distribution: Private registry push fail: server gave HTTP response to HTTPS client

I get helped from [http://stackoverflow.com/questions/38695515/can-not-pull-push-images-after-update-docker-to-1-12], two steps in total to solve this issue:

1. Create or modify /etc/docker/daemon.json { "insecure-registries":["myregistry.example.com:5000"] }
2. Restart docker daemon sudo service docker restart

I agree with @dmcgowan

The–insecure-registry=myip:5000 flag is not getting set on the daemon

but I have no idea about why it only occurred under docker version 1.12. I will keep this issue open in next three days, any comments are welcome.

I’d like to clarify that you should add the { "insecure-registries":["myregistry.example.com:5000"] } to /etc/docker/daemon.json in the client machine.

Same problem here but with Docker for Mac Version 1.12.1-beta26.1 (build: 12100). Solved adding the insecure registry in Docker Mac App preferences. Why this issue is closed?

For Centos 7 and Docker version _17.03.1-ce, build c6d412e_ , just modify ’ /usr/lib/systemd/system/docker.service’, as @saavkaar indicated:

vi /usr/lib/systemd/system/docker.service ExecStart=/usr/bin/dockerd --insecure-registry 192.168.127.1:5000

And now reset docker:

systemctl daemon-reload service docker restart

Where 192.168.127.1:5000 if the ‘IP:port’ of the master node where the registry image is running. Apply this modification and the restart in the master node and also in the slaves.

Now start the registry image in the master node: docker run -d -p 5000:5000 --restart=always --name registry -v LOCAL_PATH:/var/lib/registry registry:2

Where LOCAL_PATH is a existent directory in your master node.

Push an image intto your registry before you can pull.

In the master node: docker push 192.168.127.1:5000:/YOUR_IMAGE

Where YOUR_IMAGE is the name of the image that you want distribute.

Now you can pull

In the slaves nodes: docker pull 192.168.127.1:5000/:YOUR_IMAGE

For Mac users, it seems like they added the ability to configure insecure registries in the GUI, via Preferences > Daemon > Insecure registries.

Try adding --insecure-registry option to daemon in /etc/systemd/system/docker.service.d/docker.conf file. Then sudo systemctl daemon-reload And sudo service docker restart

It worked for me

OS: Ubuntu 16.04 Docker: 1.26

For Docker version 18.09.2, I followed https://success.docker.com/article/using-systemd-to-control-the-docker-daemon

1. sudo systemctl edit docker
2. add below lines

[Service] ExecStart= ExecStart=/usr/bin/dockerd -H fd:// --insecure-registry registry:5000

1. sudo systemctl daemon-reload
2. systemctl restart docker
3. systemctl status docker

With Docker For Mac, the registries setting doesn’t seems to be very sticky. I originally added my registry as https:// and got this error. I changed the address to http and restarted Docker, but the error persisted.

After removing the setting altogether, restarting Docker, then adding the setting back and restarting again it stuck and started working. YMMV.

For Docker version 19.03.1 on a Windows 10 machine, this is how I resolved it:

I opened up docker’s settings in the gui:

Clicked on the Daemon section, click on the toggle button Basic to enable Advance mode:

Enter in your config. 😃

@wudiapo135, I did the same per your comments, but still got the same error: Private registry push fail: server gave HTTP response to HTTPS client

My docker version: Docker version 1.12.2, build bb80604

If you are using Docker for Windows with linux containers, the ‘insecure-registries’ setting is here: C:\Program Files\Docker\Docker\resources\linux-daemon-options.json

I’m using Docker for Windows, but I’m not actually using the ‘for Windows’ part. Instead I followed the ‘hyperv’ instructions.

1. Install docker for windows but uncheck the ‘start at login’ box. Instead, follow the instructions for creating a docker machine using hyperv - https://docs.docker.com/machine/drivers/hyper-v/ . I called mine ‘dockervm’. I also created a virtual switch that is bridged so it has a real (external) IP.

