docker buildx build --push failed to push images to harbor

[chen-mao]

when push images to harbor with buildx build --push, I meet the problems of x509: certificate signed by unknown authority.

Reproduction

1. env

docker version
Client:
 Version:           20.10.25
 API version:       1.41
 Go version:        go1.18.1
 Git commit:        20.10.25-0ubuntu1~22.04.1
 Built:             Fri Jul 14 21:58:09 2023
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server:
 Engine:
  Version:          20.10.25
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.1
  Git commit:       20.10.25-0ubuntu1~22.04.1
  Built:            Thu Jun 29 21:21:05 2023
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.7.2
  GitCommit:
 runc:
  Version:          1.1.7-0ubuntu1~22.04.1
  GitCommit:
 docker-init:
  Version:          0.19.0
  GitCommit:

2. my /etc/buildkitd.toml with the following content

debug = true

insecure-entitlements = [ "network.host", "security.insecure" ]

[registry."hub.xdxct.com"]
  http = true
  insecure = true
  ca = ["/etc/docker/cert.d/xdxct.com/ca.crt"]
  [[registry."hub.xdxct.com".keypair]]
    key="/etc/docker/cert.d/xdxct.com/xdxct.com.key"
    cert="/etc/docker/cert.d/xdxct.com/xdxct.com.cert"

3. Create builder that uses this BuildKit configuration

docker buildx create --use --name mybuilder --driver-opt network=host --config /etc/buildkit/buildkitd.toml
docker buildx inspect mybuilder --bootstrap

4. build images

docker buildx build --platform linux/arm64  -t hub.xdxct.com/mchen/hello:arm64-test . --push

result is present

docker buildx build --platform linux/amd64  -t hub.xdxct.com/mchen/hello:amd64-test . --push
[+] Building 3.2s (7/7) FINISHED
 => [internal] load build definition from Dockerfile                                                            0.0s
 => => transferring dockerfile: 91B                                                                             0.0s
 => [internal] load metadata for docker.io/library/alpine:latest                                                2.8s
 => [internal] load .dockerignore                                                                               0.0s
 => => transferring context: 2B                                                                                 0.0s
 => CACHED [1/1] FROM docker.io/library/alpine:latest@sha256:7144f7bab3d4c2648d7e59409f15ec52a18006a128c733fcf  0.0s
 => => resolve docker.io/library/alpine:latest@sha256:7144f7bab3d4c2648d7e59409f15ec52a18006a128c733fcff20d3a4  0.0s
 => ERROR exporting to image                                                                                    0.2s
 => => exporting layers                                                                                         0.0s
 => => exporting manifest sha256:0738b1b180d8e1e94f449b717b185e2f1ee427090860a8d343644d043a71a53d               0.0s
 => => exporting config sha256:33aa31e5e456f8c3eba4aaca821c2985edf52b090c37e46d326f7f1568f25c26                 0.0s
 => => exporting attestation manifest sha256:3346627941374b0938a13b49870e57d661d8f6971c3dd8811d27247c43b17679   0.1s
 => => exporting manifest list sha256:e7a859fd7aecea68b467286974ade5fdb5b171030e4f86acdc17bff23d651605          0.0s
 => => pushing layers                                                                                           0.1s
 => [auth] mchen/hello:pull,push token for hub.xdxct.com                                                        0.0s
 => [auth] mchen/hello:pull,push token for hub.xdxct.com                                                        0.0s
------
 > exporting to image:
------
ERROR: failed to solve: failed to push hub.xdxct.com/mchen/hello:amd64-test: failed to authorize: failed to fetch oauth token: Post "https://hub.xdxct.com/service/token": x509: certificate signed by unknown authority

but I can login my harbor

docker login hub.xdxct.com
Authenticating with existing credentials...
WARNING! Your password will be stored unencrypted in /home/chenmao/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded