Docker login always using HTTP instead of HTTPS

Question

i've set up a docker registry server within a vm. The server has a ssl-certificate signed by a CA that is within my windows trusted root certificates.

To access the registry I've created a ssh tunnel forwarding my local port 5000 to the vm targeting [localhost:5000]. If I open https://localhost:5000 on my machine with a browser, everything checks out fine. The cert is considered valid.

Within a shell on the vm, docker login works perfectly fine. It asks for my credentials and stores them. I'm able to push images into the registry as expected.

Whenever I try to login from my developer machine connected via the tunnel, my local docker seems to ignore anything SSL:

C:\WINDOWS\system32>docker login https://localhost:5000
Username: ******
Password: ******
Error response from daemon: Get http://localhost:5000/v2/: dial tcp 127.0.0.1:5000: connect: connection refused

docker login seems to use HTTP instead of HTTPS which it is supposed to do. I can't figure out, how to force docker login to use SSL.

• I've double checked my local docker-daemon configuration, to ensure I've no "Insecure Registries" defined anywhere.
• I've cleared out my stored credentials in my profile to ensure that nothing strange is happening there.

Any suggestions would be very well appreciated!

Cheers,

Corelgott

Answer 1

Ok I've figured it out.

[tl;dr] On windows docker login localhost referes to the moby-vm running the daemon and not to the windows-system.

Since we are forced to use windows 10 as OS, docker uses it's moby-vm via hyper-v / virtualbox / hypervisor to run the "local" docker daemon. So when I type docker login localhost:5000 into my windows shell, the command is not run by my machine, but by the daemon, which resides in the vm. In this context "localhost" doesn't refere to my dev-system but to the vm the daemon is running in.

To resolve it, I had to:

1. change my ssh-tunnel to "accept connection from other hosts" (putty has a checkbox for that)
2. call docker login hostname:5000 (Where hostname is the name of my development-machine that the vm can resolve and access. You can use the command hostname in the commandline to find it.)

Now SSL, auth, push and pull seem to work as expected. Quite an odd error behaviour, but it kind of makes sense since there is no registry-server running witihn the docker-daemon-vm.

I hope this post saves somebody else some time.

Cheers,

Corelgott