2. Create a scheduled task to run at startup ‘C:\Program Files\Docker\Docker\resources\bin\docker-machine start dockervm’. Make sure to not use double quotes as there is a bug in the windows 10 task scheduler.

3. After step 1 your docker machine is running, use ‘docker-machine env dockervm’ to get the environment, and set it in your global environment settings.

4. After a reboot, your dockervm should be running, and docker ps -a should return results.

5. Run the registry locally: docker run -d -p 5000:5000 --name registry registry:2

6. Open ‘Hyper-V Manager’ and select ‘dockervm’ (it should be running). Click ‘Connect…’ under dockervm on the right to open a shell. You should now be at a root shell prompt in your dockervm

7. From the root shell prompt, cd to /var/lib/boot2docker

8. vi profile

Add a new line to this part with your registry (my vm’s IP is 192.168.1.24)

EXTRA_ARGS=’ –label provider=hyperv –insecure-registry=192.168.1.24:5000 ’ 8. Restart the dockervm machine in hyperv manager

You should now be able to push to the registry

I had the same problem as here, but with Docker on Windows. Turns out that the file at C:\ProgramData\docker\config\daemon.json isn’t the only source of config here; if I right-click the docker icon in the taskbar and choose Settings…->Daemon and enable advanced config editing, I get a different set of settings.

Adding the insecure registry there, not in the daemon.json file on disk, seems to have solved my problem.

Only this worked for me in /etc/docker/daemon.json file : { “insecure-registries” : [“127.0.0.0/8”, “myregistrydomain.com:5000”] }

Execute these commands afterwards : sudo systemctl daemon-reload sudo systemctl restart docker docker info

In the output of “docker info” look for : Insecure Registries: myregistrydomain.com:5000 127.0.0.0/8

Try it out now …

If someone with GitLab CI docker:dind as a service comes here (as I did), here’s the answer you’re looking for: https://stackoverflow.com/a/50133074 .

For future people who had my problem: If you installed docker using snap (run snap services to check if docker.dockerd is listed), you will need to add the insecure-registries entry to /var/snap/docker/current/config/daemon.json, not the default config location.

Solution : If you want to pull/push image on particular host let say 10.20.30.120 from private registry that you hosted on another node then

1.go to /etc/hosts of your host and gave same domain name to this ip 10.20.30.120 like - 10.20.30.120 myregistry.local.com

2.go to /etc/docker/daemon.json of you hosts note: if daemon.json not present, create it inside /etc/docker/

3.open daemon.json and write following lines - { “insecure-registries”: [“myregistry.local.com:5000”] }

4.Restart docker service docker stop service docker start

5.try to pull image using for eg : docker pull “myregistry.local.com:5000/username/imagename” that’s it!

I already config the “–insecure-registry localhost:5000” in /etc/sysconfig/docker and “systemctl restart docker”. See below:

[root@dhcp-140-36 ~]# docker info
Containers: 5
 Running: 0
 Paused: 0
 Stopped: 5
Images: 40
Server Version: 1.13.1
...
Insecure Registries:
 localhost:5000
 127.0.0.0/8
...

But, still got errors: Unable to connect to the server: http: server gave HTTP response to HTTPS client. Anyone know how to solve it? Thanks!

