BR-ANAC-DOV-MOD-1: Daemon Cannot Reach Registry Through Proxy

Daemon Cannot Reach Registry Through Proxy

A Docker host sits behind a corporate egress proxy at proxy.corp:3128. Pulling registry.internal:5000/app:2.1 fails with x509: certificate signed by unknown authority. The internal registry uses a certificate signed by the company's internal CA. The admin exports HTTP_PROXY and HTTPS_PROXY in the interactive shell, runs docker pull, and still gets the TLS error. curl -v https://registry.internal:5000/v2/ from the same shell succeeds. The host runs systemd. The registry hostname must not be routed through the external proxy.

1. Why does `curl` succeed while `docker pull` fails, and what must change for the daemon to trust the internal CA?

Read the worked answer

curl runs as the admin's shell process and inherits HTTP_PROXY/HTTPS_PROXY and the system trust store. The Docker daemon is a separate systemd service; it does not inherit the interactive shell's environment. So the daemon neither uses the proxy variables nor necessarily the same trust configuration.

For the daemon to trust the internal CA, the CA certificate must be installed where the daemon looks. On Linux, place the CA PEM (e.g., /etc/docker/certs.d/registry.internal:5000/ca.crt) and/or add it to the system trust store (/etc/pki/ca-trust/source/anchors/ then update-ca-certificates or update-ca-trust), then restart the daemon. The per-registry certs.d path is the most precise fix because it scopes trust to that registry.

Proxy settings for the daemon must likewise be configured for the service, not the shell - typically via a systemd drop-in setting HTTP_PROXY/HTTPS_PROXY/NO_PROXY in the unit environment, followed by systemctl daemon-reload and a restart. NO_PROXY=registry.internal keeps internal traffic off the external proxy.

2. Write the configuration changes and verification steps, including how to prove the internal registry bypasses the proxy.

Read the worked answer

CA trust

sudo mkdir -p /etc/docker/certs.d/registry.internal:5000
sudo cp corp-ca.crt /etc/docker/certs.d/registry.internal:5000/ca.crt

Optionally also add to the system store so other tools trust it.

Daemon proxy (systemd drop-in)

sudo mkdir -p /etc/systemd/system/docker.service.d
# /etc/systemd/system/docker.service.d/proxy.conf
[Service]
Environment="HTTP_PROXY=http://proxy.corp:3128"
Environment="HTTPS_PROXY=http://proxy.corp:3128"
Environment="NO_PROXY=registry.internal,localhost,127.0.0.1"

Apply

sudo systemctl daemon-reload
sudo systemctl restart docker

Verify

docker info shows the proxy settings under the daemon's HTTP proxy section.
docker pull registry.internal:5000/app:2.1 succeeds.
Prove bypass: temporarily block the proxy or inspect proxy logs during a pull; no request for registry.internal should appear. Alternatively, docker pull a public image and confirm the proxy log records it, while the internal pull does not.
systemctl show docker -p Environment confirms the variables are in the unit environment.

If the TLS error persists, confirm the certificate's SAN includes registry.internal:5000 and that the daemon was actually restarted.