How to fix Error response from daemon: Get https://myregistry:5000/v2/: dial tcp: connect: connection refused in Docker

DockerBEGINNERMEDIUMUpdated Dec 6, 2025· 225 views

This error occurs when Docker cannot establish a TCP connection to a container registry. The registry service may not be running, the port may be incorrect, or network/firewall rules are blocking the connection.

Quick fix

Fixes Error response from daemon: Get https://myregistry:5000/v2/: dial tcp: connect: connection refused

# List running containers
docker ps | grep registry

# Check all containers (including stopped)
docker ps -a | grep registry
  1. Verify the registry container is running
  2. Check port mapping and listening status
  3. Use correct hostname for your environment
  4. Configure insecure registry (for HTTP registries)
docker — error
# List running containers
docker ps | grep registry
# Check all containers (including stopped)
docker ps -a | grep registry
Error response from daemon: Get https://myregistry:5000/v2/: dial tcp: connect: connection refused

What this error means

The "connection refused" error when connecting to a Docker registry indicates that your Docker client is attempting to reach a registry server, but the TCP connection is being actively refused. This means either nothing is listening on the specified port, or a firewall is blocking the connection at the network level. This error commonly appears in several scenarios: - **Private registries**: When connecting to a self-hosted registry like Harbor, Nexus, or the official Docker Registry image - **Local development**: When pushing/pulling from a local registry running on localhost:5000 - **CI/CD pipelines**: When the registry service container hasn't fully started yet - **BuildKit builds**: When using `docker buildx` to push to a local registry with different network contexts The URL in the error message (e.g., `https://myregistry:5000/v2/`) reveals the registry hostname, port, and protocol being used. The `/v2/` path is the Docker Registry HTTP API endpoint that clients use to check registry availability.

Typical symptoms

  • Docker push/pull fails with 'dial tcp: connect: connection refused'
  • Error message shows connection to a custom registry hostname like 'myregistry:5000'
  • 'docker login' to private registry fails with connection error
  • CI/CD pipeline fails when trying to push built images
  • Local registry appears to start but remains unreachable
  • BuildKit builds fail with registry connection errors during --push

Common causes

  1. Registry container or service is not running
  2. Registry is listening on a different port than expected
  3. Firewall blocking port 5000 or the configured registry port
  4. Incorrect hostname - using 'localhost' when registry is in another container
  5. Registry container not exposing the port to the host
  6. Network isolation preventing container-to-container communication
  7. Registry crashed due to storage or configuration issues
  8. SSL/TLS configuration mismatch (HTTP vs HTTPS)
  9. Docker Desktop or BuildKit using different network context than registry

How to fix "Error response from daemon: Get https://myregistry:5000/v2/: dial tcp: connect: connection refused"

1Verify the registry container is running

First, check if your registry container is actually running:

bash
# List running containers
docker ps | grep registry

# Check all containers (including stopped)
docker ps -a | grep registry

If the registry is stopped, check the logs for errors:

bash
docker logs registry

Start or restart the registry if needed:

bash
# If stopped
docker start registry

# If not created, start a basic local registry
docker run -d --restart=always -p 5000:5000 --name registry registry:2
2Check port mapping and listening status

Verify the registry is listening on the expected port:

Check container port mapping:

bash
docker port registry
# Should show: 5000/tcp -> 0.0.0.0:5000

Verify port is listening on host:

bash
# Linux
ss -tlnp | grep 5000
netstat -tlnp | grep 5000

# macOS
lsof -i :5000

# Windows
netstat -ano | findstr 5000

Test connectivity:

bash
# Check if registry responds
curl -v http://localhost:5000/v2/

# Expected response: {"repositories":[]} or similar

If the port isn't mapped, recreate the registry with correct port binding:

bash
docker rm -f registry
docker run -d --restart=always -p 5000:5000 --name registry registry:2
3Use correct hostname for your environment

The hostname you use depends on where Docker commands run:

From host machine:

bash
# Use localhost
docker tag myimage localhost:5000/myimage
docker push localhost:5000/myimage

