{"action":"created","issue":{"url":"https://api.github.com/repos/docker/distribution/issues/996","labels_url":"https://api.github.com/repos/docker/distribution/issues/996/labels{/name}","comments_url":"https://api.github.com/repos/docker/distribution/issues/996/comments","events_url":"https://api.github.com/repos/docker/distribution/issues/996/events","html_url":"https://github.com/docker/distribution/issues/996","id":107129530,"number":996,"title":"Docker registry does not work behind TLS-only proxy (stunnel)","user":{"login":"lwcolton","id":1420846,"avatar_url":"https://avatars.githubusercontent.com/u/1420846?v=3","gravatar_id":"","url":"https://api.github.com/users/lwcolton","html_url":"https://github.com/lwcolton","followers_url":"https://api.github.com/users/lwcolton/followers","following_url":"https://api.github.com/users/lwcolton/following{/other_user}","gists_url":"https://api.github.com/users/lwcolton/gists{/gist_id}","starred_url":"https://api.github.com/users/lwcolton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lwcolton/subscriptions","organizations_url":"https://api.github.com/users/lwcolton/orgs","repos_url":"https://api.github.com/users/lwcolton/repos","events_url":"https://api.github.com/users/lwcolton/events{/privacy}","received_events_url":"https://api.github.com/users/lwcolton/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/distribution/labels/bug","name":"bug","color":"e11d21"}],"state":"open","locked":false,"assignee":{"login":"aaronlehmann","id":10601430,"avatar_url":"https://avatars.githubusercontent.com/u/10601430?v=3","gravatar_id":"","url":"https://api.github.com/users/aaronlehmann","html_url":"https://github.com/aaronlehmann","followers_url":"https://api.github.com/users/aaronlehmann/followers","following_url":"https://api.github.com/users/aaronlehmann/following{/other_user}","gists_url":"https://api.github.com/users/aaronlehmann/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronlehmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronlehmann/subscriptions","organizations_url":"https://api.github.com/users/aaronlehmann/orgs","repos_url":"https://api.github.com/users/aaronlehmann/repos","events_url":"https://api.github.com/users/aaronlehmann/events{/privacy}","received_events_url":"https://api.github.com/users/aaronlehmann/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/docker/distribution/milestones/9","html_url":"https://github.com/docker/distribution/milestones/Registry/2.2","labels_url":"https://api.github.com/repos/docker/distribution/milestones/9/labels","id":1026605,"number":9,"title":"Registry/2.2","description":"","creator":{"login":"stevvooe","id":120601,"avatar_url":"https://avatars.githubusercontent.com/u/120601?v=3","gravatar_id":"","url":"https://api.github.com/users/stevvooe","html_url":"https://github.com/stevvooe","followers_url":"https://api.github.com/users/stevvooe/followers","following_url":"https://api.github.com/users/stevvooe/following{/other_user}","gists_url":"https://api.github.com/users/stevvooe/gists{/gist_id}","starred_url":"https://api.github.com/users/stevvooe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevvooe/subscriptions","organizations_url":"https://api.github.com/users/stevvooe/orgs","repos_url":"https://api.github.com/users/stevvooe/repos","events_url":"https://api.github.com/users/stevvooe/events{/privacy}","received_events_url":"https://api.github.com/users/stevvooe/received_events","type":"User","site_admin":false},"open_issues":35,"closed_issues":55,"state":"open","created_at":"2015-03-18T04:28:58Z","updated_at":"2015-09-30T11:19:35Z","due_on":"2015-10-05T07:00:00Z","closed_at":null},"comments":4,"created_at":"2015-09-18T04:08:33Z","updated_at":"2015-09-30T17:35:34Z","closed_at":null,"body":"I have docker registry set up behind stunnel.  I could use curl to GET /v2/ just fine, but for some reason image pushes would fail.   I discovered if the registry config does not have any tls settings under the http section, the registry assumes the client is communicating via http and responds to POST /v2/<name>/blobs/uploads with a URL prefix of http://   This causes the client to then attempt to push the image to the http:// url, and the world breaks.\r\n\r\nExample:\r\n\r\ncurl -D - -X POST https://our.docker.server:8443/v2/gunicorn-base/blobs/uploads/\r\nHTTP/1.1 202 Accepted\r\nContent-Length: 0\r\nDocker-Distribution-Api-Version: registry/2.0\r\nDocker-Upload-Uuid: 4299c757-b2d3-40d2-bc9b-7cac8083c2ae\r\nLocation: http://our.docker.server/v2/gunicorn-base/blobs/uploads/<redacted>\r\n\r\nNotice how the client originally requested a URL beginning with https:// and the server responded with a location starting with http://\r\n\r\nMy recommendation is to add a setting under the http or tls section that will tell the registry to use an https:// url prefix even though it does not have tls configured.