title: Accessing Docker Hub behind Nginx
body: <p>I tried to access Docker Hub through an nginx proxy.</p>
  
  <p>The following is my nginx proxy configuration.</p>
  
  <pre><code> server {
          listen       800 ssl;
          ssl on;
          server_name nginx2 ;
          client_max_body_size 0;
          ssl_protocols             SSLv3 SSLv2 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
          ssl_certificate            ssl/cert.pem;
          ssl_certificate_key        ssl/cert.key;
          location / {
                  proxy_pass https://{dockerhub_host};
                  proxy_ssl_server_name on;
                  proxy_set_header Host $http_host;   # Required for Docker client sake
                          proxy_set_header X-Forwarded-Host $http_host;
                  proxy_set_header X-Real-IP $remote_addr;
                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                  proxy_set_header X-Scheme $scheme;
          }
  }
  </code></pre>
  
  <p>I have tried both <code>registry-1.docker.io</code> and <code>hub.docker.com</code> in the place of <code>{dockerhub_host}</code> in the configuration.</p>
  
  <p>Now I tried to log into Docker Hub using the following command.</p>
  
  <pre><code>docker login localhost:800
  </code></pre>
  
  <p>The following error was thrown:</p>
  
  <blockquote>
    <p>Error response from daemon: login attempt to <code>http://localhost:800/v2/ failed with status: 400 Bad Request</code> </p>
  </blockquote>
  
  <p>And the following are the logs of the nginx proxy:</p>
  
  <pre><code>proxy_1  | 2018/06/12 22:24:42 [error] 5#5: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://34.232.188.57:80/v2/", host: "localhost:800"
  proxy_1  | 2018/06/12 22:24:42 [warn] 5#5: *1 upstream server temporarily disabled while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://34.232.188.57:80/v2/", host: "localhost:800"
  proxy_1  | 2018/06/12 22:24:42 [error] 5#5: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://52.3.45.201:80/v2/", host: "localhost:800"
  proxy_1  | 2018/06/12 22:24:42 [warn] 5#5: *1 upstream server temporarily disabled while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://52.3.45.201:80/v2/", host: "localhost:800"
  proxy_1  | 2018/06/12 22:24:42 [error] 5#5: *1 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://54.209.102.157:80/v2/", host: "localhost:800"
  proxy_1  | 2018/06/12 22:24:42 [warn] 5#5: *1 upstream server temporarily disabled while SSL handshaking to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://54.209.102.157:80/v2/", host: "localhost:800"
  proxy_1  | 172.21.0.1 - - [12/Jun/2018:22:24:42 +0000] "GET /v2/ HTTP/1.1" 502 173 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 2018/06/12 22:24:42 [error] 5#5: *5 no live upstreams while connecting to upstream, client: 172.21.0.1, server: nginx2, request: "GET /v2/ HTTP/1.1", upstream: "https://docker_host/v2/", host: "localhost:800"
  proxy_1  | 172.21.0.1 - - [12/Jun/2018:22:24:42 +0000] "GET /v2/ HTTP/1.1" 502 173 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 172.21.0.1 - - [12/Jun/2018:22:24:42 +0000] "GET /v2/ HTTP/1.1" 400 271 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 172.21.0.1 - - [12/Jun/2018:22:24:42 +0000] "GET /v2/ HTTP/1.1" 400 271 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  </code></pre>
  
  <p>At first, I thought the error is thrown as I am accessing port 80. So, I have set the port to 443 explicitly like,</p>
  
  <pre><code>&gt;proxy_pass https://hub.docker.com:443
  
  &gt;proxy_pass https://registry-1.docker.io:443
  </code></pre>
  
  <p>and tried the login command now. I still see the same error. Following are the logs of the nginx proxy:</p>
  
  <pre><code>proxy_1  | 172.21.0.1 - - [12/Jun/2018:22:33:09 +0000] "GET /v2/ HTTP/1.1" 503 119 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 172.21.0.1 - - [12/Jun/2018:22:33:09 +0000] "GET /v2/ HTTP/1.1" 503 119 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 172.21.0.1 - - [12/Jun/2018:22:33:09 +0000] "GET /v2/ HTTP/1.1" 400 271 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 172.21.0.1 - - [12/Jun/2018:22:33:09 +0000] "GET /v2/ HTTP/1.1" 400 271 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  </code></pre>
  
  <p><strong>Output of <code>docker version</code></strong></p>
  
  <pre><code>Client:
   Version:      18.03.1-ce
   API version:  1.37
   Go version:   go1.9.5
   Git commit:   9ee9f40
   Built:        Thu Apr 26 07:13:02 2018
   OS/Arch:      darwin/amd64
   Experimental: false
   Orchestrator: swarm
  
