blocks|key|2459432|text|由于我在几个月前就已经讨论过这个问题，因为我也遇到了同样的问题，现在--希望--有了一个解决方案，我想和大家分享一下我为我们的个人维基所写的下面这段话……|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2459433|安装专用注册中心(带有自签名证书)|2459434|为了将docker+login分发到私有注册中心，您必须将上面生成的证书分发给Docker节点。|offset|length|style|CODE|2459435|从*.example.com下载自签名证书的haxx.se通配符证书和中间证书，然后重新启动Docker守护进程。|2459436|curl+-k+https://git.example.com/herzog/pub/raw/master/ssh/example.com.crt+>+/usr/local/share/ca-certificates/registry.example.com-ca.crt
curl+http://curl.haxx.se/ca/cacert.pem+>+/usr/local/share/ca-certificates/cacert.pem
sudo+update-ca-certificates
sudo+service+docker+restart|code-block|syntax|javascript|2459437|CA更新的输出示例|2459438|root@test1:~#+sudo+update-ca-certificates
Updating+certificates+in+/etc/ssl/certs...+2+added,+0+removed;+done.
Running+hooks+in+/etc/ca-certificates/update.d....done.|2459439|登录到专用注册表|2459440|docker+login+--username+registry+--email+reg@example.com+https://registry.example.com/v1|2459441|注意！使用https://.../v1指定的注册表主机应该适用于docker和docker-compose。|blockquote|2459442|然后拉出一个图像|2459443|docker+pull+registry.example.com/namespace/image:1.0.0|2459444|entityMap|0|LINK|mutability|MUTABLE|url|https://.../v1^0|0|0|3|C|0|1|D|0|0|0|0|0|0|W|6|13|E|5|E|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1D|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1E|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1F|8|@$F|1G|G|1H|H|I]]|9|@]|A|$]]|$1|J|3|K|5|6|7|1I|8|@$F|1J|G|1K|H|I]]|9|@]|A|$]]|$1|L|3|M|5|N|7|1L|8|@]|9|@]|A|$O|P]]|$1|Q|3|R|5|6|7|1M|8|@]|9|@]|A|$]]|$1|S|3|T|5|N|7|1N|8|@]|9|@]|A|$O|P]]|$1|U|3|V|5|6|7|1O|8|@]|9|@]|A|$]]|$1|W|3|X|5|N|7|1P|8|@]|9|@]|A|$O|P]]|$1|Y|3|Z|5|10|7|1Q|8|@$F|1R|G|1S|H|I]|$F|1T|G|1U|H|I]]|9|@$F|1V|G|1W|1|1X]]|A|$]]|$1|11|3|12|5|6|7|1Y|8|@]|9|@]|A|$]]|$1|13|3|14|5|N|7|1Z|8|@]|9|@]|A|$O|P]]|$1|15|3|-4|5|6|7|20|8|@]|9|@]|A|$]]]|16|$17|$5|18|19|1A|A|$1B|1C]]]]

Since I already upvoted this issue months ago, because I had the same problem, and now - hopefully - having a solution for it, I'd like the share with you the following paragraph I wrote for our private wiki...

<h3>Setup Private registries (with self-signed certificates)</h3>

In order to <code>docker login</code> to a private registry you have to distribute the certificate generated above to the Docker-nodes.

Download <code>*.example.com</code> wildcard cert and the intermediate cert for self-signed certs from haxx.se and restart the Docker daemon.

<pre><code>curl -k https://git.example.com/herzog/pub/raw/master/ssh/example.com.crt &gt; /usr/local/share/ca-certificates/registry.example.com-ca.crt
curl http://curl.haxx.se/ca/cacert.pem &gt; /usr/local/share/ca-certificates/cacert.pem
sudo update-ca-certificates
sudo service docker restart
</code></pre>

Output example for CA update 

<pre><code>root@test1:~# sudo update-ca-certificates
Updating certificates in /etc/ssl/certs... 2 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....done.
</code></pre>

Login to the private registry

<pre><code>docker login --username registry --email reg@example.com https://registry.example.com/v1
</code></pre>

<blockquote>
 Notice! The registry host specified with <a href="https://.../v1" rel="nofollow">https://.../v1</a> should work for <code>docker</code> and <code>docker-compose</code>
</blockquote>

and pull an image

<pre><code>docker pull registry.example.com/namespace/image:1.0.0
</code></pre>

blocks|key|1162344|text|是!我发现问题了！|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1162345|您需要修复/etc/systemd/system/multi-user.target.wants/docker.service。目前，它没有考虑到$OPTIONS在启动码头。我的现在看起来是这样的：|offset|length|style|CODE|1162346|[Unit]
Description=Docker+Application+Container+Engine
Documentation=http://docs.docker.com
After=network.target+docker.socket
Requires=docker.socket

[Service]
#The+line+below+was+missing+$OPTIONS+at+the+end!!!
ExecStart=/usr/bin/docker+-d+-H+fd://+$OPTIONS
MountFlags=slave
LimitNOFILE=1048576
LimitNPROC=1048576
LimitCORE=infinity

[Install]
WantedBy=multi-user.target|code-block|syntax|javascript|1162347|在此之后，照常做：|1162348|$+sudo+systemctl+daemon-reload+
$+sudo+systemctl+restart+docker|1162349|现在一切都正常了。|1162350|entityMap^0|0|5|1M|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@$D|W|E|X|F|G]]|9|@]|A|$]]|$1|H|3|I|5|J|7|Y|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|Z|8|@]|9|@]|A|$]]|$1|O|3|P|5|J|7|10|8|@]|9|@]|A|$K|L]]|$1|Q|3|R|5|6|7|11|8|@]|9|@]|A|$]]|$1|S|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|T|$]]

YES! I've found the problem!

You need to fix <code>/etc/systemd/system/multi-user.target.wants/docker.service</code>. Currently it doesn't take $OPTIONS into consideration when starting docker. So mine now looks like this:

<pre><code>[Unit]
Description=Docker Application Container Engine
Documentation=http://docs.docker.com
After=network.target docker.socket
Requires=docker.socket

[Service]
#The line below was missing $OPTIONS at the end!!!
ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS
MountFlags=slave
LimitNOFILE=1048576
LimitNPROC=1048576
LimitCORE=infinity

[Install]
WantedBy=multi-user.target
</code></pre>

After that do the usual:

<pre><code>$ sudo systemctl daemon-reload 
$ sudo systemctl restart docker
</code></pre>

and everything works now.

blocks|key|114525|text|最好也是最独立于平台的方法是使用/etc/docker/daemon.json+配置文件。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|114526|看：|114527|cat+>+/etc/docker/daemon.json+<<DOCKERCONFIG
{
++"insecure-registries":+["registry:8443"]
}
DOCKERCONFIG|code-block|syntax|javascript|114528|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.docker.com/engine/reference/commandline/dockerd/#/daemon-configuration-file^0|G|N|14|4|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@$9|X|A|Y|1|Z]]|E|$]]|$1|F|3|G|5|6|7|10|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|11|8|@]|D|@]|E|$K|L]]|$1|M|3|-4|5|6|7|12|8|@]|D|@]|E|$]]]|N|$O|$5|P|Q|R|E|$S|T]]]]

The best and also most platform-independent way is to use the <code>/etc/docker/daemon.json</code> <a href="https://docs.docker.com/engine/reference/commandline/dockerd/#/daemon-configuration-file" rel="nofollow">configuration file</a>.

Behold:

<pre><code>cat &gt; /etc/docker/daemon.json &lt;&lt;DOCKERCONFIG
{
 "insecure-registries": ["registry:8443"]
}
DOCKERCONFIG
</code></pre>

blocks|key|114530|text|推荐方式码头商17.xx+%2B|type|unstyled|depth|inlineStyleRanges|entityRanges|data|114531|有许多方法可以为Docker守护进程配置守护进程标志和环境变量。推荐方式将使用与平台无关的daemon.json文件，默认情况下它位于Linux上的/etc/docker/中。|offset|length|style|CODE|114532|因此，对于配置不安全的注册中心，请执行以下操作：|114533|在daemon.json文件中设置以下标志：
{“不安全-注册表”：“注册表:8443”}|ordered-list-item|114534|重新启动码头
$+sudo+systemctl重启码头|114535|就这样!|114536|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.docker.com/engine/reference/commandline/dockerd//#daemon-configuration-file^0|0|19|B|22|C|W|4|0|0|0|1|B|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Z|8|@$D|10|E|11|F|G]|$D|12|E|13|F|G]]|9|@$D|14|E|15|1|16]]|A|$]]|$1|H|3|I|5|6|7|17|8|@]|9|@]|A|$]]|$1|J|3|K|5|L|7|18|8|@$D|19|E|1A|F|G]]|9|@]|A|$]]|$1|M|3|N|5|L|7|1B|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1C|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|1D|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]]]

<h1>Recommended Way Docker 17.xx +</h1>

There are a number of ways to configure the daemon flags and environment variables for your Docker daemon. The <a href="https://docs.docker.com/engine/reference/commandline/dockerd//#daemon-configuration-file" rel="noreferrer">recommended way</a> is to use the platform-independent <code>daemon.json</code> file, which is located in <code>/etc/docker/</code> on Linux by default.

So, for configuring insecure registries, do the following:

<ol>
<li>Set the following flag in the <code>daemon.json</code> file:

<pre><code>{
 "insecure-registries": ["registry:8443"]
}
</code></pre></li>
<li>Restart Docker 

<pre><code> $ sudo systemctl restart docker
</code></pre></li>
</ol>

That's it!

blocks|key|1162424|text|我的解决办法是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1162425|像前面提到的那样修改/etc/docker/daemon.json|ordered-list-item|offset|length|style|CODE|1162426|修改对：/etc/docker/daemon.json的权限
sudo+chmod+-R+777+/etc/docker/daemon.json|1162427|entityMap^0|0|A|N|0|4|N|V|15|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@$E|O|F|P|G|H]]|9|@]|A|$]]|$1|I|3|J|5|D|7|Q|8|@$E|R|F|S|G|H]|$E|T|F|U|G|H]]|9|@]|A|$]]|$1|K|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|L|$]]

my solution was:
<ol>
<li>Modify <code>/etc/docker/daemon.json</code> as is mention before
</li>
<li>Modify permissions to:
<code>/etc/docker/daemon.json</code> with
<code>sudo chmod -R 777 /etc/docker/daemon.json</code>
</li>
</ol>

The instructions for private registries with self signed certs state when logging in:

<blockquote>
 FATA[0005] Error response from daemon: v1 ping attempt failed with
 error: Get <a href="https://registry:8443/v1/_ping" rel="noreferrer">https://registry:8443/v1/_ping</a>: x509: certificate signed by
 unknown authority. If this private registry supports only HTTP or
 HTTPS with an unknown CA certificate, please add <code>--insecure-registry
 registry:8443</code> to the daemon's arguments. In the case of HTTPS, if you
 have access to the registry's CA certificate, no need for the flag;
 simply place the CA certificate at
 /etc/docker/certs.d/registry:8443/ca.crt
</blockquote>

I tried that but got another error about the IP not being in the subject. So I fixed that error and now get:

<blockquote>
 FATA[0006] Error response from daemon: Server Error: Post
 <a href="https://registry:8443/v1/users/" rel="noreferrer">https://registry:8443/v1/users/</a>: x509: certificate signed by unknown
 authority
</blockquote>

Where registry is the IP of the registry.

I then placed "--insecure-registry registry:8443" in /etc/default/docker and restarted the daemon

I've verified it's taken the setting.

<blockquote>
 root 6865 1 0 12:47 ? 00:00:00 /usr/bin/docker -d
 --insecure-registry registry:8443
</blockquote>

But docker login still produces this error:

<blockquote>
 FATA[0006] Error response from daemon: Server Error: Post
 <a href="https://registry:8443/v1/users/" rel="noreferrer">https://registry:8443/v1/users/</a>: x509: certificate signed by unknown
 authority
</blockquote>

Does insecure-registry work differently than I thought and how do I get around it?

And yes, I need HTTPS. It's a private registry but on a public IP. Is the only way forward to create a proper DNS entry with a real cert?

docker --insecure-registry flag not working as expected

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

使用自签名证书的私有注册中心的说明在登录时处于状态：来自守护进程的FATA0005错误响应: v1 ping尝试失败，错误:获取：x509:由未知权威机构签名的证书。如果此私有注册表只支持具有未知CA证书的HTTP或HTTPS，请将--insecure-registry   registry:8443添加到守护进程的参...

问码头-不安全-注册表标志不能按预期工作
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问码头-不安全-注册表标志不能按预期工作EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问码头-不安全-注册表标志不能按预期工作
EN