From another container (e.g., in CI/CD):

bash
# Use the registry container name or Docker network hostname
docker tag myimage registry:5000/myimage
docker push registry:5000/myimage

# Or use host.docker.internal (Docker Desktop)
docker tag myimage host.docker.internal:5000/myimage
docker push host.docker.internal:5000/myimage

In Docker Compose:

yaml
services:
  registry:
    image: registry:2
    ports:
      - "5000:5000"

  builder:
    image: docker:latest
    environment:
      # Use service name as hostname
      REGISTRY_HOST: registry:5000
    depends_on:
      - registry
4Configure insecure registry (for HTTP registries)

If your registry uses HTTP instead of HTTPS, Docker requires explicit configuration:

Docker Desktop (Windows/macOS):
1. Open Docker Desktop Settings
2. Go to Docker Engine
3. Add your registry to the insecure-registries list:

json
{
  "insecure-registries": ["myregistry:5000", "localhost:5000"]
}

4. Click "Apply & Restart"

Linux - Edit daemon.json:

bash
sudo tee /etc/docker/daemon.json << EOF
{
  "insecure-registries": ["myregistry:5000", "localhost:5000"]
}
EOF

sudo systemctl restart docker

Verify configuration:

bash
docker info | grep -A5 "Insecure Registries"

Note: "Insecure" here refers to HTTP (not HTTPS), not to authentication. For production, always use HTTPS.

5Fix BuildKit/buildx registry connectivity

BuildKit (used by docker buildx) runs in a separate context and may not reach localhost registries:

Problem: BuildKit container can't reach localhost:5000 because localhost refers to the BuildKit container, not the host.

Solution 1: Use host network mode for buildx:

bash
docker buildx create --name hostbuilder --driver docker-container --driver-opt network=host
docker buildx use hostbuilder
docker buildx build --push -t localhost:5000/myimage .

Solution 2: Use host.docker.internal (Docker Desktop):

bash
docker buildx build --push -t host.docker.internal:5000/myimage .

Solution 3: Put registry and buildx on same Docker network:

bash
# Create network
docker network create buildnet

# Start registry on network
docker run -d --name registry --network buildnet -p 5000:5000 registry:2

# Create buildx builder on same network
docker buildx create --name netbuilder --driver docker-container --driver-opt network=buildnet
docker buildx use netbuilder

# Push using registry container name
docker buildx build --push -t registry:5000/myimage .
6Add startup delay in CI/CD pipelines

Registry containers need time to initialize. Add a wait step in CI/CD:

GitLab CI example:

yaml
services:
  - name: registry:2
    alias: registry

variables:
  REGISTRY_HOST: registry:5000

build:
  script:
    # Wait for registry to be ready
    - |
      echo "Waiting for registry..."
      timeout 30 sh -c 'until curl -sf http://registry:5000/v2/; do sleep 1; done'
      echo "Registry is ready!"

    - docker build -t $REGISTRY_HOST/myimage .
    - docker push $REGISTRY_HOST/myimage

GitHub Actions example:

yaml
services:
  registry:
    image: registry:2
    ports:
      - 5000:5000

steps:
  - name: Wait for registry
    run: |
      timeout 30 sh -c 'until curl -sf http://localhost:5000/v2/; do sleep 1; done'

  - name: Build and push
    run: |
      docker build -t localhost:5000/myimage .
      docker push localhost:5000/myimage
7Check firewall and network rules

Firewall rules may block registry port:

Linux with UFW:

bash
# Check status
sudo ufw status

# Allow port 5000
sudo ufw allow 5000/tcp

Linux with firewalld:

bash
# Check ports
sudo firewall-cmd --list-ports

# Allow port 5000
sudo firewall-cmd --permanent --add-port=5000/tcp
sudo firewall-cmd --reload

Check Docker network connectivity:

bash
# List networks
docker network ls

# Inspect network
docker network inspect bridge

# Test connectivity from a container
docker run --rm curlimages/curl curl -v http://host.docker.internal:5000/v2/

Windows firewall:

powershell
# Check if port is allowed
Get-NetFirewallRule | Where-Object {$_.LocalPort -eq 5000}

