GoogleContainerTools/jib · error · SSLException

insecure HTTP connection not allowed: + url

Error message

insecure HTTP connection not allowed: + url

What it means

FailoverHttpClient.call() rejects plain-HTTP (non-HTTPS) registry URLs unless HTTP and insecure failover were explicitly enabled at construction. This SSLException names the offending URL. Jib requires HTTPS by default for registry communication security.

Solutions

1. Use an https:// registry URL
2. Enable insecure failover: configure allowInsecureRegistries (Jib's --allow-insecure-registries / Containerizer.setAllowInsecureRegistries(true))
3. Set up TLS on your registry and trust its certificate
4. Fix the registry URL if 'http://' was a typo

Example fix

// before
Containerizer.to(RegistryImage.named("http://localhost:5000/myapp"));
// after
Containerizer.to(
    RegistryImage.named("localhost:5000/myapp")
        .setCredentialRetriever(...))
  .setAllowInsecureRegistries(true);

URL u = new URL(registryUrl);
if (!"https".equals(u.getProtocol()) && !allowInsecure) throw new IllegalArgumentException("Insecure registry requires allowInsecureRegistries: " + u);

try { jibStep(); } catch (SSLException e) { if (e.getMessage().startsWith("insecure HTTP connection not allowed")) { failBuild("Enable allowInsecureRegistries or use https://"); } throw e; }

When it happens

Trigger: Calling get/post/put/call with an http:// registry URL while the client was built without allowInsecureRegistries / HTTP failover enabled.

Common situations: Pointing jib at a local or offline registry (localhost:5000, corporate mirror) over http:// without enabling insecure access; misconfigured registry base URL missing the https scheme.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• ${helpfulSuggestions.forHttpHostConnect()}
• Server requires HTTPS but is not HTTPS-secure
• Authentication over HTTP is enabled. It is strongly…
• 'Bearer' was not found in the 'WWW-Authenticate' header…
• Cannot build to a container registry in offline mode

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/8b4f642c5ef02643. Report an issue: GitHub.

Appendix: source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java:257

  public Response put(URL url, Request request) throws IOException {
    return call(HttpMethods.PUT, url, request);
  }

  /**
   * Sends the request.
   *
   * @param httpMethod the HTTP request method
   * @param url endpoint URL
   * @param request the request to send
   * @return the response to the sent request
   * @throws IOException if building the HTTP request fails.
   */
  public Response call(String httpMethod, URL url, Request request) throws IOException {
    if (!isHttpsProtocol(url)) {
      if (enableHttpAndInsecureFailover) { // HTTP requested. We only care if HTTP is enabled.
        return call(httpMethod, url, request, getHttpTransport(true), true);
      }
      throw new SSLException("insecure HTTP connection not allowed: " + url);
    }

    Optional<Response> fastPathResponse = followFailoverHistory(httpMethod, url, request);
    if (fastPathResponse.isPresent()) {
      return fastPathResponse.get();
    }

    try {
      return call(httpMethod, url, request, getHttpTransport(true), !enableHttpAndInsecureFailover);

    } catch (SSLException ex) {
      if (!enableHttpAndInsecureFailover) {
        throw ex;
      }

      try {
        logInsecureHttpsFailover(url);
        Response response = call(httpMethod, url, request, getHttpTransport(false), false);

View on GitHub (pinned to fb949e2676)