Hi folks, I'm starting my Flyte journey, going through the local install docs. At the point of doing

flytectl demo start

, and the

flyte-sandbox-xxx

and

flyteconnector-xxx

services never get out of Pending state. Looking at the Docker (Rancher) logs show a few x509 ca cert issues as well as some "back-off" entries. Not sure what's going on. I am on the company VPN which I'm not allowed to disable, so if it's a cert issue, not sure how to get around it.

--admin.insecure

and

--admin.insecureSkipVerify

doesn't help. Ideas? Sample log entries...

2025-12-03T21:43:57.491204261Z E1203 21:43:57.491163      68 pod_workers.go:1298] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"local-path-provisioner\" with ErrImagePull: \"failed to pull and unpack image \\\"<http://docker.io/rancher/local-path-provisioner:v0.0.24\\\|docker.io/rancher/local-path-provisioner:v0.0.24\\\>": failed to copy: httpReadSeeker: failed open: failed to do request: Get \\\"<https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/10/10ada9a7f8ab578464314da2df287d1d384c6ef9f474d00dc73bf232599df55f/data?expires=1764801238&signature=KC81Pwa1VNzUPyOJ089%2BQZbYlH4%3D&version=2>\\\": tls: failed to verify certificate: x509: certificate signed by unknown authority\"" pod="kube-system/local-path-provisioner-84db5d44d9-q2chh" podUID="fad13c92-96bd-4cec-b19f-0e9ade5ffb19"

...

2025-12-03T21:44:05.221227848Z E1203 21:44:05.220969      68 pod_workers.go:1298] "Error syncing pod, skipping" err="failed to \"StartContainer\" for \"coredns\" with ImagePullBackOff: \"Back-off pulling image \\\"rancher/mirrored-coredns-coredns:1.10.1\\\"\"" pod="kube-system/coredns-6799fbcd5-27h25" podUID="1fa7b663-8c6b-492e-a816-d35a29e56e30"

The easiest way will be to : • OPTION 1 - Get the docker images from dockerhub and push it to your corporate registry. I presume you should be having a GCR or similar registry. You have change the registry address and the image name in the code, since you are using sanbox env. • OPTION 2 - Next would be either to import the certificates and add the certificate authority (or the signing authority) to your corporate which will be way more difficult given governance. • OPTION 3 - Try

experimentalHostResolver

in the docker daemon conf file. I am not sure about this but if you believe the internet some people suggest it