Docker Private Registry-推到“insecure-registry”仍然抱怨“未知权限”

Question

我有一个远程Docker注册表设置。它安装了go-daddy SSL证书。

如果我卷曲它,我会得到一个“未知权限”错误：

curl https://example.com:5000/v2/

curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none 
More details here: http://curl.haxx.se/docs/sslcerts.html

...

If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.

所以我使用了“insecure”curl：

curl -k https://example.com:5000/v2

{} //which I guess is because there is nothing in the registry?

curl -k https://example.com:5000/moo

404 page not found //which is positive, as it means the -k flag is suppressing the 'unknown authority' correctly

所以，现在我知道可以通过curl连接到注册表我尝试使用Docker客户端推送一个图像：

docker push example.com:5000/my-image

The push refers to a repository [example.com:5000/my-image] 
unable to ping registry endpoint https://example.com:5000/v0/
v2 ping attempt failed with error: Get https://example.com:5000/v2/: x509: certificate signed by unknown authority
v1 ping attempt failed with error: Get https://example.com:5000/v1/_ping: x509: certificate signed by unknown authority

因此，我尝试通过在DOCKER_OPTS中添加'insecure-registry'来抑制错误（如下所述）：

docker_opts=“--insecure-registry example.com:5000”

[重新启动docker后台进程]

而且它不起作用。我得到了同样的“未知权威”警告。

首先，为什么Go Daddy的证书不被信任？我在nginx服务器上设置了它，它在浏览器上的“绿色条”上运行良好。

Answer 1

好吧，我查清楚了。

结果表明,我不需要用以下内容修改/etc/default/docker：

DOCKER_OPTS="--insecure-registry example.com:5000"

问题是我在注册表中安装的Go-Daddy证书也需要有中间证书。我收到了Go-Daddy的以下信息：

domain.crt
some-bundle.crt

cat bundle.crt >> domain.crt