Proxy Settings for a Distribution Registry’s S3 Requests
Place proxy settings on the Distribution registry process that accesses S3, and account separately for clients redirected to object storage.
For a containerized Distribution registry using an environment-aware HTTP transport, pass the S3 route into the registry container:
services:
registry:
environment:
HTTP_PROXY: http://proxy.example.internal:8080
HTTPS_PROXY: http://proxy.example.internal:8080
NO_PROXY: localhost,127.0.0.1Merge this with the existing image, storage, authentication and volumes. The fragment is not a complete registry. Its proxy name must be reachable from that container, and the scheme must match the proxy listener.
Confirm the deployed S3 driver and transport. Distribution 2.8.3's cited source uses an AWS SDK session; a custom driver or transport may need another supported configuration.
| Connection | Owner to configure or investigate |
|---|---|
| Client → registry | The registry's incoming HTTP listener and client route |
| Daemon → image source | Docker daemon proxy settings |
| Registry → S3 | The registry process's storage HTTP transport |
A successful client login proves only the first route. The storage driver makes its own requests to S3; the daemon that previously pulled the registry image does not make those calls.
Inspect redirects during blob downloads too. Distribution can redirect a consumer to object storage, giving that client a direct S3 reachability requirement. Configuring the registry's proxy does not configure the consumer. Changing redirect behavior changes where blob traffic flows, so name the failing sender and operation before adjusting that setting.