docker manifest insecure error

Description

I am using :

docker manifest create -- secure - a private_ Domain/library/browsertime: 17.14.2 private_ Domain/library/browsertime: 17.14.2-arm64 private_ Domain/library/browsertime: 17.14.2-amd64, 

docker pull a.com/library/browsertime:17.14.2-arm64

docker tag a.com/library/browsertime:17.14.2-arm64 b.com/library/browsertime:17.14.2-arm64

docker pull a.com/library/browsertime:17.14.2-amd64

docker tag a.com/library/browsertime:17.14.2-amd64 b.com/library/browsertime:17.14.2-amd64

docker manifest create --insecure -a b.com/library/browsertime:17.14.2 b.com/library/browsertime:17.14.2-arm64 b.com/library/browsertime:17.14.2-amd64

enable debug, and configure/etc/docker/daemon.json with the following content:

 "experimental": true, 
"insecure-registries": ["10.250.04", "10.250.03", "b.com:80"] 

still using https, I want use http://a.com:80

b.com -> 10.10.x.x:80, no has 443

debug:

 docker -D  manifest create --insecure -a b.com/library/browsertime:17.14.2 b.com/library/browsertime:17.14.2-arm64 b.com/library/browsertime:17.14.2-amd64
DEBU[0000] allowing insecure registry for: b.com
DEBU[0000] endpoints for b.com/library/browsertime:17.14.2-arm64: [{false https://b.com v2 false false true 0xc000002600} {false http://b.com v2 false false true 0xc000002600}]
DEBU[0000] error failed to configure transport: error pinging v2 registry: Get "https://b.com/v2/": dial tcp 10.10.4.43:443: connect: connection refused with repo endpoint {info:0xc000330ff0 endpoint:{Mirror:false URL:0xc000040bd0 Version:2 AllowNondistributableArtifacts:false Official:false TrimHostname:true TLSConfig:0xc000002600}}
failed to configure transport: error pinging v2 registry: Get "https://b.com/v2/": dial tcp 10.10.4.43:443: connect: connection refused

Reproduce

docker pull a.com/library/browsertime:17.14.2-arm64

docker tag a.com/library/browsertime:17.14.2-arm64 b.com/library/browsertime:17.14.2-arm64

docker pull a.com/library/browsertime:17.14.2-amd64

docker tag a.com/library/browsertime:17.14.2-amd64 b.com/library/browsertime:17.14.2-amd64

docker manifest create --insecure -a b.com/library/browsertime:17.14.2 b.com/library/browsertime:17.14.2-arm64 b.com/library/browsertime:17.14.2-amd64

Expected behavior

No response

docker version

Client:
 Version:           24.0.5
 API version:       1.43
 Go version:        go1.20.6
 Git commit:        ced0996
 Built:             Fri Jul 21 20:34:32 2023
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          24.0.5
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.6
  Git commit:       a61e2b4
  Built:            Fri Jul 21 20:35:56 2023
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          v1.7.1
  GitCommit:        1677a17964311325ed1c31e2c0a3589ce6d5c30d
 runc:
  Version:          1.1.8
  GitCommit:        v1.1.8-0-g82f18fe
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client:
 Version:    24.0.5
 Context:    default
 Debug Mode: false

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 3
 Server Version: 24.0.5
 Storage Driver: overlay2
  Backing Filesystem: xfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 1677a17964311325ed1c31e2c0a3589ce6d5c30d
 runc version: v1.1.8-0-g82f18fe
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
 Kernel Version: 3.10.0-1160.49.1.el7.x86_64
 Operating System: CentOS Linux 7 (Core)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 7.638GiB
 Name: sec-docker-docker.xxx.xxxx.cn
 ID: e9a5d413-37ad-429c-82e0-d084ccc2f883
 Docker Root Dir: /home/.varlibdocker
 Debug Mode: false
 HTTP Proxy: http://10.10.x.x:6666/
 HTTPS Proxy: http://10.10.x.x:6666/
 No Proxy: localhost,127.0.0.1,localaddress,.localdomain.com,.xxx.cn,.m.com
 Experimental: true
 Insecure Registries:
  b.com:80
  10.10.4.43:80
  10.250.0.3
  10.250.0.4
  127.0.0.0/8
 Registry Mirrors:
  http://10.250.0.4/
  http://10.250.0.3/
  http://b.com/
 Live Restore Enabled: false
 Product License: Community Engine

WARNING: API is accessible on http://127.0.0.1:23456 without encryption.
         Access to the remote API is equivalent to root access on the host. Refer
         to the 'Docker daemon attack surface' section in the documentation for
         more information: https://docs.docker.com/go/attack-surface/
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

Additional Info

docker -D  manifest create --insecure -a b.com/library/browsertime:17.14.2 b.com/library/browsertime:17.14.2-arm64 b.com/library/browsertime:17.14.2-amd64
DEBU[0000] allowing insecure registry for: b.com
DEBU[0000] endpoints for b.com/library/browsertime:17.14.2-arm64: [{false https://b.com v2 false false true 0xc000002600} {false http://b.com v2 false false true 0xc000002600}]
DEBU[0000] error failed to configure transport: error pinging v2 registry: Get "https://b.com/v2/": dial tcp 10.10.4.43:443: connect: connection refused with repo endpoint {info:0xc000330ff0 endpoint:{Mirror:false URL:0xc000040bd0 Version:2 AllowNondistributableArtifacts:false Official:false TrimHostname:true TLSConfig:0xc000002600}}
failed to configure transport: error pinging v2 registry: Get "https://b.com/v2/": dial tcp 10.10.4.43:443: connect: connection refused

cat /etc/docker/daemon.json
{
  "experimental": true,
  "registry-mirrors": ["http://10.250.0.4", "http://10.250.0.3", "http://b.com"],
  "hosts": ["tcp://127.0.0.1:23456", "unix:///var/run/docker.sock"],
  "insecure-registries": ["10.250.0.4", "10.250.0.3", "b:80", "10.10.4.43:80"],
  "max-concurrent-downloads": 10,
  "log-driver": "json-file",
  "log-level": "warn",
  "log-opts": {
    "max-size": "128m",
    "max-file": "3"
    },
  "data-root": "/home/.varlibdocker"
}

Start with the docker manifest create --insecure command and the debug output showing HTTPS is tried before HTTP. Review how the CLI handles the listed insecure-registries and registry endpoints; done means the reproduced HTTP-only registry case no longer fails by connecting to port 443.