Insecure registry "http: server gave HTTP response to HTTPS client" in CI

By Daniel Zoghalchali·Latchkey

The docker daemon defaults to HTTPS for registries, but this registry answered over plain HTTP. The handshake fails with "server gave HTTP response to HTTPS client". For a registry that genuinely serves HTTP, declare it as an insecure registry in the daemon config; the better fix is to enable TLS.

What this error means

docker push or pull to a local/self-hosted registry (often :5000) fails with "http: server gave HTTP response to HTTPS client".

Error response from daemon: Get "https://registry.internal:5000/v2/":
http: server gave HTTP response to HTTPS client

Diagnose it: separate auth from naming from rate limits

Registry errors look alike and have unrelated causes. Work out which of the three you have before changing credentials, because a malformed image reference produces an error that reads like an authentication failure.

# 1. is the reference even valid? (lowercase, no spaces, valid tag)
docker image inspect "$IMAGE" 2>&1 | head -2

# 2. are you authenticated to the right registry?
cat ~/.docker/config.json | grep -o '"[^"]*\.[^"]*"' | head

# 3. are you rate limited? (Docker Hub anonymous pulls)
curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:ratelimit-preview/test:pull" \
  | grep -o '"token"' >/dev/null && echo "token ok"

Common causes

The registry serves HTTP, the daemon expects HTTPS

A registry started without TLS responds in HTTP, but docker speaks HTTPS first and rejects the mismatch.

The host is not in insecure-registries

Until the daemon is told the host is insecure, it will not fall back to HTTP.

How to fix it

Declare the registry insecure (non-prod)

1. Add the host:port to insecure-registries in daemon.json.
2. Restart docker so the daemon accepts HTTP for that host.
3. Retry the push or pull.

{ "insecure-registries": ["registry.internal:5000"] }

Enable TLS on the registry (preferred)

Serve the registry over HTTPS with a trusted certificate so no insecure exception is needed.

Authenticate in the job, not in the image

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

# GHCR needs this on the job or the push is rejected as unauthorised
permissions:
  contents: read
  packages: write

How to prevent it

• Run registries over TLS so HTTPS clients connect cleanly.
• Reserve insecure-registries for local/dev only.
• Configure insecure hosts on every runner that needs them.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation