How to get remote access to a private docker-registry?

I'm trying to setup a private docker registry using the image taken from:

Just by running: docker run -p 5000:5000 registry

I can pull/push from/to this repository only from localhost, but if i try to access it from another machine (using a private address on the same LAN) it fails with an error message:

*2014/11/03 09:49:04 Error: Invalid registry endpoint https ://': 
Get https:// Forbidden. If this private 
registry supports only HTTP or HTTPS with an unknown CA certificate,
please add `--insecure-registry` to the daemon's 
arguments. In the case of HTTPS, if you have access to the registry's
CA certificate, no need for the flag; simply place the CA certificate 
at /etc/docker/certs.d/*

What drives me crazy is that I can access it successfully using: curl and/or curl

I also don't understand where and how I should pass the --insecure-registry flag.


OK - I found the solution to this - after a day of digging.

For docker below 1.12.1:

It turns out that the new client version refuses to work with a private registry without SSL.

To fix this - the daemon on the client machine should be launched with the insecure flag:

Just type:

sudo service docker stop # to stop the service

and then

sudo docker -d --insecure-registry

(replace the with your own ip address).

I would expect the docker guys to add this option to the pull/push command line...

Edit - altenantively - you can add the flag to DOCKER_OPTS env variable inside /etc/default/docker... and then sudo service docker restart

Edit again - It seems that the docker guys are on it - and a fix will come soon:

For docker 1.12.1:

Please follow below the answer of vikas027 (valid for centos)

This is what worked for me on CentOS 7.2 and Docker 1.12.1 (latest as on date). My private registry v2 was running on, change it accordingly. This also works if you have multiple registries, just keep on adding --insecure-registry IP:Port

$ sudo vim /usr/lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd --insecure-registry
$ sudo systemctl stop docker
$ sudo systemctl daemon-reload
$ systemctl start docker

Edit the config file "/etc/default/docker"

sudo vi /etc/default/docker

add the line at the end of file

DOCKER_OPTS="$DOCKER_OPTS --insecure-registry="

(replace the with your own ip address)

and restart docker service

sudo service docker restart

Ok. Here is how I got it to work. If you see this error in docker 1.3.2 or above, do this

go to /etc/sysconfig/docker


and run

sudo service docker restart

I found the following to be very useful as it discusses how the Docker service itself is configured.

Along with this article on the systemctl command

I used the following series of commands in a Centos 7 based container with a registry image obtained by "docker pull registry:2.1.1"

sudo mkdir -p /etc/systemd/system/docker.service.d
cd /etc/systemd/system/docker.service.d
sudo touch override.conf
sudo nano override.conf

And inside the override.conf added the following.

ExecStart=/usr/bin/docker -d -H tcp:// -H unix:///var/run/docker.sock --insecure-registry

Note the first, blank, ExecStart= clears anything that is already in place so be sure to add anything from the /usr/lib/systemd/system/docker.service ExecStart= statement that you wish to retain.

If you don't specify the -d(daemon) option you'll get a "Please specify only one -H" error.

After issuing the following series of commands I can see my overrides in place.

sudo systemctl stop docker
sudo systemctl daemon-reload
sudo systemctl start docker
sudo systemctl status docker

docker.service - Docker Application Container Engine
   Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled)
  Drop-In: /etc/systemd/system/docker.service.d
   Active: active (running) since Thu 2015-09-17 13:37:34 AEST; 7s ago
 Main PID: 5697 (docker)
   CGroup: /system.slice/docker.service
           └─5697 /usr/bin/docker -d -H tcp:// -H unix:///var/run/docker.sock --insecure-registry

NOTE: The information provided by Loaded: and Drop-In: lines in the status message, the are useful for checking what's happening with a pre-existing docker daemon to work.

NOTE: Also have a look in the Loaded: docker.service file for an EnvironmentFile= for further clues.

use the following command replacing {YOUR_REGISTRY} with your registry

boot2docker ssh "echo $'EXTRA_ARGS=\"--insecure-registry {YOUR_REGISTRY}\"' | sudo tee -a /var/lib/boot2docker/profile && sudo /etc/init.d/docker restart"

edit docker.service file, add --insecure-registry x.x.x.x after -d flag, restart docker

this is the only thing that worked for me, the DOCKER_OPTS didn't have any effect

Docker 1.12.1

For CentOS 7.2

ExecStart=/usr/bin/dockerd --insecure-registry

For ubuntu 16.04

#ExecStart=/usr/bin/dockerd -H fd://
ExecStart=/usr/bin/dockerd --insecure-registry -H fd://

sudo systemctl stop docker
sudo systemctl daemon-reload
sudo systemctl start docker

It seems the --insecure-registry option may be used both with and without the "=" between it and the registry ID.

