[Docker Insecure Registry] "server gave HTTP response to HTTPS client"

본 포스팅에서는 http로 docker command를 실행하는 방법에 대해 간략히 살펴보겠습니다.

앞선 수많은 포스팅에서 언급했던 내용을 정리하는 차원이며, 다음과 같은 에러 발생 시 대처 방안입니다.

[root@kubemaster ~]# docker push 192.168.56.102:80/nara0617/my-apache2/latest
The push refers to a repository [192.168.56.102:80/nara0617/my-apache2/latest]
Get https://192.168.56.102:80/v1/_ping: http: server gave HTTP response to HTTPS client
[root@kubemaster ~]#

에러 문구와 같이 문제 발생 시 두가지 방안으로 대응할 수 있습니다.

1) /etc/docker/daemon.json 수정

[root@kubemaster ~]# cat /etc/docker/daemon.json 
{
    "insecure-registries": ["192.168.56.102:5000", "192.168.56.101:5000"]
}
[root@kubemaster ~]# 

docker command를 수행하고자 하는 여러 registry를 추가할 수 있습니다.

2) /etc/sysconfig/docker 수정

[root@kubemaster ~]# vi /etc/sysconfig/docker
# /etc/sysconfig/docker

# Modify these options if you want to change the way the docker daemon runs
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false --insecure-registry=192.168.56.102:5000 --insecure-registry=192.168.56.101:5000'
if [ -z "${DOCKER_CERT_PATH}" ]; then
    DOCKER_CERT_PATH=/etc/docker
fi

# Do not add registries in this file anymore. Use /etc/containers/registries.conf
# instead. For more information reference the registries.conf(5) man page.

# Location used for temporary files, such as those created by
# docker load and build operations. Default is /var/lib/docker/tmp
# Can be overriden by setting the following environment variable.
# DOCKER_TMPDIR=/var/tmp

# Controls the /etc/cron.daily/docker-logrotate cron job status.
# To disable, uncomment the line below.
# LOGROTATE=false

# docker-latest daemon can be used by starting the docker-latest unitfile.
# To use docker-latest client, uncomment below lines
#DOCKERBINARY=/usr/bin/docker-latest
#DOCKERDBINARY=/usr/bin/dockerd-latest
#DOCKER_CONTAINERD_BINARY=/usr/bin/docker-containerd-latest
#DOCKER_CONTAINERD_SHIM_BINARY=/usr/bin/docker-containerd-shim-latest
[root@kubemaster ~]# 

위와 같이 OPTIONS 뒤에 --insecure-registry==[DOCKER_REGISTRY_IP]:[DOCKER_REGISTRY_PORT]를 추가합니다. 마찬가지로 여러 도커에 접근하고자 할 경우 여러 개를 추가할 수 있습니다.

3) docker 재기동

[root@kubemaster ~]# systemctl daemon-reload
[root@kubemaster ~]# systemctl restart docker
[root@kubemaster ~]# docker run --name MyPrivate-Docker -d -p 5000:5000 registry
4f4874196dac2c37b6ed40648c913641c6e3344dfa1acf27d7048d3e277c5d18
[root@kubemaster ~]#

위와 같이 재기동 이후 registry에 다시 push를 실행하면, 

[root@kubemaster ~]# docker push 192.168.56.102:5000/nrson/hello:1.0
The push refers to a repository [192.168.56.102:5000/nrson/hello]
e79142719515: Pushed 
aeda103e78c9: Pushed 
2558e637fbff: Pushed 
f749b9b0fb21: Pushed 
1.0: digest: sha256:0a538ffd8d4b1d44c0fc68b81dae7eeae0a30b26915dfe9157743b1954e9cbba size: 1150
[root@kubemaster ~]#

위와 같이 정상적으로 이미지가 push 되는 것을 확인할 수 있습니다.