64" "linux" "" [] ""}, snapshotter "overlayfs". 
DEBU[0000] fetching                                      image="proxy.lll.com/registry.k8s.io/metrics-server/metrics-server:v0.8.0"
DEBU[0000] remote introspection plugin filters           filters="[type==io.containerd.snapshotter.v1, id==overlayfs]"
DEBU[0000] resolving                                     host=proxy.lll.com
DEBU[0000] do request                                    host=proxy.lll.com request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/2.2.0+unknown request.method=HEAD url="https://proxy.lll.com/v2/registry.k8s.io/metrics-server/metrics-server/manifests/v0.8.0"
proxy.lll.com/registry.k8s.io/metrics-server/metrics-server:v0.8.0: resolving      |--------------------------------------| 
elapsed: 2.1 s                                                       total:   0.0 B (0.0 B/s)                                         
DEBU[0002] fetch response received                       host=proxy.lll.com response.header.alt-svc="h3=\":443\"; ma=86400" response.header.cf-cache-status=DYNAMIC response.header.cf-ray=9ba18e3a7813672a-AMS response.header.connection=keep-alive response.header.content-length=1728 response.header.content-type=application/vnd.docker.distribution.manifest.list.v2+json response.header.date="Wed, 07 Jan 2026 06:56:31 GMT" response.header.docker-content-digest="sha256:89258156d0e9af60403eafd44da9676fd66f600c7934d468ccc17e42b199aee2" response.header.nel="{\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}" response.header.report-to="{\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yDzRTvSMMuo0mINzyPXEKYyqKGMRMFEAVgHWSfRBJqZmHoJHP2PGEjjK7Rt6v1LA0Knm1Y9SBvPDisGi9MO29fACFsSNFomWFmQCP91E\"}]}" response.header.server=cloudflare response.status="200 OK" url="https://proxy.lll.com/v2/registry.k8s.io/metrics-server/metrics-server/manifests/v0.8.0"
DEBU[0002] resolved                                      desc.digest="sha256:89258156d0e9af60403eafd44da9676fd66f600c7934d468ccc17e42b199aee2" host=proxy.lll.com
DEBU[0002] fetch                                         digest="sha256:89258156d0e9af60403eafd44da9676fd66f600c7934d468ccc17e42b199aee2" mediatype=application/vnd.docker.distribution.manifest.list.v2+json size=1728
proxy.lll.com/registry.k8s.io/metrics-server/metrics-server:v0.8.0: resolving      |--------------------------------------| 
elapsed: 2.2 s                                                       total:   0.0 B (0.0 B/s)                                         
proxy.lll.com/registry.k8s.io/metrics-server/metrics-server:v0.8.0:              resolved       |++++++++++++++++++++++++++++++++++++++| 
index-sha256:89258156d0e9af60403eafd44da9676fd66f600c7934d468ccc17e42b199aee2:    exists         |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:5dd31abb8093690d9624a53277a00d2257e7e57e6766be3f9f54cf9f54cddbc1: exists         |++++++++++++++++++++++++++++++++++++++| 
config-sha256:b9e1e3849e07022817ebc1612858382f0c0b91d00e4dcd2996adc1df6ced26e9:   exists         |++++++++++++++++++++++++++++++++++++++| 
elapsed: 2.4 s                                                                    total:   0.0 B (0.0 B/s)                                         

[sky22333]

已修复，现在支持你最初的配置方式了，你试试

cat /etc/containerd/certs.d/registry.k8s.io/hosts.toml
server = "https://registry.k8s.io" # 原地址

[host."https://proxy.lll.com"] # 加速地址
  capabilities = ["pull", "resolve", "push"] # 支持能力
  skip_verify = true # 是否跳过证书验证, 加速地址为http时 false

[muwn]

已修复，现在支持你最初的配置方式了，你试试

cat /etc/containerd/certs.d/registry.k8s.io/hosts.toml
server = "https://registry.k8s.io" # 原地址

[host."https://proxy.lll.com"] # 加速地址
  capabilities = ["pull", "resolve", "push"] # 支持能力
  skip_verify = true # 是否跳过证书验证, 加速地址为http时 false

可以了

[sky22333]

是改用最新版本后就可以了吗