docker/cli · error · invalidParameterErr

insecure registry is not valid

Error message

insecure registry %s is not valid: %w

What it means

Returned by newServiceConfig when an insecure-registry entry is neither a valid CIDR nor passes validateHostPort (host:port syntax validation). The underlying validateHostPort error is wrapped with %w, naming the offending value.

Solutions

1. Provide a valid host:port (e.g. `registry.local:5000`) or a CIDR (e.g. `10.0.0.0/8`).
2. Read the wrapped error for the precise reason and correct accordingly.
3. Clean daemon.json insecure-registries array and restart dockerd.

Example fix

# before (no port, fails validateHostPort)
dockerd --insecure-registry=registry.local
# after
dockerd --insecure-registry=registry.local:5000

if _, _, err := net.SplitHostPort(entry); err != nil { /* invalid host:port */ }
if _, _, err := net.ParseCIDR(entry); err != nil { /* not CIDR either */ }

When it happens

Trigger: Passing an --insecure-registry value that is not a valid CIDR and not a valid host:port — e.g. missing port, invalid hostname characters, bad port range.

Common situations: Typing `--insecure-registry=registry.local` (no port) when a port is required; invalid characters; port out of range; trailing slash; copy-paste artifacts.

Related errors

• insecure registry should not contain '://
• error reading from STDIN: data is empty
• config file is required
• cannot supply extra formatting options to the pretty…
• unrecognized config key

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/cbb04da5501b1e08. Report an issue: GitHub.

Appendix: source

Thrown at internal/registry/config.go:137

			default:
				// unsupported scheme
				return nil, invalidParam(fmt.Errorf("insecure registry %s should not contain '://'", r))
			}
		}
		// Check if CIDR was passed to --insecure-registry
		_, ipnet, err := net.ParseCIDR(r)
		if err == nil {
			// Valid CIDR. If ipnet is already in config.InsecureRegistryCIDRs, skip.
			for _, value := range insecureRegistryCIDRs {
				if value.IP.String() == ipnet.IP.String() && value.Mask.String() == ipnet.Mask.String() {
					continue skip
				}
			}
			// ipnet is not found, add it in config.InsecureRegistryCIDRs
			insecureRegistryCIDRs = append(insecureRegistryCIDRs, ipnet)
		} else {
			if err := validateHostPort(r); err != nil {
				return nil, invalidParam(fmt.Errorf("insecure registry %s is not valid: %w", r, err))
			}
			// Assume `host:port` if not CIDR.
			indexConfigs[r] = &registry.IndexInfo{
				Name:     r,
				Secure:   false,
				Official: false,
			}
		}
	}

	// Configure public registry.
	indexConfigs[IndexName] = &registry.IndexInfo{
		Name:     IndexName,
		Secure:   true,
		Official: true,
	}

	return &serviceConfig{

View on GitHub (pinned to 4f84911bfe)