How to fix Error response from daemon: Get https://myregistry:5000/v2/: http: server gave HTTP response to HTTPS client in Docker

DockerINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 200 views

This error occurs when Docker attempts to connect to a registry over HTTPS, but the registry is only serving plain HTTP. Docker defaults to secure HTTPS connections for all registries, so you must explicitly configure it to allow insecure HTTP connections to specific registries.

Quick fix

Fixes Error response from daemon: Get https://myregistry:5000/v2/: http: server gave HTTP response to HTTPS client

# Create or edit the Docker daemon configuration
sudo nano /etc/docker/daemon.json

Add registry to insecure-registries in daemon.json
Configure Docker Desktop (Windows/macOS)
Fix BuildKit insecure registry issues (Docker 23+)
Verify and restart Docker daemon

docker — error

$# Create or edit the Docker daemon configuration
sudo nano /etc/docker/daemon.json
Error response from daemon: Get https://myregistry:5000/v2/: http: server gave HTTP response to HTTPS client

What this error means

The "http: server gave HTTP response to HTTPS client" error appears when Docker's client tries to establish a secure TLS/HTTPS connection to a container registry, but the registry responds with unencrypted HTTP instead. Docker, by design, assumes all registries are secure and will only communicate over HTTPS unless explicitly configured otherwise. This commonly happens in several scenarios: - **Private registries** running without TLS certificates configured - **Development environments** where setting up certificates is unnecessary - **Local registries** running on localhost or internal networks - **Air-gapped environments** where external CA verification isn't possible Starting with Docker 1.3.2, the client enforces HTTPS for all registry communications except localhost. When the registry only supports HTTP, Docker receives an HTTP response when expecting HTTPS, causing this protocol mismatch error. The daemon requires explicit configuration via the `insecure-registries` option to allow HTTP connections.

Typical symptoms

docker pull fails with 'http: server gave HTTP response to HTTPS client'
docker push to private registry fails with protocol error
docker login to local registry returns HTTP/HTTPS mismatch error
Commands work with Docker Hub but fail with private registries
Registry worked before Docker upgrade but fails now
Docker build fails when pulling from internal registry
Error occurs with BuildKit enabled but didn't before

Common causes

Private registry is configured to serve HTTP only (no TLS/SSL)
Registry port is not configured with SSL certificates
Docker daemon is not configured to allow insecure registries
Docker daemon.json configuration was not applied (Docker not restarted)
BuildKit ignores insecure-registries setting (Docker 23+ issue)
DOCKER_TLS_VERIFY environment variable is set unexpectedly
Using wrong port (2375 for HTTP vs 2376 for HTTPS)

How to fix "Error response from daemon: Get https://myregistry:5000/v2/: http: server gave HTTP response to HTTPS client"

1Add registry to insecure-registries in daemon.json

The most common fix is to explicitly tell Docker to allow HTTP connections to your registry by adding it to the insecure-registries list:

bash

# Create or edit the Docker daemon configuration
sudo nano /etc/docker/daemon.json

Add your registry to the insecure-registries array:

json

{
  "insecure-registries": ["myregistry:5000"]
}

For multiple registries or CIDR ranges:

json

{
  "insecure-registries": [
    "myregistry:5000",
    "192.168.1.100:5000",
    "10.0.0.0/8"
  ]
}

Then restart Docker to apply the changes:

bash

sudo systemctl restart docker

# Verify the configuration was applied
docker info | grep -A 10 "Insecure Registries"

Note: The registry address must exactly match how you reference it in Docker commands, including the port number.

2Configure Docker Desktop (Windows/macOS)

For Docker Desktop, configure insecure registries through the GUI:

Docker Desktop on Windows/macOS:
1. Click the Docker icon in the system tray/menu bar
2. Select Settings (or Preferences on macOS)
3. Go to Docker Engine tab
4. Add your registry to the JSON configuration:

json

{
  "insecure-registries": ["myregistry:5000"]
}

5. Click Apply & Restart

Alternative on Windows (daemon.json location):

bash

C:\ProgramData\docker\config\daemon.json

Verify configuration:

powershell

docker info | Select-String "Insecure"

3Fix BuildKit insecure registry issues (Docker 23+)

Starting with Docker Engine v23.0, BuildKit became the default builder and it ignores the insecure-registries setting in daemon.json. Use one of these workarounds:

Option 1: Disable BuildKit temporarily

bash

DOCKER_BUILDKIT=0 docker build -t myregistry:5000/myimage .

Option 2: Use BUILDKIT_NO_CLIENT_TOKEN

bash

BUILDKIT_NO_CLIENT_TOKEN=true docker build -t myregistry:5000/myimage .

