{"action":"created","issue":{"url":"https://api.github.com/repos/docker/distribution/issues/479","labels_url":"https://api.github.com/repos/docker/distribution/issues/479/labels{/name}","comments_url":"https://api.github.com/repos/docker/distribution/issues/479/comments","events_url":"https://api.github.com/repos/docker/distribution/issues/479/events","html_url":"https://github.com/docker/distribution/issues/479","id":72266196,"number":479,"title":"Registry downgrades from HTTPS to HTTP when uploading layers","user":{"login":"burke","id":1284,"avatar_url":"https://avatars.githubusercontent.com/u/1284?v=3","gravatar_id":"","url":"https://api.github.com/users/burke","html_url":"https://github.com/burke","followers_url":"https://api.github.com/users/burke/followers","following_url":"https://api.github.com/users/burke/following{/other_user}","gists_url":"https://api.github.com/users/burke/gists{/gist_id}","starred_url":"https://api.github.com/users/burke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/burke/subscriptions","organizations_url":"https://api.github.com/users/burke/orgs","repos_url":"https://api.github.com/users/burke/repos","events_url":"https://api.github.com/users/burke/events{/privacy}","received_events_url":"https://api.github.com/users/burke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/distribution/labels/documentation","name":"documentation","color":"0052cc"},{"url":"https://api.github.com/repos/docker/distribution/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-04-30T19:56:31Z","updated_at":"2015-04-30T20:30:46Z","closed_at":null,"body":"```\r\nDEBU[0047] [registry] Calling \"POST\" https://registry3.ash.shopify.io/v2/deleteme/blobs/uploads/\r\nDEBU[0047] https://registry3.ash.shopify.io/v2/deleteme/blobs/uploads/ -- HEADERS: map[User-Agent:[docker/1.6.0 go/go1.4.2 git-commit/4749651 kernel/3.18.8-031808-generic os/linux arch/amd64] Authorization:[Basic Og==]]\r\nDEBU[0047] hostDir: /etc/docker/certs.d/registry3.ash.shopify.io\r\nDEBU[0047] [registry] Calling \"PUT\" http://registry3.ash.shopify.io/v2/deleteme/blobs/uploads/75ca4844-a94c-4b40-9cb3-8e21d7c16565?_state=eI9aAEqgMmRdGxWZA6-Kgqv98Zb224Grxt2610KKqZt7Ik5hbWUiOiJkZWxldGVtZSIsIlVVSUQiOiI3NWNhNDg0NC1hOTRjLTRiNDAtOWNiMy04ZTIxZDdjMTY1NjUiLCJPZmZzZXQiOjAsIlN0YXJ0ZWRBdCI6IjIwMTUtMDQtMjlUMjA6Mzg6MTYuMjE0MjYxNDg4WiJ9\r\nDEBU[0047] http://registry3.ash.shopify.io/v2/deleteme/blobs/uploads/75ca4844-a94c-4b40-9cb3-8e21d7c16565?_state=eI9aAEqgMmRdGxWZA6-Kgqv98Zb224Grxt2610KKqZt7Ik5hbWUiOiJkZWxldGVtZSIsIlVVSUQiOiI3NWNhNDg0NC1hOTRjLTRiNDAtOWNiMy04ZTIxZDdjMTY1NjUiLCJPZmZzZXQiOjAsIlN0YXJ0ZWRBdCI6IjIwMTUtMDQtMjlUMjA6Mzg6MTYuMjE0MjYxNDg4WiJ9 -- HEADERS: map[User-Agent:[docker/1.6.0 go/go1.4.2 git-commit/4749651 kernel/3.18.8-031808-generic os/linux arch/amd64] Authorization:[Basic Og==]]\r\n```\r\n\r\nThe [docker-side code generating these messages](https://github.com/docker/docker/blob/master/registry/session_v2.go#L216-L222) is: \r\n\r\n```go\r\n\tlocation, err := r.initiateBlobUpload(ep, imageName, auth)\r\n\tif err != nil {\r\n\t\treturn err\r\n\t}\r\n\r\n\tmethod := \"PUT\"\r\n\tlogrus.Debugf(\"[registry] Calling %q %s\", method, location)\r\n```\r\n\r\n`initiateBlobUpload` does the initial `POST` to `.../uploads/`, and the `Location` header is extracted from the response to use as the URL for the followup `PUT` request.\r\n\r\nWe're running our registry from behind a reverse proxy cache, where we terminate SSL. So the registry is serving up unauthenticated HTTP but docker is speaking TLS.\r\n\r\nIt appears that the registry, despite getting the hostname right, generates URLs using `http://` -- which, to some extent, makes sense -- that is what it's speaking.\r\n\r\nI can fix this in my own usecase by adding `proxy_redirect http:// https://` to my nginx config, but I feel like this is a problem that should probably be prevented somehow.\r\n"},"comment":{"url":"https://api.github.com/repos/docker/distribution/issues/comments/97956718","html_url":"https://github.com/docker/distribution/issues/479#issuecomment-97956718","issue_url":"https://api.github.com/repos/docker/distribution/issues/479","id":97956718,"user":{"login":"burke","id":1284,"avatar_url":"https://avatars.githubusercontent.com/u/1284?v=3","gravatar_id":"","url":"https://api.github.com/users/burke","html_url":"https://github.com/burke","followers_url":"https://api.github.com/users/burke/followers","following_url":"https://api.github.com/users/burke/following{/other_user}","gists_url":"https://api.github.com/users/burke/gists{/gist_id}","starred_url":"https://api.github.com/users/burke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/burke/subscriptions","organizations_url":"https://api.github.com/users/burke/orgs","repos_url":"https://api.github.com/users/burke/repos","events_url":"https://api.github.com/users/burke/events{/privacy}","received_events_url":"https://api.github.com/users/burke/received_events","type":"User","site_admin":false},"created_at":"2015-04-30T20:30:46Z","updated_at":"2015-04-30T20:30:46Z","body":"Yup, that works, thanks!"}}