I found that docker client version and registry docker version has to match up, else you would run into connectivity issues, despite having everything in place.

This is based on the answer from vikas027 on Centos 7 and Docker 1.12

Since I am behind a proxy my full solution was ...








ExecStart=/usr/bin/dockerd --insecure-registry {{MY_INSECURE_REGISTRY_IP}}:5000

and dont forget to restart :)

sudo systemctl daemon-reload; sudo systemctl restart docker;

Two step solution(without --insecure-registry):

  1. Download public key from your registry
  2. Put it into /etc/docker/certs.d/$HOSTNAME/ directory


mkdir -p /etc/docker/certs.d/
echo -n | openssl s_client -connect | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /etc/docker/certs.d/

Now your docker will trust your self-signed certificate.

Setting Local insecure registry in docker along with proxy:

1) in ubuntu add the following flag --insecure-registry IP:port under DOCKER_OPTS in file /etc/default/docker

1.1) configure no_proxy env variable to bypass local IP/hostname/ proxy can throw a interactive msg continue and this intermediate msg confuses docker client and finally timesout...

1.2) if domainname is configured...then don't forget to update /etc/hosts file if not using DNS.

1.3) in /etc/default/docker set the env variables http_proxy and it enables to download images from outside company hubs. format http_proxy=http://username:password@proxy:port

2) restart the docker service...if installed as service, use sudo service docker restart

3) restart the registry container [sudo docker run -p 5000:5000 registry:2 ]

4) tag the required image using sudo docker tag imageid IP:port/imagename/tagname ifany

5) push the image ...sudo docker push ip:port/imagename

6) If u want to pull the image from another machine say B without TLS/SSL,then in B apply setps 1,1.1 and 2. If these changes are not done in machine B...pull will fail.

To save you hassle, why don't you just use the FREE private docker registry service provided by gitlab - works great

Their registry is secure so you won't have any issues

Ubuntu 16.04

Create (does not exist) file /etc/systemd/system/docker.service.d/registry.conf with contents:

#You need the below or you 'ExecStart=' or you will get and error 'Service has more than one ExecStart= setting, which is only allowed'
ExecStart=/usr/bin/dockerd -H fd:// --insecure-registry


sudo systemctl stop docker
sudo systemctl daemon-reload
sudo systemctl start docker

The following has been tested with:

ubuntu@ubuntu-xenial:~$ docker -v
Docker version 17.05.0-ce, build 89658be

I tried all of above mentioned answers, but none of these worked for me.

I was following these instructions in order to make it work

openssl req \
  -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
  -x509 -days 365 -out certs/domain.crt


Linux: Copy the domain.crt file to
/etc/docker/certs.d/ on every Docker
host. You do not need to restart Docker.

and other issues occurred that were solved as follows:

Issue 1

Error response from daemon: Get x509: cannot validate certificate for because it doesn't contain any IP SANs


host mapping in /etc/hosts: somehost

Issue 2

Error response from daemon: Get https://somehost:8001/v1/users/: x509: certificate is valid for , not somehost


rerun the openssl command

$ openssl req \
  -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
  -x509 -days 365 -out certs/domain.crt

press enter at every step except at:

Common Name (e.g. server FQDN or YOUR name) []:

and type the fqdn of the registry, i.e. somehost

Be sure to use the name as a CN.

logging in to the registry succeeds now

Issue 3

Error response from daemon: Get https://somehost:8001/v1/users/: x509: certificate signed by unknown authority


sudo mkdir -p /etc/docker/certs.d/somehost:8001/
sudo cp certs/domain.crt /etc/docker/certs.d/somehost:8001/ca.crt

In addition to the above answers, I am adding what worked in "docker for mac" for me:

  1. Click on the docker whale icon from mac tray on top right corner of your screen.
  2. Click on Preferences -> Daemon.
  3. Add your IP and port to the insecure registries.
  4. Restart the Daemon.

Need Your Help

Creating metro style winform in windows 7 using C#

c# winforms microsoft-metro

Is it possible to design a metro styled winform in visual studio 10 or visual studio 11 on windows 7? If so, where can I find info on how to do it? I have already found some links, like

How to search for file names in Visual Studio?

visual-studio search keyboard-shortcuts visual-studio-mac

In Eclipse you can search for a file in the project by pressing CTRL-SHIFT-R.