I setup a private registry, which run fine. Docker 1.10. I choose to change the host, and recreate the certificate. All run fine on my server, but on my customer server I can't push an image to the registry :

unable to ping registry endpoint https://my.customer.private.hostname:5000/v0/
 v2 ping attempt failed with error: Get https://my.customer.private.hostname:5000/v2/: Forbidden
 v1 ping attempt failed with error: Get https://my.customer.private.hostname:5000/v1/_ping: Forbidden

I can't find anybody else talking about 'forbidden' answer on Google. Where can I search to understand ? I already deleted the container, the image, uninstalled docker, reinstalled docker but still the same error. The only thing I do not delete is the thinpool used to store docker data (devicemapper).

  • You changed the host, did you update dns records? – Farhad Farahi Sep 15 '16 at 18:55
  • Yes, and curl -k my.customer.private.hostname:5000/v2/_catalog give me a json record with my docker images. – Cédric Girard Sep 16 '16 at 14:42
  • First of all we need to know if its a certificate issue. try --insecure-registry myregistry:5000 option – Farhad Farahi Sep 16 '16 at 16:07
  • My docker registry have a certificate built for it, and the CA certificate is given to each Docker installation in /etc/docker/certs.d/myregistry.domain.tld:5000/ca.crt, so my registry is not insecure. But I will try to be sure. – Cédric Girard Sep 19 '16 at 12:29
  • Have you done a docker login my.customer.private.hostname:5000? I'd preface that with a docker logout my.customer.private.hostname:5000 to make sure an old login isn't sitting around. – BMitch Sep 19 '16 at 14:36

There is a systemd conf file for docker :



[Service] Environment="HTTP_PROXY=http://proxy:3128" Environment="NO_PROXY=localhost,"

The registry IP was not localhost, so I needed to add the host to the NO_PROXY variable. I still not undestand why the first host worked. Restarting the registry container without https (http only) and using tcpdump help us to resolve this issue.

  • Hooray: In my case, we used to have proxy, and no longer do, so this reminded me to delete the proxy settings. – Douglas Royds Oct 25 '17 at 3:02

For me it is very strange that docker is trying to reach via https to 5000 port and then you made a curl with http to the same port and it worked.

Probably you are doing: docker pull my.customer.private.hostname:5000 xxx/yyy instead of docker pull my.customer.private.hostname xxx/yyy


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.