Docker "insecure-registries" Not Configured - HTTPS Failures to a Plain Registry in CI

By Kaveh Alemi·Latchkey

The Docker daemon treats every registry as HTTPS unless its host:port is listed in insecure-registries. A plain-HTTP or untrusted-TLS registry that is not on that list is refused before any pull or push.

What this error means

A pull/push to an internal registry (often by IP or on :5000) fails because the daemon insists on HTTPS or rejects the certificate, and the host is not in insecure-registries. Adding it (and restarting) makes the same operation work.

Error response from daemon: Get "https://10.0.0.5:5000/v2/": http: server gave
HTTP response to HTTPS client
# the host 10.0.0.5:5000 is not listed in insecure-registries

Diagnose it: separate auth from naming from rate limits

Registry errors look alike and have unrelated causes. Work out which of the three you have before changing credentials, because a malformed image reference produces an error that reads like an authentication failure.

# 1. is the reference even valid? (lowercase, no spaces, valid tag)
docker image inspect "$IMAGE" 2>&1 | head -2

# 2. are you authenticated to the right registry?
cat ~/.docker/config.json | grep -o '"[^"]*\.[^"]*"' | head

# 3. are you rate limited? (Docker Hub anonymous pulls)
curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:ratelimit-preview/test:pull" \
  | grep -o '"token"' >/dev/null && echo "token ok"

Common causes

The registry is not in insecure-registries

For a registry without trusted TLS, the daemon only falls back to HTTP (or skips cert verification) for hosts explicitly listed in insecure-registries. Otherwise it refuses the connection.

Host:port mismatch in the list

The entry must match the exact host and port used in the image reference (e.g. 10.0.0.5:5000). A missing port or a different host form does not apply.

Daemon not restarted after editing daemon.json

The setting only takes effect after a daemon reload; the running daemon otherwise still enforces HTTPS for the host.

How to fix it

Add the exact host:port and restart the daemon

List the registry in insecure-registries, matching the reference exactly, then reload Docker. Suitable for trusted internal/CI registries only.

# /etc/docker/daemon.json
{ "insecure-registries": ["10.0.0.5:5000"] }

sudo systemctl restart docker

Prefer proper TLS where possible

1. Front the registry with a real or private-CA certificate and use HTTPS.
2. If you must use insecure mode, scope insecure-registries to exactly the needed hosts.
3. Match the host:port form in the list to the image reference.

Authenticate in the job, not in the image

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

# GHCR needs this on the job or the push is rejected as unauthorised
permissions:
  contents: read
  packages: write

How to prevent it

• List only specific trusted hosts in insecure-registries.
• Match the host:port form to the image reference exactly.
• Restart the daemon after editing daemon.json.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation