{"record":{"id":"5c76e40a7a68e0b1","repo":"docker/cli","slug":"insecure-registry-s-should-not-contain","errorCode":null,"errorMessage":"insecure registry %s should not contain '://'","messagePattern":"insecure registry (.+?) should not contain '://'","errorType":"validation","errorClass":"invalidParameterErr","httpStatus":null,"severity":"error","filePath":"internal/registry/config.go","lineNumber":121,"sourceCode":"\t// Localhost is by default considered as an insecure registry. This is a\n\t// stop-gap for people who are running a private registry on localhost.\n\tregistries = append(registries, \"::1/128\", \"127.0.0.0/8\")\n\n\tvar (\n\t\tinsecureRegistryCIDRs = make([]*net.IPNet, 0)\n\t\tindexConfigs          = make(map[string]*registry.IndexInfo)\n\t)\n\nskip:\n\tfor _, r := range registries {\n\t\tif scheme, host, ok := strings.Cut(r, \"://\"); ok {\n\t\t\tswitch strings.ToLower(scheme) {\n\t\t\tcase \"http\", \"https\":\n\t\t\t\tlog.G(context.TODO()).Warnf(\"insecure registry %[1]s should not contain '%[2]s' and '%[2]ss' has been removed from the insecure registry config\", r, scheme)\n\t\t\t\tr = host\n\t\t\tdefault:\n\t\t\t\t// unsupported scheme\n\t\t\t\treturn nil, invalidParam(fmt.Errorf(\"insecure registry %s should not contain '://'\", r))\n\t\t\t}\n\t\t}\n\t\t// Check if CIDR was passed to --insecure-registry\n\t\t_, ipnet, err := net.ParseCIDR(r)\n\t\tif err == nil {\n\t\t\t// Valid CIDR. If ipnet is already in config.InsecureRegistryCIDRs, skip.\n\t\t\tfor _, value := range insecureRegistryCIDRs {\n\t\t\t\tif value.IP.String() == ipnet.IP.String() && value.Mask.String() == ipnet.Mask.String() {\n\t\t\t\t\tcontinue skip\n\t\t\t\t}\n\t\t\t}\n\t\t\t// ipnet is not found, add it in config.InsecureRegistryCIDRs\n\t\t\tinsecureRegistryCIDRs = append(insecureRegistryCIDRs, ipnet)\n\t\t} else {\n\t\t\tif err := validateHostPort(r); err != nil {\n\t\t\t\treturn nil, invalidParam(fmt.Errorf(\"insecure registry %s is not valid: %w\", r, err))\n\t\t\t}\n\t\t\t// Assume `host:port` if not CIDR.","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/internal/registry/config.go#L103-L139","documentation":"Returned by newServiceConfig while parsing --insecure-registry entries. If an entry contains `://` the code splits off the scheme; http/https are accepted (scheme stripped with a warning), but any other scheme (ftp://, tcp://, etc.) is rejected because insecure registries must be bare host[:port] or CIDR.","triggerScenarios":"Passing an --insecure-registry value (or InsecureRegistries option) with a non-http(s) scheme, e.g. `--insecure-registry=ftp://myregistry` or `tcp://1.2.3.4:5000`.","commonSituations":"Copying a DOCKER_HOST-style tcp:// URL into the insecure-registry list by mistake; pasting a registry URL with a stray scheme; config management templating the wrong variable.","solutions":["Remove the scheme: use `--insecure-registry=myregistry:5000` instead of `ftp://myregistry:5000`.","If you meant http(s), drop the scheme (http/https are auto-stripped with a warning).","Re-read daemon.json and remove offending entries, then restart dockerd."],"exampleFix":"# before\ndockerd --insecure-registry=tcp://registry.local:5000\n# after\ndockerd --insecure-registry=registry.local:5000","handlingStrategy":"validation","validationCode":"// strip any scheme before passing to InsecureRegistries\nif _, _, ok := strings.Cut(entry, \"://\"); ok { entry = host /* or reject */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use bare host:port or CIDR for insecure registries.","Lint daemon.json insecure-registries entries.","Do not reuse DOCKER_HOST-style URLs here."],"tags":["registry","insecure-registry","config","daemon","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}