# Add rule
New-NetFirewallRule -DisplayName "Docker Registry" -Direction Inbound -LocalPort 5000 -Protocol TCP -Action Allow
8Debug registry container health

If the registry container keeps crashing or becomes unresponsive:

Check container logs:

bash
docker logs registry --tail 100
docker logs registry -f  # Follow logs

Common registry issues and fixes:

Storage issues:

bash
# Check disk space in registry
docker exec registry df -h /var/lib/registry

# If full, prune old images (WARNING: removes unused images)
docker exec registry bin/registry garbage-collect /etc/docker/registry/config.yml

Configuration problems:

bash
# Check registry config
docker exec registry cat /etc/docker/registry/config.yml

# Start with verbose logging
docker run -d -p 5000:5000 --name registry \
  -e REGISTRY_LOG_LEVEL=debug \
  registry:2

Memory issues:

bash
# Check container stats
docker stats registry --no-stream

# Restart with memory limit
docker run -d -p 5000:5000 --name registry \
  --memory=512m \
  registry:2

Advanced notes

Understanding Docker Registry networking:

When working with registries, network context matters greatly:

- Host context: Commands run directly on the host can use localhost:5000
- Container context: Commands run inside containers must use container names, bridge IPs, or host.docker.internal
- BuildKit context: BuildKit runs in its own container and needs special network configuration

Registry authentication and TLS:

For production registries, always configure TLS and authentication:

bash
# Generate self-signed certificate
mkdir -p certs
openssl req -newkey rsa:4096 -nodes -sha256 \
  -keyout certs/domain.key -x509 -days 365 \
  -out certs/domain.crt \
  -subj "/CN=myregistry" \
  -addext "subjectAltName=DNS:myregistry,IP:192.168.1.100"

# Start registry with TLS
docker run -d -p 5000:5000 --name registry \
  -v $(pwd)/certs:/certs \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
  registry:2

# Configure Docker to trust the certificate
sudo mkdir -p /etc/docker/certs.d/myregistry:5000
sudo cp certs/domain.crt /etc/docker/certs.d/myregistry:5000/ca.crt

Using Docker registry mirror:

For air-gapped or slow network environments, configure registry as a pull-through cache:

yaml
# config.yml for registry
version: 0.1
proxy:
  remoteurl: https://registry-1.docker.io
storage:
  filesystem:
    rootdirectory: /var/lib/registry
bash
docker run -d -p 5000:5000 --name mirror \
  -v $(pwd)/config.yml:/etc/docker/registry/config.yml \
  registry:2

Debugging with Docker events:

Monitor Docker daemon events to see connection attempts:

bash
docker events --filter 'type=image' &
docker push myregistry:5000/test

Alternative registries with built-in UI:

If you frequently have registry issues, consider registries with web interfaces for easier debugging:
- Harbor (enterprise features, vulnerability scanning)
- Nexus Repository (supports multiple package formats)
- GitLab Container Registry (integrated with GitLab CI)
- Portus (open source UI for Docker Registry)

Frequently asked questions

What does "Error response from daemon: Get https://myregistry:5000/v2/: dial tcp:" mean?
The "connection refused" error when connecting to a Docker registry indicates that your Docker client is attempting to reach a registry server, but the TCP connection is being actively refused. This means either nothing is listening on the specified port, or a firewall is blocking the connection at the network level. , https://myregistry:5000/v2/) reveals the registry hostname, port, and protocol being used.
How do I fix "Error response from daemon: Get https://myregistry:5000/v2/: dial tcp:"?
This error occurs when Docker cannot establish a TCP connection to a container registry. The registry service may not be running, the port may be incorrect, or network/firewall rules are blocking the connection.
What causes "Error response from daemon: Get https://myregistry:5000/v2/: dial tcp:"?
Registry container or service is not running Registry is listening on a different port than expected Firewall blocking port 5000 or the configured registry port
Is the "Error response from daemon: Get https://myregistry:5000/v2/: dial tcp:" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading