title: Private Docker registry in pull through cache mode return "invalid authorization credential"
body: <p>I'm using the <a href="https://hub.docker.com/_/registry/" rel="nofollow noreferrer" title="official Docker registry image">official Docker registry image</a>, and have configured it as a pull though cache. </p>
  
  <p>My clients can log in and push/pull local images, such as this:</p>
  
  <pre><code>docker login -u username -p secret docker.example.local:5000
  docker pull docker.example.local:5000/myImage
  </code></pre>
  
  <p>I've configured my clients to use the Docker registry server as a proxy:</p>
  
  <pre><code>root@server:/# cat /etc/docker/daemon.json
    {
       "registry-mirrors": ["https://docker.example.local:5000"]
    }
  </code></pre>
  
  <p>But when my clients tries to pull images not already present on the registry server, I get an error. Example pull command:</p>
  
  <pre><code>docker pull alpine
  </code></pre>
  
  <p>The registry server then responds with this message in its log file:</p>
  
  <pre><code>error authorizing context: basic authentication challenge for realm \"Registry Realm\": invalid authorization credential
  </code></pre>
  
  <p>I came across <a href="https://stackoverflow.com/questions/42143395/docker-registry-mirror-not-used">this SO post</a> suggesting putting a Nginx proxy server in front, but this seems like a hack and I'd prefer some cleaner way of doing this if possible. </p>
  
  <p>How have others set up their registry server in a pull through cache mode - did you find a better solution than setting up an Nginx proxy in front of the registry server? </p>