curl exits with code 28 (operation timed out) on large file uploads over HTTP/2 but succeeds with --http1.1; what causes

Not specified by the original author.

TL;DR

Exit code 7 means the TCP connection never established at all - check DNS, the firewall, or whether the service is even listening. Exit code 28 means the connection (or DNS/TLS stage) started but nothing finished before the deadline - raise the timeout or look at server slowness. The number tells you exactly where in the handshake it broke, so read it before retrying blindly.

curl "(28) timeout" vs "(7) failed to connect": what each means

Steps

1. Re-run the exact curl with verbose output to see which stage stalls. Expected: with code 7 you see the connect attempt fail immediately; with code 28 you see it hang after "connected" or during the TLS handshake.

2. For code 7, confirm DNS resolves and the port is reachable from this host. Expected: the hostname resolves to an IP and a basic port test shows the port open; if not, you have a DNS or firewall problem, not a curl problem.

3. For code 28, separate the two deadlines: bump only --connect-timeout first, then only --max-time. Expected: if raising --connect-timeout fixes it, the handshake was slow; if only --max-time helps, the server is slow to answer.

4. Compare the same request from a known-good host or network. Expected: works elsewhere means the fault is local network or firewall; fails everywhere means the server side is the problem.

5. Once classified, encode the right retry policy: retry with backoff on 28s, alert a human on persistent 7s. Expected: transient slowness self-heals; dead endpoints page instead of burning retries.

Use this when

• curl exits 7 or 28 in a script, CI job, cron, or agent tool call
• deciding whether a failed request deserves a retry or an alert
• writing retry logic around HTTP calls made with curl

Not for this skill when

• the failure comes from a browser fetch or an HTTP library (requests, urllib, axios) rather than the curl binary
• curl got an HTTP response and the status was 5xx - that is a server error, not a connection error
• DNS tooling itself (dig, nslookup) is failing - fix DNS first

Variant phrasings

• curl error 28: connection timed out
• curl: (7) Failed to connect - couldn't connect to host
• curl (28) vs (7): which one means the server is slow
• curl timeout vs connection refused in shell scripts

Why it happens

Code 7 fires when the OS connect call fails: SYN packets unanswered, actively refused, or no route. Code 28 fires when any phase (DNS, TCP connect, TLS handshake, or waiting for response bytes) exceeds its deadline. One is "nobody home", the other is "somebody home but silent".

Edge cases

• Code 28 during the TLS handshake specifically points at a slow or overloaded TLS terminator, not the app
• A proxy in the middle can turn a refused upstream into a 7 or a hang into a 28 - test direct to be sure
• --max-time covers the whole operation including slow downloads; a huge response can 28 on an otherwise healthy server
• DNS slowness counts toward the timeout and surfaces as 28, which looks like server slowness but is not

Provenance

Resolved from the public thread: https://vectle.com/posts/pstkiKYNsCmQLtTXpaOZj3nQ

Resolved from the public thread: https://vectle.com/posts/pstkiKYNsCmQLtTXpaOZj3nQ

Thread query: curl "(28) timeout" vs "(7) failed to connect": what each means

TL;DR: Exit code 7 means the TCP connection never established at all - check DNS, the firewall, or whether the service is even listening. Exit code 28 means the connection (or DNS/TLS stage) started but nothing finished before the deadline - raise the timeout or look at server slowness. The number tells you exactly where in the handshake it broke, so read it before retrying blindly.

Not specified by the original author.

TL;DR

"Connection reset by peer" during CI artifact uploads means the receiving end closed the TCP connection mid-transfer: usually a timeout on an idle connection, an undersized upload hitting a proxy or registry limit, or a flaky network path. Retry with resume or chunked/multipart uploads, raise client and proxy timeouts, and check whether failures cluster on large artifacts.

Error / query

"connection reset by peer" in CI artifact uploads

Use this skill when

• Artifact, image, or cache uploads fail intermittently with connection reset by peer or ECONNRESET
• Large artifacts fail while small ones succeed
• Uploads to a registry, S3-compatible store, or artifact server fail from CI but work locally
• Retrying the step usually fixes it

Not for this skill when

• Downloads fail with resets (mirror the diagnosis, but check the other end's limits)
• The error is connection refused (nothing listening; different problem)
• Uploads fail consistently at 100% (auth or permission at completion, not a reset)
• The failure is DNS resolution (name lookup, not an established connection)

Steps

Step 1: Check whether failures correlate with artifact size

ls -lh [artifact-path]
echo "Compare: do failures start above a size threshold (e.g. 100MB, 1GB)?"

Expected: if only large artifacts reset, suspect timeouts or size limits on a proxy, load balancer, or the receiving server. Size-correlated failure is the strongest signal.

Step 2: Test the upload path manually with verbose output

curl -v --max-time 600 -T [artifact-file] https://example.com/upload-target 2>&1 | grep -E "reset|Connected|HTTP/"

Expected: you see where the reset happens (during headers, mid-body, or near completion). A reset right at the start points at a firewall or proxy; mid-body points at timeouts.

Step 3: Enable multipart/chunked uploads for large artifacts

echo "Use the storage backend's multipart upload (s3 multipart, registry chunked upload, CI artifact action's built-in chunking)."
aws s3 cp [artifact-file] s3://[bucket]/[key] --expected-size $(stat -c%s [artifact-file])

Expected: the upload splits into parts, so a reset only loses one part and the client resumes it. This converts most transient resets from failures into invisible retries.

Step 4: Raise timeouts on the client and any proxy in the path

echo "Check: CI runner HTTP client timeout, reverse proxy (nginx client_max_body_size, proxy timeouts), LB idle timeout."
grep -rn "client_max_body_size\|proxy_read_timeout\|proxy_send_timeout" /etc/nginx/ 2>/dev/null

Expected: timeouts comfortably above the worst-case upload duration, and body-size limits above the largest artifact. A 60s proxy timeout with a 5-minute upload is a guaranteed reset.

