What causes "insecure HTTP connection not allowed: + url" in GoogleContainerTools/jib?

GoogleContainerTools/jib · error · SSLException

insecure HTTP connection not allowed: + url

Error message

insecure HTTP connection not allowed: + url

What it means

FailoverHttpClient.call() rejects plain-HTTP (non-HTTPS) registry URLs unless HTTP and insecure failover were explicitly enabled at construction. This SSLException names the offending URL. Jib requires HTTPS by default for registry communication security.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java:257

  public Response put(URL url, Request request) throws IOException {
    return call(HttpMethods.PUT, url, request);
  }

  /**
   * Sends the request.
   *
   * @param httpMethod the HTTP request method
   * @param url endpoint URL
   * @param request the request to send
   * @return the response to the sent request
   * @throws IOException if building the HTTP request fails.
   */
  public Response call(String httpMethod, URL url, Request request) throws IOException {
    if (!isHttpsProtocol(url)) {
      if (enableHttpAndInsecureFailover) { // HTTP requested. We only care if HTTP is enabled.
        return call(httpMethod, url, request, getHttpTransport(true), true);
      }
      throw new SSLException("insecure HTTP connection not allowed: " + url);
    }

    Optional<Response> fastPathResponse = followFailoverHistory(httpMethod, url, request);
    if (fastPathResponse.isPresent()) {
      return fastPathResponse.get();
    }

    try {
      return call(httpMethod, url, request, getHttpTransport(true), !enableHttpAndInsecureFailover);

    } catch (SSLException ex) {
      if (!enableHttpAndInsecureFailover) {
        throw ex;
      }

      try {
        logInsecureHttpsFailover(url);
        Response response = call(httpMethod, url, request, getHttpTransport(false), false);

View on GitHub (pinned to fb949e2676)

Solutions

Use an https:// registry URL
Enable insecure failover: configure allowInsecureRegistries (Jib's --allow-insecure-registries / Containerizer.setAllowInsecureRegistries(true))
Set up TLS on your registry and trust its certificate
Fix the registry URL if 'http://' was a typo

Example fix

// before
Containerizer.to(RegistryImage.named("http://localhost:5000/myapp"));
// after
Containerizer.to(
    RegistryImage.named("localhost:5000/myapp")
        .setCredentialRetriever(...))
  .setAllowInsecureRegistries(true);

Defensive patterns

Strategy: validation

Validate before calling

URL u = new URL(registryUrl);
if (!"https".equals(u.getProtocol()) && !allowInsecure) throw new IllegalArgumentException("Insecure registry requires allowInsecureRegistries: " + u);

Try / catch

try { jibStep(); } catch (SSLException e) { if (e.getMessage().startsWith("insecure HTTP connection not allowed")) { failBuild("Enable allowInsecureRegistries or use https://"); } throw e; }

Prevention

Always use https:// registry endpoints in production
For local dev registries (localhost:5000), enable allowInsecureRegistries or add TLS to the registry
Audit build scripts for http:// registry URLs

When it happens

Trigger: Calling get/post/put/call with an http:// registry URL while the client was built without allowInsecureRegistries / HTTP failover enabled.

Common situations: Pointing jib at a local or offline registry (localhost:5000, corporate mirror) over http:// without enabling insecure access; misconfigured registry base URL missing the https scheme.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/8b4f642c5ef02643. Report an issue: GitHub.