Docker Registry无法在Traefik HTTPS代理下正常工作求助

核心问题分析 #

你执行docker login registry.example.de:5000时出错，根源有两点：

• 错误指定了5000端口：Traefik作为反向代理，对外暴露的是标准HTTPS端口443，无需手动添加5000
• Registry服务的Traefik标签配置有误：Traefik与Registry容器内部通信被错误设为HTTPS，但Registry本身未配置SSL证书，导致代理链路中断

修复步骤 #

1. 修正docker-compose.yml中的Traefik标签 #

将traefik.http.services.registry-secure.loadbalancer.server.scheme=https改为http——因为Registry容器默认仅提供HTTP服务，TLS终止在Traefik层面即可。修改后的完整配置：

version: "3.3"
services:
  registry:
    image: registry:latest
    container_name: docker_registry
    restart: always
    volumes:
      - /srv/docker-registry/data:/data
      - /srv/docker-registry/auth:/auth
    environment:
      - REGISTRY_AUTH=htpasswd
      - REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm
      - REGISTRY_AUTH_HTPASSWD_PATH=/auth/.htpasswd
      - REGISTRY_LOG_LEVEL=debug
      - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/data

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.registry.entrypoints=http"
      - "traefik.http.routers.registry.rule=Host(`registry.example.de`)"
      - "traefik.http.middlewares.registry-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.registry.middlewares=registry-https-redirect"
      - "traefik.http.services.registry-secure.loadbalancer.server.port=5000"
      - "traefik.http.services.registry-secure.loadbalancer.server.scheme=http"  # 此处改为http
      - "traefik.http.routers.registry-secure.entrypoints=https"
      - "traefik.http.routers.registry-secure.tls.certresolver=http"
      - "traefik.http.routers.registry-secure.tls=true"
      - "traefik.http.routers.registry-secure.rule=Host(`registry.example.de`)"
    networks:
      - proxy
networks:
  proxy:
    external: true

2. 执行正确的docker login命令 #

无需添加5000端口，直接使用标准HTTPS端口（默认443）：

docker login registry.example.de

3. 验证配置生效 #

重启Registry容器使配置生效：

docker-compose down && docker-compose up -d

之后执行登录命令，输入预先创建的htpasswd账号密码即可完成验证。

额外检查点 #

• 确保Traefik配置中已正确开启https入口点（Traefik的docker-compose.yml里，entrypoints部分需包含https:443）
• 确认registry.example.de已正确解析到服务器IP，且服务器443端口对外开放

内容的提问来源于stack exchange，提问作者Gooze