\r\n```\r\nInfos:\r\n# docker version\r\nClient:\r\n Version:      1.9.0-dev\r\n API version:  1.21\r\n Go version:   go1.4.2\r\n Git commit:   d2e7ba4\r\n Built:        Thu Sep 17 23:46:39 UTC 2015\r\n OS/Arch:      linux/amd64\r\n\r\nServer:\r\n Version:      1.9.0-dev\r\n API version:  1.21\r\n Go version:   go1.4.2\r\n Git commit:   d2e7ba4\r\n Built:        Thu Sep 17 23:46:39 UTC 2015\r\n OS/Arch:      linux/amd64\r\n\r\n# docker info\r\nContainers: 9\r\nImages: 637\r\nStorage Driver: aufs\r\n Root Dir: /var/lib/docker/aufs\r\n Backing Filesystem: xfs\r\n Dirs: 658\r\n Dirperm1 Supported: false\r\nExecution Driver: native-0.2\r\nLogging Driver: json-file\r\nKernel Version: 3.13.0-61-generic\r\nOperating System: Ubuntu 14.04.2 LTS\r\nCPUs: 2\r\nTotal Memory: 3.908 GiB\r\nName: raptorcage\r\nID: R7QM:23DE:XOID:O2UY:JZCI:5BT3:A2WX:7C2F:M6DF:B4E3:XAPF:AZIJ\r\nWARNING: No swap limit support\r\n\r\n# docker exec registry_main_1 registry --version\r\nregistry github.com/docker/distribution v2.1.1\r\n\r\nRegistry Config:\r\n\r\nversion: 0.1\r\nlog:\r\n  fields:\r\n    service: registry\r\nstorage:\r\n    cache:\r\n        blobdescriptor: inmemory\r\n    s3:\r\n        accesskey: <redacted>\r\n        secretkey: <redacted>\r\n        region: us-east-1\r\n        bucket: some-bucket\r\n        rootdirectory: /v2-registry\r\n        encrypt: true\r\n        secure: true\r\n        v4auth: true\r\nhttp:\r\n    addr: :5000\r\n    headers:\r\n        X-Content-Type-Options: [nosniff]\r\nhealth:\r\n  storagedriver:\r\n    enabled: true\r\n\r\nWhat happens when I push:\r\n08eefe93c719: Pushing 1.024 kB\r\nread tcp <redacted>:8443: connection reset by peer\r\n\r\nWhat I see in the  syslog for stunnel (clearly indicating the docker client is trying to use http after seeing the bad referred send by the registry):\r\n\r\nSep 18 04:04:51 <redacted> stunnel: LOG5[10682:140222830589696]: Service [registry] accepted connection from <redacted>\r\nSep 18 04:04:51 <redacted> stunnel: LOG3[10682:140222830589696]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol\r\nSep 18 04:04:51 <redacted> stunnel: LOG5[10682:140222830589696]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/docker/distribution/issues/comments/144485333","html_url":"https://github.com/docker/distribution/issues/996#issuecomment-144485333","issue_url":"https://api.github.com/repos/docker/distribution/issues/996","id":144485333,"user":{"login":"djenriquez","id":4636740,"avatar_url":"https://avatars.githubusercontent.com/u/4636740?v=3","gravatar_id":"","url":"https://api.github.com/users/djenriquez","html_url":"https://github.com/djenriquez","followers_url":"https://api.github.com/users/djenriquez/followers","following_url":"https://api.github.com/users/djenriquez/following{/other_user}","gists_url":"https://api.github.com/users/djenriquez/gists{/gist_id}","starred_url":"https://api.github.com/users/djenriquez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djenriquez/subscriptions","organizations_url":"https://api.github.com/users/djenriquez/orgs","repos_url":"https://api.github.com/users/djenriquez/repos","events_url":"https://api.github.com/users/djenriquez/events{/privacy}","received_events_url":"https://api.github.com/users/djenriquez/received_events","type":"User","site_admin":false},"created_at":"2015-09-30T17:35:34Z","updated_at":"2015-09-30T17:35:34Z","body":"I believe I'm having the same issue with #1043, however I'm not really sure how to test this. I am able to pull images and push  UNCHANGED images, but cannot push new images or images with changes.\r\n\r\nMy private registry is behind an ELB, which handles the TLS termination then routed behind an NGINX reverse-proxy to the container. I also have an authentication server using [cesanta/docker_auth](https://github.com/cesanta/docker_auth) where traffic is TCP streamed from an ELB into the container, which then handles the TLS termination. Cesanta/docker_auth requires the TLS termination to happen in the container, which is why I'm not being consistent with TLS termination.\r\n\r\nFrom what @lwcolton stated, since my registry config does not have TLS defined, it would push to an http:// location and would break.\r\n\r\nAm I having the same issue? If so, why does it only affect pushes? Is there an ETA for a fix?"}}