如何登录带Nginx基础认证前置的Docker Registry？

Ah, this is a common gotcha when dealing with a Docker Registry behind an Nginx reverse proxy that enforces HTTP Basic Auth in addition to the Registry's own authentication. The Docker CLI doesn't natively handle two layers of authentication out of the box—when you run docker login, it only expects to respond to the Registry's authentication challenge, not a prior one from Nginx. Here's how to work around this:

Method 1: Embed Nginx Credentials in the Registry URL #

The simplest way is to include your Nginx HTTP Basic Auth credentials directly in the Registry URL when running docker login. This tells Docker to send those credentials first to pass Nginx's check, then you'll be prompted for the Registry's own credentials.

# Replace placeholders with your actual values
docker login https://<nginx-username>:<nginx-password>@your-registry-url

Warning: Avoid typing the password directly in the command line—it will show up in your shell history. Instead, use read to input credentials securely:

read -p "Nginx Username: " NGINX_USER
read -sp "Nginx Password: " NGINX_PASS
echo
docker login https://$NGINX_USER:$NGINX_PASS@your-registry-url

When prompted, enter your Docker Registry username and password (not the Nginx ones), and the login should succeed.

Method 2: Configure Docker to Send Nginx Auth Headers Globally #

If you don't want to mess with URLs every time, you can add the Nginx Basic Auth header to Docker's global config. This way, every Docker request will include the header (only use this if you don't have other registries that conflict with this auth).

1. Generate the base64-encoded string for your Nginx credentials:

echo -n "<nginx-username>:<nginx-password>" | base64

You'll get a string like dXNlcjE6cGFzc3dvcmQxMjM=—copy this.

2. Edit your Docker config file at ~/.docker/config.json (create it if it doesn't exist) and add the HttpHeaders section:

{
  "auths": {},
  "HttpHeaders": {
    "Authorization": "Basic <your-nginx-base64-string>"
  }
}

3. Now run the standard login command, and just enter your Registry credentials when prompted:

docker login your-registry-url

Key Background #

The core issue is that Nginx's Basic Auth is an HTTP-level check that happens before the Registry even receives the request. By ensuring Docker sends those credentials upfront, you let Nginx pass the request through to the Registry, where Docker can then handle the Registry's own authentication challenge as expected.

内容的提问来源于stack exchange，提问作者John Somen