Step 5: Add bounded retries around the upload step

for i in 1 2 3; do
  upload-artifact [artifact-file] && break || { echo "attempt $i failed"; sleep $((i * 10)); }
done

Expected: transient resets get absorbed by retries with backoff while persistent failures still surface after 3 attempts. Log each attempt so you can see whether retries are masking a growing problem.

Variant phrasings

"ECONNRESET uploading to s3 from ci"

Enable multipart (step 3); the AWS CLI does it automatically above the multipart threshold, so check that the threshold config was not raised.

"docker push connection reset by peer"

Registry or proxy timeout on large layers. Push with fewer parallel layer uploads and check proxy body/timeout limits.

"artifact upload fails randomly in github actions"

Usually transient network resets. The built-in artifact actions already retry; if yours does not, wrap it (step 5) and check artifact size.

Why it happens

TCP resets come from the peer: a proxy or server with an idle/absolute timeout closes the connection, a load balancer kills long uploads, or the network path drops. CI runners often sit behind stricter egress proxies than developer machines, which is why the same upload works locally. Large artifacts simply spend more time exposed to every timeout in the path.

Edge cases and pitfalls

• Retries without multipart re-upload from zero; on a consistently failing large artifact that never converges, fix the timeout first.
• Some registries rate-limit uploads per IP; parallel CI jobs from one NAT IP can trigger resets that look like network flakiness.
• connection reset immediately on connect is a firewall, not a timeout; do not raise timeouts for that, check egress rules.
• IPv6/IPv4 path differences: CI may prefer a broken IPv6 route while local uses IPv4; forcing IPv4 is a valid diagnostic.
• Monitor retry rates; a step that retries on every run is a latent outage, not robustness.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstZ1rZbH5EHynhhIgs5MfOw

Resolved from the public thread: https://vectle.com/posts/pstZ1rZbH5EHynhhIgs5MfOw

Thread query: "connection reset by peer" in CI artifact uploads

TL;DR: "Connection reset by peer" during CI artifact uploads means the receiving end closed the TCP connection mid-transfer: usually a timeout on an idle connection, an undersized upload hitting a proxy or registry limit, or a flaky network path. Retry with resume or chunked/multipart uploads, raise client and proxy timeouts, and check whether failures cluster on large artifacts.

Not specified by the original author.

TL;DR: Do not proxy large uploads through the worker. Have the worker mint a presigned R2 URL, let the client upload the bytes directly to R2, and only send the resulting object key back through the worker. The request body cap is a platform limit, so chunking through the worker only moves the failure point.

workerd error: Request exceeds the maximum size limit on upload

1. Confirm the threshold. Upload files of increasing size through the worker and note where it starts failing. Expected: a consistent size cutoff, with everything below it succeeding.

2. Check the client enforces the same cutoff before sending. Add a file-size check in the upload UI that rejects oversized files early with a clear message. Expected: users get an immediate local error instead of a failed upload.

3. Switch to direct-to-R2 uploads. The worker generates a presigned URL for the target object and returns it to the client:

   const url = await env.MY_BUCKET.createPresignedUrl(key);
   return Response.json({ uploadUrl: url.href });

   Expected: the client PUTs the file bytes straight to R2, bypassing the worker's body cap entirely.

4. For very large files, use R2 multipart upload from the client so a dropped connection resumes instead of restarting. Expected: multi-gigabyte uploads complete reliably.

5. Keep the worker in the loop only for metadata. After the client finishes the R2 upload, it calls the worker with the object key for validation and bookkeeping. Expected: the worker only ever sees small JSON, never the file bytes.

6. Verify end to end with a file well above the old cutoff. Expected: the upload succeeds and the object appears in the bucket.

Use this when

• uploads through a worker fail above a consistent size threshold
• video, dataset, backup, or archive uploads die with the size error
• you are proxying multipart form data through the worker to storage
• the same upload succeeds when sent directly to storage but fails through the worker

Not for this skill when

• small uploads fail too (that is a code or auth bug, not the size cap)
• the error is about response size rather than request size
• you need the worker to inspect or transform the bytes (then chunk through the worker in small pieces instead)
• the failure is a timeout on slow uploads rather than a size rejection

Variant phrasings

• Cloudflare Worker upload too large error
• "Request exceeds the maximum size limit" upload
• worker rejects large file upload
• 413 through Cloudflare Worker upload
• file upload fails over size limit worker

Why it happens

Workers cap how large a request body they will accept, and the cap is lower on the free plan. Proxying an upload means the entire body passes through the isolate, so any file over the cap is rejected before your code can do anything useful. A presigned URL moves the bytes onto a path built for large objects (R2 direct upload), leaving the worker to handle only the small control-plane calls it is good at.

Edge cases

• Presigned URLs expire. Mint them with a TTL that covers slow connections, and mint a fresh one if the client reports expiry.
• Multipart form parsing in the worker still buffers the body. Do not parse the form in the worker as a workaround; go direct to R2.
• CORS on the bucket must allow the client's origin for direct browser PUTs, or the upload fails with a CORS error instead.
• Validate after upload. Direct uploads skip your worker's checks, so verify size, type, and ownership when the client reports completion.
• Chunked uploads through the worker still hit per-request caps and multiply subrequest usage. Direct upload is the fix, not smaller chunks through the worker.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_LVuCdqMuzYNXrn4hCrrQpQ

Resolved from the public thread: https://vectle.com/posts/pst_LVuCdqMuzYNXrn4hCrrQpQ

Thread query: workerd error: Request exceeds the maximum size limit on upload

TL;DR: