{"action":"created","issue":{"url":"https://api.github.com/repos/docker/distribution/issues/1436","repository_url":"https://api.github.com/repos/docker/distribution","labels_url":"https://api.github.com/repos/docker/distribution/issues/1436/labels{/name}","comments_url":"https://api.github.com/repos/docker/distribution/issues/1436/comments","events_url":"https://api.github.com/repos/docker/distribution/issues/1436/events","html_url":"https://github.com/docker/distribution/issues/1436","id":132078021,"number":1436,"title":"Distribution as pull through proxy cache doesn't work","user":{"login":"valentinbud","id":3338528,"avatar_url":"https://avatars.githubusercontent.com/u/3338528?v=3","gravatar_id":"","url":"https://api.github.com/users/valentinbud","html_url":"https://github.com/valentinbud","followers_url":"https://api.github.com/users/valentinbud/followers","following_url":"https://api.github.com/users/valentinbud/following{/other_user}","gists_url":"https://api.github.com/users/valentinbud/gists{/gist_id}","starred_url":"https://api.github.com/users/valentinbud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/valentinbud/subscriptions","organizations_url":"https://api.github.com/users/valentinbud/orgs","repos_url":"https://api.github.com/users/valentinbud/repos","events_url":"https://api.github.com/users/valentinbud/events{/privacy}","received_events_url":"https://api.github.com/users/valentinbud/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-02-08T08:09:48Z","updated_at":"2016-02-09T18:47:21Z","closed_at":"2016-02-09T18:47:21Z","body":"I am running Docker Engine 1.10.0 on Debian Jessie. I want to configure a pull through proxy cache to speed up content delivery in my network and to offload the Hub.\r\n\r\n```\r\n$ cat /docker-data/iproxy/config.yml\r\nversion: 0.1\r\nlog:\r\n  level: debug\r\n  formatter: text\r\n  fields:\r\n    service: registry\r\nstorage:\r\n    cache:\r\n        blobdescriptor: inmemory\r\n    filesystem:\r\n        rootdirectory: /var/lib/registry\r\nhttp:\r\n    addr: :5000\r\n    headers:\r\n        X-Content-Type-Options: [nosniff]\r\n    certificate: /var/lib/registry/__databus_systems.crt\r\n    key: /var/lib/registry/STAR.databus.systems.key\r\nhealth:\r\n  storagedriver:\r\n    enabled: true\r\n    interval: 10s\r\n    threshold: 3\r\nproxy:\r\n    remoteurl: https://registry-1.docker.io\r\n```\r\n\r\nThe TLS certificate is issued by [COMODO RSA Domain Validation Secure Server CA](https://support.comodo.com/index.php?/Knowledgebase/Article/View/970/0/intermediate-2-sha-2-comodo-rsa-domain-validation-secure-server-ca) for `*.databus.systems`.\r\n\r\nThe Docker Engine Daemon in configured to use the pull through cache.\r\n```\r\n$ cat /etc/systemd/system/docker.service.d/registry-mirror.conf\r\n[Service]\r\nEnvironmentFile=-/etc/default/docker\r\nExecStart=\r\nExecStart=/usr/bin/docker daemon -H fd:// $DOCKER_OPTS\r\n\r\n$ cat /etc/default/docker | grep DOCKER_OPTS\r\nDOCKER_OPTS=\"--registry-mirror=https://iproxy.databus.systems:5000\"\r\n\r\n$ ps auxf | grep \"docker daemon\"\r\nroot     16052  0.0  0.3 889500 50796 ?        Ssl  Feb06   1:36 /usr/bin/docker daemon -H fd:// --registry-mirror=https://iproxy.databus.systems:5000\r\n```\r\n\r\nThere is an entry in `/etc/hosts` for `iproxy.databus.systems` pointing to `127.0.0.1`.\r\n\r\n```\r\n$ ping iproxy.databus.systems\r\nPING iproxy.databus.systems (127.0.0.1) 56(84) bytes of data.\r\n64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.048 ms\r\n```\r\n\r\nDocker Distribution was started with the following command and it's up and running.\r\n\r\n```\r\n$ docker run -d --restart=always -p 5000:5000 --name iproxy -v /docker-data/iproxy:/var/lib/registry registry:2 /var/lib/registry/config.yml\r\n\r\n$ docker ps\r\nCONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES\r\nc79dad342f64        registry:2          \"/bin/registry /var/l\"   46 hours ago        Up 11 minutes       0.0.0.0:5000->5000/tcp   iproxy\r\n```\r\n\r\nWhen I pull an image which is not stored locally I can't see anything in the `iproxy` logs.\r\n\r\n```\r\n$ docker rmi -f alpine\r\nUntagged: alpine:latest\r\nDeleted: sha256:14f89d0e62577f42622f994da6b1b47159d95516d24ba050952e517b915a41f8\r\nDeleted: sha256:6102f0d2ad337bf6646381b7cf51242875db4d3470cb7d42059b7cdd880b1786\r\n\r\n$ docker pull alpine\r\nUsing default tag: latest\r\nlatest: Pulling from library/alpine\r\nc52e3ed763ff: Pull complete\r\nDigest: sha256:d7201bdfa765bebed9a79c385db4378f55593e50dc8d002b9713810320ad93b9\r\nStatus: Downloaded newer image for alpine:latest\r\n\r\n$ docker logs iproxy\r\ntime=\"2016-02-08T08:07:25.941548336Z\" level=debug msg=\"filesystem.List(\\\"/\\\")\" go.version=go1.5.3 instance.id=1a007513-d09a-4f81-be6e-ab333e97e173 service=registry trace.duration=105.343µs trace.file=\"/go/src/github.com/docker/distribution/registry/storage/driver/base/base.go\" trace.func=\"github.com/docker/distribution/registry/storage/driver/base.(*Base).List\" trace.id=00b87fd8-749c-4e2d-b793-5fa69e088e5d trace.line=154 version=v2.3.0\r\ntime=\"2016-02-08T08:07:35.941567036Z\" level=debug msg=\"filesystem.List(\\\"/\\\")\" go.version=go1.5.3 instance.id=1a007513-d09a-4f81-be6e-ab333e97e173 service=registry trace.duration=126.801µs trace.file=\"/go/src/github.com/docker/distribution/registry/storage/driver/base/base.go\" trace.func=\"github.com/docker/distribution/registry/storage/driver/base.(*Base).List\" trace.id=61bde8af-6c37-42fb-9a96-559942a0583b trace.line=154 version=v2.3.0\r\ntime=\"2016-02-08T08:07:45.94152612Z\" level=debug msg=\"filesystem.List(\\\"/\\\")\" go.version=go1.5.3 instance.id=1a007513-d09a-4f81-be6e-ab333e97e173 service=registry trace.duration=82.943µs trace.file=\"/go/src/github.com/docker/distribution/registry/storage/driver/base/base.go\" trace.func=\"github.com/docker/distribution/registry/storage/driver/base.(*Base).List\" trace.id=89eaa4c5-2fb6-4eb2-a5f9-cf21ba20f01a trace.line=154 version=v2.3.0\r\ntime=\"2016-02-08T08:07:55.941526648Z\" level=debug msg=\"filesystem.List(\\\"/\\\")\" go.version=go1.5.3 instance.id=1a007513-d09a-4f81-be6e-ab333e97e173 service=registry trace.duration=90.094µs trace.file=\"/go/src/github.com/docker/distribution/registry/storage/driver/base/base.go\" trace.func=\"github.com/docker/distribution/registry/storage/driver/base.(*Base).List\" trace.id=ef67942f-fea1-4bed-8619-4e379e59e0d8 trace.line=154 version=v2.3.0\r\ntime=\"2016-02-08T08:08:05.941518409Z\" level=debug msg=\"filesystem.List(\\\"/\\\")\" go.version=go1.5.3 instance.id=1a007513-d09a-4f81-be6e-ab333e97e173 service=registry trace.duration=83.364µs trace.file=\"/go/src/github.com/docker/distribution/registry/storage/driver/base/base.go\" trace.func=\"github.com/docker/distribution/registry/storage/driver/base.(*Base).List\" trace.id=9ae9b31f-b9b5-493b-8d04-a33594bbd44c trace.line=154 version=v2.3.0\r\ntime=\"2016-02-08T08:08:15.941659323Z\" level=debug msg=\"filesystem.List(\\\"/\\\")\" go.version=go1.5.3 instance.id=1a007513-d09a-4f81-be6e-ab333e97e173 service=registry trace.duration=122.246µs trace.file=\"/go/src/github.com/docker/distribution/registry/storage/driver/base/base.go\" trace.func=\"github.com/docker/distribution/registry/storage/driver/base.(*Base).List\" trace.id=e7747738-c35f-4e2a-b892-f48a28ed3221 trace.line=154 version=v2.3.0\r\ntime=\"2016-02-08T08:08:25.941594509Z\" level=debug msg=\"filesystem.List(\\\"/\\\")\" go.version=go1.5.3 instance.id=1a007513-d09a-4f81-be6e-ab333e97e173 service=registry trace.duration=93.639µs trace.file=\"/go/src/github.com/docker/distribution/registry/storage/driver/base/base.go\" trace.func=\"github.com/docker/distribution/registry/storage/driver/base.(*Base).List\" trace.id=f6cf0312-4761-4bc0-93da-2e088de7736c trace.line=154 version=v2.3.0\r\n```\r\n\r\n`curl` the catalog throws a nasty SSL error.\r\n\r\n```\r\ncurl https://iproxy.databus.systems:5000/v2/_catalog\r\ncurl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol\r\n```\r\n\r\nWhat can I do to debug further? Thanks."},"comment":{"url":"https://api.github.com/repos/docker/distribution/issues/comments/181999855","html_url":"https://github.com/docker/distribution/issues/1436#issuecomment-181999855","issue_url":"https://api.github.com/repos/docker/distribution/issues/1436","id":181999855,"user":{"login":"valentinbud","id":3338528,"avatar_url":"https://avatars.githubusercontent.com/u/3338528?v=3","gravatar_id":"","url":"https://api.github.com/users/valentinbud","html_url":"https://github.com/valentinbud","followers_url":"https://api.github.com/users/valentinbud/followers","following_url":"https://api.github.com/users/valentinbud/following{/other_user}","gists_url":"https://api.github.com/users/valentinbud/gists{/gist_id}","starred_url":"https://api.github.com/users/valentinbud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/valentinbud/subscriptions","organizations_url":"https://api.github.com/users/valentinbud/orgs","repos_url":"https://api.github.com/users/valentinbud/repos","events_url":"https://api.github.com/users/valentinbud/events{/privacy}","received_events_url":"https://api.github.com/users/valentinbud/received_events","type":"User","site_admin":false},"created_at":"2016-02-09T18:47:20Z","updated_at":"2016-02-09T18:47:20Z","body":"@RichardScothern thank you. It works now after inserting `tls` where it belongs :).\r\n"}}