Docker "insecure-registries" Not Configured - HTTPS Failures to a Plain Registry in CI

By Kaveh Alemi·Latchkey

The Docker daemon treats every registry as HTTPS unless its host:port is listed in insecure-registries. A plain-HTTP or untrusted-TLS registry that is not on that list is refused before any pull or push.

What this error means

A pull/push to an internal registry (often by IP or on :5000) fails because the daemon insists on HTTPS or rejects the certificate, and the host is not in insecure-registries. Adding it (and restarting) makes the same operation work.

docker pull/push output

Error response from daemon: Get "https://10.0.0.5:5000/v2/": http: server gave
HTTP response to HTTPS client
# the host 10.0.0.5:5000 is not listed in insecure-registries

Common causes

The registry is not in insecure-registries

For a registry without trusted TLS, the daemon only falls back to HTTP (or skips cert verification) for hosts explicitly listed in insecure-registries. Otherwise it refuses the connection.

Host:port mismatch in the list

The entry must match the exact host and port used in the image reference (e.g. 10.0.0.5:5000). A missing port or a different host form does not apply.

Daemon not restarted after editing daemon.json

The setting only takes effect after a daemon reload; the running daemon otherwise still enforces HTTPS for the host.

How to fix it

Add the exact host:port and restart the daemon

List the registry in insecure-registries, matching the reference exactly, then reload Docker. Suitable for trusted internal/CI registries only.

daemon.json / Terminal

# /etc/docker/daemon.json
{ "insecure-registries": ["10.0.0.5:5000"] }

sudo systemctl restart docker

Prefer proper TLS where possible

Front the registry with a real or private-CA certificate and use HTTPS.
If you must use insecure mode, scope insecure-registries to exactly the needed hosts.
Match the host:port form in the list to the image reference.

How to prevent it

List only specific trusted hosts in insecure-registries.
Match the host:port form to the image reference exactly.
Restart the daemon after editing daemon.json.

Frequently asked questions

What causes ""insecure-registries" not set"?

For a registry without trusted TLS, the daemon only falls back to HTTP (or skips cert verification) for hosts explicitly listed in insecure-registries. Otherwise it refuses the connection.

How do I fix "insecure-registries" not set?

List the registry in insecure-registries, matching the reference exactly, then reload Docker. Suitable for trusted internal/CI registries only.