  Server:
   Engine:
    Version:      18.03.1-ce
    API version:  1.37 (minimum version 1.12)
    Go version:   go1.9.5
    Git commit:   9ee9f40
    Built:        Thu Apr 26 07:22:38 2018
    OS/Arch:      linux/amd64
    Experimental: true
  </code></pre>
  
  <p><strong>Output of <code>docker info</code></strong></p>
  
  <pre><code>Containers: 2
   Running: 2
   Paused: 0
   Stopped: 0
  Images: 44
  Server Version: 18.03.1-ce
  Storage Driver: overlay2
   Backing Filesystem: extfs
   Supports d_type: true
   Native Overlay Diff: true
  Logging Driver: json-file
  Cgroup Driver: cgroupfs
  Plugins:
   Volume: local
   Network: bridge host ipvlan macvlan null overlay
   Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
  Swarm: inactive
  Runtimes: runc
  Default Runtime: runc
  Init Binary: docker-init
  containerd version: 773c489c9c1b21a6d78b5c538cd395416ec50f88
  runc version: 4fc53a81fb7c994640722ac585fa9ca548971871
  init version: 949e6fa
  Security Options:
   seccomp
    Profile: default
  Kernel Version: 4.9.87-linuxkit-aufs
  Operating System: Docker for Mac
  OSType: linux
  Architecture: x86_64
  CPUs: 2
  Total Memory: 1.952GiB
  Name: linuxkit-025000000001
  ID: OCVQ:XRBF:3H7P:PB3A:YQUH:FU2O:6BVB:BMHR:G7HX:UK63:SDKU:NPVI
  Docker Root Dir: /var/lib/docker
  Debug Mode (client): false
  Debug Mode (server): true
   File Descriptors: 39
   Goroutines: 63
   System Time: 2018-06-13T23:16:57.569645612Z
   EventsListeners: 3
  HTTP Proxy: docker.for.mac.http.internal:3128
  HTTPS Proxy: docker.for.mac.http.internal:3129
  Registry: https://index.docker.io/v1/
  Labels:
  Experimental: true
  Insecure Registries:
   127.0.0.0/8
  Live Restore Enabled: false
  </code></pre>
  
  <hr>
  
  <p><strong>Update</strong></p>
  
  <p>I got the login thing working with the help of Tarun's solution. I now tried to pull/push images to the hub.docker.com site, but with no luck.</p>
  
  <pre><code>&gt; docker push localhost:800/nadella/hello-world
  
  Error:
  
  The push refers to repository [localhost:800/nadella/helloworld]
  2b8cbd0846c5: Pushing [==================================================&gt;]  3.584kB
  unauthorized: authentication required
  </code></pre>
  
  <p>logs:</p>
  
  <pre><code>proxy_1  | 172.21.0.1 - - [14/Jun/2018:04:57:26 +0000] "POST /v2/nadella/helloworld/blobs/uploads/ HTTP/1.1" 202 0 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 172.21.0.1 - - [14/Jun/2018:05:00:09 +0000] "GET /v2/ HTTP/1.1" 401 87 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 172.21.0.1 - - [14/Jun/2018:05:00:10 +0000] "HEAD /v2/nadella/helloworld/blobs/sha256:9bb5a5d4561a5511fa7f80718617e67cf2ed2e6cdcd02e31be111a8d0ac4d6b7 HTTP/1.1" 404 0 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 172.21.0.1 - - [14/Jun/2018:05:00:11 +0000] "POST /v2/nadella/helloworld/blobs/uploads/?from=helloworld&amp;mount=sha256%3A9bb5a5d4561a5511fa7f80718617e67cf2ed2e6cdcd02e31be111a8d0ac4d6b7 HTTP/1.1" 401 307 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  proxy_1  | 172.21.0.1 - - [14/Jun/2018:05:00:11 +0000] "POST /v2/nadella/helloworld/blobs/uploads/ HTTP/1.1" 202 0 "-" "docker/18.03.1-ce go/go1.9.5 git-commit/9ee9f40 kernel/4.9.87-linuxkit-aufs os/linux arch/amd64 UpstreamClient(Docker-Client/18.03.1-ce \x5C(darwin\x5C))" "-"
  </code></pre>
  
  <p>I looked at <code>~/.docker/config.json</code></p>
  
  <pre><code>{
          "auths": {
                  "localhost:800": {}
          },
          "HttpHeaders": {
                  "User-Agent": "Docker-Client/18.03.1-ce (darwin)"
          },
          "credsStore": "osxkeychain"
  }
  </code></pre>
  
  <p>I even added "<a href="https://index.docker.io/v1/" rel="nofollow noreferrer">https://index.docker.io/v1/</a>": {} to the configuration file and checked. But it didn't work.</p>