It works, but only if the http:///https:// scheme is explicitly present in the insecure-registries entries, due to:

However, the non-c8d Docker does advise against using explicit schema:

And because the daemon.RegistryHosts() is passed to buildkit (in the upstream Docker) then probably insecure registries are broken when building images? This probably needs to be looked at.

The non-c8d Docker doesn't need the schemas, because the behaviour for handling insecure registries is first to try the HTTPS ignoring the certificate errors, and if that fails fallback to HTTP.

I added the fallback to the HTTP and changed the (daemon *Daemon) RegistryHosts to correctly parse scheme-less URL with ports.
It's a bit hacky, but it works.

tested, but doesn't work for me.
My test setup:

• create a registry container
• run moby dev container with `--link registry``
• register registry:5000 as insecureRegistry in daemon.json

$ docker pull registry:5000/alpine
Using default tag: latest
Error response from daemon: failed to resolve reference "registry:5000/alpine:latest": failed to do request: Head "https://registry:5000/v2/alpine/manifests/latest": http: server gave HTTP response to HTTPS client