[root@dhcp-140-36 db-731491371]# oc adm catalog build --appregistry-org=jiazha --to=localhost:5000/jiazha/catalog:v1 --loglevel=8
...
INFO[0003] directory                                     dir=/tmp/manifests-314255191 file=learn-operator load=package
I1125 16:15:48.553395   11938 builder.go:105] database written /tmp/db-251746264/bundles.db
I1125 16:15:48.566404   11938 builder.go:115] built db layer /tmp/archive-942757578/layer.tar.gz
I1125 16:15:48.566462   11938 config.go:137] looking for config.json at /root/.docker/config.json
I1125 16:15:48.566694   11938 config.go:145] found valid config.json at /root/.docker/config.json
I1125 16:15:48.566743   11938 round_trippers.go:420] GET https://localhost:5000/v2/
I1125 16:15:48.566753   11938 round_trippers.go:427] Request Headers:
I1125 16:15:48.567916   11938 round_trippers.go:446] Response Status:  in 1 milliseconds
I1125 16:15:48.567929   11938 round_trippers.go:449] Response Headers:
I1125 16:15:48.567952   11938 helpers.go:217] Connection error: Get https://localhost:5000/v2/: http: server gave HTTP response to HTTPS client
F1125 16:15:48.567961   11938 helpers.go:114] Unable to connect to the server: http: server gave HTTP response to HTTPS client

[root@dhcp-140-36 ~]# docker run -it --rm -p 5000:5000 registry
WARN[0000] No HTTP secret provided - generated random secret. This may cause problems with uploads if multiple registries are behind a load-balancer. To provide a shared secret, fill in http.secret in the configuration file or set the REGISTRY_HTTP_SECRET environment variable.  go.version=go1.11.2 instance.id=871badf0-b4d3-44fe-aca3-300b969ede4f service=registry version=v2.7.1
INFO[0000] redis not configured                          go.version=go1.11.2 instance.id=871badf0-b4d3-44fe-aca3-300b969ede4f service=registry version=v2.7.1
INFO[0000] Starting upload purge in 1m0s                 go.version=go1.11.2 instance.id=871badf0-b4d3-44fe-aca3-300b969ede4f service=registry version=v2.7.1
INFO[0000] using inmemory blob descriptor cache          go.version=go1.11.2 instance.id=871badf0-b4d3-44fe-aca3-300b969ede4f service=registry version=v2.7.1
INFO[0000] listening on [::]:5000                        go.version=go1.11.2 instance.id=871badf0-b4d3-44fe-aca3-300b969ede4f service=registry version=v2.7.1
INFO[0060] PurgeUploads starting: olderThan=2019-11-18 08:16:34.579628009 +0000 UTC m=-604739.979538633, actuallyDelete=true 
INFO[0060] Purge uploads finished.  Num deleted=0, num errors=1 
INFO[0060] Starting upload purge in 24h0m0s              go.version=go1.11.2 instance.id=871badf0-b4d3-44fe-aca3-300b969ede4f service=registry version=v2.7.1

ubuntu Edit configuration file /etc/systemd/system/multi-user.target.wants/docker.service add ExecStart=/usr/************* --insecure-registry yourip:5000

Also you can install haproxy and add into config:

frontend http
        bind *:80
        redirect scheme https if !{ ssl_fc }

frontend https
        bind *:443 ssl crt {{{ your certificate  }}}
        acl host_docker hdr(host) -i docker.domain.com
        reqadd X-Forwarded-Port:\ 443
        reqadd X-Forwarded-Proto:\ https
        reqadd X-Forwarded-Scheme:\ https
        use_backend docker if host_docker

backend docker
        reqadd X-Forwarded-Host:\ docker.domain.com
        server docker 127.0.0.1:5000

then you don’t need --insecure-registry flag…

Please follow these instructions to help us diagnose your issue

1. create a new issue, with a succinct title that describes your issue:
   • bad title: “It doesn’t work with my docker”
   • good title: “Private registry push fail: 400 error with E_INVALID_DIGEST”
2. copy the output of:
   • docker version
   • docker info
   • docker exec <registry-container> registry -version
3. copy the command line you used to launch your Registry
4. restart your docker daemon in debug mode (add -D to the daemon launch arguments)
5. reproduce your problem and get your docker daemon logs showing the error
6. if relevant, copy your registry logs that show the error
7. provide any relevant detail about your specific Registry configuration (e.g., storage backend used)
8. indicate if you are using an enterprise proxy, Nginx, or anything else between you and your Registry