This message was deleted.

are you using containerd or dockerd?

containerd

have you tried to just pass

--insecure-registry=true

on the nerdctl call or is that pull coming from k8s?