Option 3: Configure buildx with insecure registry

bash

# Create a new builder with host network access
docker buildx create --name mybuilder --driver-opt network=host --use

# Build with --allow option
docker buildx build --allow insecure --push -t myregistry:5000/myimage .

Option 4: Configure buildx with registry config
Create ~/.docker/buildx/buildkitd.toml:

toml

[registry."myregistry:5000"]
  http = true
  insecure = true

4Verify and restart Docker daemon

After making configuration changes, you must restart Docker and verify the settings took effect:

bash

# Restart Docker daemon
sudo systemctl daemon-reload
sudo systemctl restart docker

# Verify Docker is running
sudo systemctl status docker

# Check insecure registries are configured
docker info 2>/dev/null | grep -A 5 "Insecure Registries"

Expected output should show your registry:

bash

Insecure Registries:
  myregistry:5000
  127.0.0.0/8

If your registry doesn't appear, check the daemon.json syntax:

bash

# Validate JSON syntax
cat /etc/docker/daemon.json | python3 -m json.tool

# Check Docker logs for configuration errors
sudo journalctl -u docker.service --since "5 minutes ago"

5Test registry connectivity

After configuration, test that Docker can connect to your registry:

bash

# Test pull from registry
docker pull myregistry:5000/test-image:latest

# Or test login if authentication is required
docker login myregistry:5000

# Test push capability
docker tag alpine:latest myregistry:5000/alpine:test
docker push myregistry:5000/alpine:test

If still failing, test the registry directly:

bash

# Check if registry is reachable and responding
curl -v http://myregistry:5000/v2/

# Expected response for healthy registry:
# HTTP/1.1 200 OK
# {}

If curl works but Docker doesn't, ensure the registry address in daemon.json exactly matches your Docker commands.

6Configure TLS for production registries

For production environments, the recommended solution is to configure TLS on your registry rather than using insecure connections:

Option 1: Add SSL certificates to Docker Registry

yaml

# docker-compose.yml for registry with TLS
version: '3'
services:
  registry:
    image: registry:2
    ports:
      - "5000:5000"
    environment:
      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/registry.crt
      REGISTRY_HTTP_TLS_KEY: /certs/registry.key
    volumes:
      - ./certs:/certs
      - registry-data:/var/lib/registry
volumes:
  registry-data:

Option 2: Use Let's Encrypt with Traefik/nginx
Place a reverse proxy in front of your registry that handles TLS termination.

Option 3: Add self-signed cert to Docker
If using self-signed certificates, add them to Docker's trust store:

bash

sudo mkdir -p /etc/docker/certs.d/myregistry:5000
sudo cp ca.crt /etc/docker/certs.d/myregistry:5000/ca.crt
sudo systemctl restart docker

This is more secure than marking the registry as insecure, as it still validates the certificate.

Advanced notes

Understanding the security implications:
Using insecure-registries disables TLS verification entirely for the specified registries. This means:
- No encryption of data in transit (images, credentials)
- No verification of registry identity (vulnerable to man-in-the-middle attacks)
- Should never be used in production or over untrusted networks

CIDR notation for multiple hosts:
You can configure entire subnets as insecure:

json

{
  "insecure-registries": ["10.0.0.0/8", "192.168.0.0/16"]
}

Linux service file override (alternative method):
If daemon.json doesn't work, modify the Docker service:

bash

sudo systemctl edit docker.service

Add:

ini

[Service]
ExecStart=
ExecStart=/usr/bin/dockerd --insecure-registry myregistry:5000

Then reload and restart:

bash

sudo systemctl daemon-reload
sudo systemctl restart docker

SSH tunnel workaround:
Docker allows HTTP traffic to localhost. You can tunnel to your registry:

bash

ssh -L 5000:myregistry:5000 user@jump-host
docker pull localhost:5000/myimage

containerd/CRI-O configuration:
For Kubernetes nodes using containerd:

toml

# /etc/containerd/config.toml
[plugins."io.containerd.grpc.v1.cri".registry.configs."myregistry:5000".tls]
  insecure_skip_verify = true

Debugging DOCKER_TLS_VERIFY:
Check if environment variables are overriding your configuration:

bash

env | grep -i docker
# If DOCKER_TLS_VERIFY=1 is set, unset it:
unset DOCKER_TLS_VERIFY

Frequently asked questions

What does "Error response from daemon: Get https://myregistry:5000/v2/: http: ser" mean?: The "http: server gave HTTP response to HTTPS client" error appears when Docker's client tries to establish a secure TLS/HTTPS connection to a container registry, but the registry responds with unencrypted HTTP instead. Docker, by design, assumes all registries are secure and will only communicate over HTTPS unless explicitly configured otherwise. 2, the client enforces HTTPS for all registry communications except localhost.
How do I fix "Error response from daemon: Get https://myregistry:5000/v2/: http: ser"?: This error occurs when Docker attempts to connect to a registry over HTTPS, but the registry is only serving plain HTTP. Docker defaults to secure HTTPS connections for all registries, so you must explicitly configure it to allow insecure HTTP connections to specific registries.
What causes "Error response from daemon: Get https://myregistry:5000/v2/: http: ser"?: Private registry is configured to serve HTTP only (no TLS/SSL) Registry port is not configured with SSL certificates Docker daemon is not configured to allow insecure registries
Is the "Error response from daemon: Get https://myregistry:5000/v2/: http: ser" error serious?: It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading

📚Docker Official Documentation
📖
Test an insecure registry - Docker Docs(Official Docs)
📖
dockerd CLI reference - Docker Docs(Official Docs)
💬
Docker repository server gave HTTP response to HTTPS client(Stack Overflow)
🐙
BuildKit ignores insecure-registries - GitHub Issue(GitHub)
💬
Cannot pull/push images after Docker upgrade(Stack Overflow)
🐙
docker compose v2 build error with insecure registry(GitHub)

How to fix Error response from daemon: Get https://myregistry:5000/v2/: http: server gave HTTP response to HTTPS client in Docker

Quick fix

What this error means

Typical symptoms

Common causes

How to fix "Error response from daemon: Get https://myregistry:5000/v2/: http: server gave HTTP response to HTTPS client"

Advanced notes

Frequently asked questions

Related errors

Official resources & further reading