{"record":{"id":"cbb04da5501b1e08","repo":"docker/cli","slug":"insecure-registry-s-is-not-valid-w","errorCode":null,"errorMessage":"insecure registry %s is not valid: %w","messagePattern":"insecure registry (.+?) is not valid: %w","errorType":"validation","errorClass":"invalidParameterErr","httpStatus":null,"severity":"error","filePath":"internal/registry/config.go","lineNumber":137,"sourceCode":"\t\t\tdefault:\n\t\t\t\t// unsupported scheme\n\t\t\t\treturn nil, invalidParam(fmt.Errorf(\"insecure registry %s should not contain '://'\", r))\n\t\t\t}\n\t\t}\n\t\t// Check if CIDR was passed to --insecure-registry\n\t\t_, ipnet, err := net.ParseCIDR(r)\n\t\tif err == nil {\n\t\t\t// Valid CIDR. If ipnet is already in config.InsecureRegistryCIDRs, skip.\n\t\t\tfor _, value := range insecureRegistryCIDRs {\n\t\t\t\tif value.IP.String() == ipnet.IP.String() && value.Mask.String() == ipnet.Mask.String() {\n\t\t\t\t\tcontinue skip\n\t\t\t\t}\n\t\t\t}\n\t\t\t// ipnet is not found, add it in config.InsecureRegistryCIDRs\n\t\t\tinsecureRegistryCIDRs = append(insecureRegistryCIDRs, ipnet)\n\t\t} else {\n\t\t\tif err := validateHostPort(r); err != nil {\n\t\t\t\treturn nil, invalidParam(fmt.Errorf(\"insecure registry %s is not valid: %w\", r, err))\n\t\t\t}\n\t\t\t// Assume `host:port` if not CIDR.\n\t\t\tindexConfigs[r] = &registry.IndexInfo{\n\t\t\t\tName:     r,\n\t\t\t\tSecure:   false,\n\t\t\t\tOfficial: false,\n\t\t\t}\n\t\t}\n\t}\n\n\t// Configure public registry.\n\tindexConfigs[IndexName] = &registry.IndexInfo{\n\t\tName:     IndexName,\n\t\tSecure:   true,\n\t\tOfficial: true,\n\t}\n\n\treturn &serviceConfig{","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/internal/registry/config.go#L119-L155","documentation":"Returned by newServiceConfig when an insecure-registry entry is neither a valid CIDR nor passes validateHostPort (host:port syntax validation). The underlying validateHostPort error is wrapped with %w, naming the offending value.","triggerScenarios":"Passing an --insecure-registry value that is not a valid CIDR and not a valid host:port — e.g. missing port, invalid hostname characters, bad port range.","commonSituations":"Typing `--insecure-registry=registry.local` (no port) when a port is required; invalid characters; port out of range; trailing slash; copy-paste artifacts.","solutions":["Provide a valid host:port (e.g. `registry.local:5000`) or a CIDR (e.g. `10.0.0.0/8`).","Read the wrapped error for the precise reason and correct accordingly.","Clean daemon.json insecure-registries array and restart dockerd."],"exampleFix":"# before (no port, fails validateHostPort)\ndockerd --insecure-registry=registry.local\n# after\ndockerd --insecure-registry=registry.local:5000","handlingStrategy":"validation","validationCode":"if _, _, err := net.SplitHostPort(entry); err != nil { /* invalid host:port */ }\nif _, _, err := net.ParseCIDR(entry); err != nil { /* not CIDR either */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include the port for host-style insecure registries.","Validate each insecure-registry entry before daemon restart.","Read the wrapped validateHostPort error for specifics."],"tags":["registry","insecure-registry","config","daemon","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}