带Nginx反向代理、基础认证与SSL的Docker Registry远程推送镜像失败求助

各位大佬好，我最近碰到个棘手的问题——远程往配置了Nginx反向代理、基础认证和SSL的私有Docker Registry推送镜像一直失败，本地在服务器上绕过代理直接推送是正常的，但远程通过代理推就报错，实在找不到问题出在哪了，麻烦帮忙排查一下！

执行推送命令及错误信息 #

我用的推送命令是：

podman push sub.example.com:5000/dummyimg sub.example.com:5000/rem/dummyimg

执行后输出的错误内容：

Getting image source signatures

Copying blob 0fbe8c68abd3 done

Copying blob 30085473d084 done

Copying blob 664eb87278f9 done

Copying blob c8db7b4be633 done

Copying blob f1417ff83b31 [=====================>----------------] 4.0MiB / 7.0MiB

Copying blob d007f013021f [===========================>----------] 4.0MiB / 5.4MiB

Error: writing blob: Patch "index404.html": stopped after 10 redirects

Registry日志中的错误 #

同时Registry日志里出现了这样的错误：

time="2023...Z" level=error msg="response completed with error" err.code="blob unknown"
err.detail=sha256:0fbe...04 err.message="blob unknown to registry" go.version=go1.16.15
http.request.host=sub.example.com http.request.id=440cfc9f-272d-493a-be95-c6f29bfae3dd
http.request.method=HEAD http.request.remoteaddr=1.2.3.4
http.request.uri="/v2/rem/dummyimg/blobs/sha256:0fbe...04"
http.request.useragent="containers/5.16.0 (github.com/containers/image)"
http.response.contenttype="application/json; charset=utf-8"
http.response.duration=4.959982ms http.response.status=404 http.response.written=157
vars.digest="sha256:0fbe...04" vars.name="rem/dummyimg"

已确认正常的操作 #

我已经验证过几个基础操作是没问题的：

• 能成功登录到Registry：

podman login sub.example.com:5000
Username: testuser
Password:
Login Succeeded!

• 用curl可以正常查询catalog：

curl -u testuser https://sub.example.com:5000/v2/_catalog

环境配置详情 #

我是通过Nginx代理来提供Registry的SSL和基础认证访问，SSL证书已经包含了example.com和sub.example.com所有域名。

Nginx配置

server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://$host$request_uri;
}

server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name _;
root /var/www/html;
ssl_certificate "/etc/letsencrypt/live/example.com/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/example.com/privkey.pem";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
index index404.html;
error_page 404 index404.html;
location / {
try_files $uri $uri/ =404;
}
}

server {
listen 443 ssl http2;
server_name example.com www.example.com;
ssl_certificate "/etc/letsencrypt/live/example.com/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/example.com/privkey.pem";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://localhost:8080;
}
}

# for podman registry
map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
'' 'registry/2.0';
}

server {
listen 5000 ssl http2;
server_name sub.example.com;
ssl_certificate "/etc/letsencrypt/live/example.com/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/example.com/privkey.pem";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
client_max_body_size 16384m;
chunked_transfer_encoding on;
location / {
add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;
auth_basic "Registry realm";
auth_basic_user_file /var/www/_auth/htpass2;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto "https";
proxy_pass http://127.0.0.1:5001;
}
}

Registry容器创建与启动

我用podman创建Registry容器的脚本：

#!/bin/bash

BASE=/home/some/folder
podman create -p 127.0.0.1:5001:5000 \
-e REGISTRY_HTTP_ADDR=0.0.0.0:5000 \
-v $BASE/registry:/var/lib/registry \
--replace \
--name myregistry \
registry:2

启动命令就是：

podman run myregistry

本地直接推到服务器的5001端口完全正常，但通过Nginx代理的5000端口远程推就会出现上面的错误，实在摸不着头绪了，求各位帮忙看看问题可能出在哪！

备注：内容来源于stack exchange，提问作者Yaroslav Alexeevich