CODEWITHSUNDEEP
nginxdockerdocker-registry
Berco Beute
Berco Beute

Reputation: 1195

Docker will not send auth headers over HTTP

I'm setting up a private docker registry with NGINX in front for authentication. Both in a container which are linked. The nginx image I'm using is jwilder/nginx-proxy. I can ping the registry just fine:

>http zite.com:5000/v1/_ping
HTTP/1.1 200 OK
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 2
Content-Type: application/json
Date: Thu, 02 Apr 2015 12:13:32 GMT
Expires: -1
Pragma: no-cache
Server: nginx/1.7.11
X-Docker-Registry-Standalone: True

But pushing an image gives me:

FATA[0001] HTTP code 401, Docker will not send auth headers over HTTP

I've tried marking the registry as insecure but to no avail:

--insecure-registry zite.com:5000

I have been able to get this setup running without NGINX in the middle.

My NGINX config file is (where 'dockerregistry' is the name of the linked container):

upstream dockerregistry {
    server dockerregistry:5000;
}

server {
  listen 80;
  server_name zite.com;
  proxy_set_header Host $http_host;
  client_max_body_size 0;
  location / {
    proxy_pass http://dockerregistry;
    auth_basic "Docker Registry";
    auth_basic_user_file /etc/nginx/dockerregistry_users;
  }
  location /v1/_ping {
    auth_basic off;
    proxy_pass http://dockerregistry;
  }
}

I think I've read almost every article about this setup but one thing I cannot figure out is whether HTTP only access to a private docker repo is a no-go at all. Is it at all possible to get it working? Or do I have to use SSL certificates? If so, who knows a good guide for this setup?

Upvotes: 2

Views: 2614

Answers (1)

Mangled Deutz
Mangled Deutz

Reputation: 11403

Yes, you need SSL if you want to use (basic) authentication against your registry (and there is no way around that).

This was a deliberate design decision: the reasoning was that basic authentication over plain http would give a false sense of security, while credentials would really be transmitted in the clear and be extremely easy to compromise.

Not allowing for false security was indeed on purpose (though a questionable move, judging by the number of people being confused by that).

About setting up SSL, I would just go with the example nginx files in the repo: https://github.com/docker/docker-registry/tree/master/contrib/nginx

Upvotes: 4

Related Questions