amir20/dozzle · error

auth realm has no host

Error message

auth realm %q has no host

What it means

validateRealm is a security guard: a registry's challenge redirected Dozzle to a token endpoint URL with no host component (e.g. a relative realm), which cannot be validated as a safe HTTPS endpoint. Dozzle refuses to send credentials to it.

Solutions

1. Skip the image update check for this registry; it is responding with a malformed challenge.
2. If it is a self-hosted registry, fix its WWW-Authenticate realm to an absolute URL including scheme and host.
3. Report the issue to the registry operator; this is a server-side configuration error.

When it happens

Trigger: Thrown at internal/imagecheck/registry.go:233 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of amir20/dozzle@d9463cbe21 (2026-09-07). Data as JSON: /api/errors/bdf02c1552583280. Report an issue: GitHub.

Appendix: source

Thrown at internal/imagecheck/registry.go:233

	// The token itself is a credential and is deliberately never logged.
	log.Debug().
		Str("repository", ref.Repository).
		Str("realm", realm).
		Dur("ttl", ttl).
		Msg("image update check: obtained registry token")

	r.mu.Lock()
	// Expire the token a little early so a request never races the deadline.
	r.tokens[key] = cachedToken{token: token, expiresAt: time.Now().Add(ttl - 10*time.Second)}
	r.mu.Unlock()

	return token, nil
}

// validateRealm restricts where a registry can send us for a token.
func validateRealm(endpoint *url.URL, ref Reference) error {
	if endpoint.Host == "" {
		return fmt.Errorf("auth realm %q has no host", endpoint)
	}

	if endpoint.Scheme == "https" {
		return nil
	}

	// A loopback registry is already trusted over plain HTTP, but only for
	// itself: it cannot send us to some other host in the clear.
	if endpoint.Scheme == "http" && ref.Insecure() && sameHost(endpoint.Host, ref.Registry) {
		return nil
	}

	return fmt.Errorf("refusing auth realm %q: must be https", endpoint)
}

func sameHost(a, b string) bool {
	return strings.EqualFold(a, b)
}

View on GitHub (pinned to d9463cbe21)