How to properly point just dockerhub images to local mirror

[OCram85]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitea

Please tell us more about your question or problem

Hey folks,
I'm using renovate with internal mirrored dockerhub repostory for a while now.
Now I'm faced with an issue where new repositories using multiple docker image sources fails.

So I guess the global redirect is causing problems whenever the dependency lookup points to these new sources:

default.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "dependencyDashboard": true,
  "enabledManagers": ["dockerfile", "docker-compose", "woodpecker", "bun", "npm", "nodenv"],
  "packageRules": [
    {
      "matchDatasources": ["docker"],
      "registryUrls": ["https://mirror.ocram85.com"]
    }
  ]
}

config.js

module.exports = {
  platform: 'gitea',
  endpoint: 'https://gitea.ocram85.com',
  gitAuthor: 'renovate-bot <[email protected]>',
  autodiscover: true,
  prHourlyLimit: 10,
  automerge: false,
  major: {
    automerge: false,
  },
  automergeType: 'pr',
  automergeStrategy: 'squash',
  labels: ['renovate'],
  dependencyDashboardLabels: ['renovate'],
  githubTokenWarn: false,
  semanticCommits: 'enabled',
  autodiscoverFilter: ['OCram85/*', 'arkanum/*', 'renovate-bot/*', 'plugins/gitea-package'],
}

renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["local>renovate-bot/config"]
}

This is my full renovate setup just to reference.

The dependency lookup error appears on every repository which contains:

• dockerhub mirrored images ✔️ - ubuntu:22.04
• additional internal repositories ❌ - myimages.ocram85.com/myuser/myimage
• additional public repositories ❌ - ghcr.io/myuser/myimage

Unfortunately I couldn't find a detailed instruction or best practice how to just redirect the dockerhub / index.docker.io located images.

Is there anyone who could help pointing into the right direction to solve this?

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[rarkins]

Custom registryUrls are only applied for non-fully qualified docker images like ubuntu. For others where you want to remap domains, use registryAliases

[rarkins]

You only need to define registryAliases if you have any non-docker.io images you want remapped to look up at docker.io

[OCram85]

Well, I thought setting the registryUrls overrides all lookups - because I'm getting then errors for all images not provided within this repository mirror:

WARN: Error obtaining docker token (repository=foo/bar)
       "registryHost": "https://ghcr.io",
       "dockerRepository": "prymitive/karma",
       "err": {
         "name": "RequestError",
         "code": "EPROTO",
         "timings": {
           "start": 1736640242206,
           "socket": 1736640242225,
           "lookup": 1736640242225,
           "connect": 1736640242225,
           "upload": 1736640242225,
           "error": 1736640242225,
           "phases": {"wait": 19, "dns": 0, "tcp": 0, "request": 0, "total": 19}
         },
         "message": "write EPROTO C0FCEE9E887F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:354:\n",
         "stack": "RequestError: write EPROTO C0FCEE9E887F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:354:\n\n    at ClientRequest.<anonymous> (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/got/dist/source/core/index.js:970:111)\n    at Object.onceWrapper (node:events:633:26)\n    at ClientRequest.emit (node:events:530:35)\n    at ClientRequest.emit (node:domain:489:12)\n    at ClientRequest.origin.emit (/usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)\n    at emitErrorEvent (node:_http_client:103:11)\n    at TLSSocket.socketErrorListener (node:_http_client:506:5)\n    at TLSSocket.emit (node:events:530:35)\n    at TLSSocket.emit (node:domain:489:12)\n    at emitErrorNT (node:internal/streams/destroy:170:8)\n    at emitErrorCloseNT (node:internal/streams/destroy:129:3)\n    at processTicksAndRejections (node:internal/process/task_queues:90:21)\n    at WriteWrap.onWriteComplete [as oncomplete] (node:internal/stream_base_commons:87:19)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/39.100.1 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://ghcr.io/token?scope=repository%3Aprymitive%2Fkarma%3Apull&service=ghcr.io",
           "hostType": "docker",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         }
       }
 WARN: Error obtaining docker token (repository=foo/bar)
       "registryHost": "https://gitea.ocram85.com",
       "dockerRepository": "ocram85/swarmproxy",
       "err": {
         "name": "RequestError",
         "code": "EPROTO",
         "timings": {
           "start": 1736640243880,
           "socket": 1736640243950,
           "lookup": 1736640243950,
           "connect": 1736640243950,
           "upload": 1736640243950,
           "error": 1736640243951,
           "phases": {"wait": 70, "dns": 0, "tcp": 0, "request": 0, "total": 71}
         },
         "message": "write EPROTO C0FCEE9E887F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:354:\n",
         "stack": "RequestError: write EPROTO C0FCEE9E887F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:354:\n\n    at ClientRequest.<anonymous> (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/got/dist/source/core/index.js:970:111)\n    at Object.onceWrapper (node:events:633:26)\n    at ClientRequest.emit (node:events:530:35)\n    at ClientRequest.emit (node:domain:489:12)\n    at ClientRequest.origin.emit (/usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)\n    at emitErrorEvent (node:_http_client:103:11)\n    at TLSSocket.socketErrorListener (node:_http_client:506:5)\n    at TLSSocket.emit (node:events:530:35)\n    at TLSSocket.emit (node:domain:489:12)\n    at emitErrorNT (node:internal/streams/destroy:170:8)\n    at emitErrorCloseNT (node:internal/streams/destroy:129:3)\n    at processTicksAndRejections (node:internal/process/task_queues:90:21)\n    at WriteWrap.onWriteComplete [as oncomplete] (node:internal/stream_base_commons:87:19)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/39.100.1 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://gitea.ocram85.com/v2/ocram85/swarmproxy/tags/list?n=10000",
           "hostType": "docker",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         }
       }
 WARN: Package lookup failures (repository=foo/bar, branch=renovate/docker-24.x)
       "warnings": [
         "Failed to look up docker package ghcr.io/prymitive/karma",
         "Failed to look up docker package gitea.ocram85.com/ocram85/swarmproxy"
       ],
       "files": ["1-system/swarmprom.yml", "1-system/swarmproxy.yml"]
 WARN: Package lookup failures (repository=foo/bar, branch=renovate/grafana-grafana-10.x)
       "warnings": [
         "Failed to look up docker package ghcr.io/prymitive/karma",
         "Failed to look up docker package gitea.ocram85.com/ocram85/swarmproxy"
       ],

[rarkins]

Your logs show that the lookup is to e.g. "url": "https://ghcr.io/token?scope=repository%3Aprymitive%2Fkarma%3Apull&service=ghcr.io", which would indicate it's not overriding all lookups, unless I'm misunderstanding something?

[OCram85]

you're right. there is no redirect for these registries (ghcr.io + my own gitea based) - But I have absolutely no idea where these dns lookup / ssl errors are coming from.

[rarkins]

Most likely is that you have a MITM proxy attempting to intercept the https and need to add custom certificates to allow it