Proxy Settings for a Distribution Registry’s S3 Requests

Place proxy settings on the Distribution registry process that accesses S3, and account separately for clients redirected to object storage.

For a containerized Distribution registry using an environment-aware HTTP transport, pass the S3 route into the registry container:

services:
  registry:
    environment:
      HTTP_PROXY: http://proxy.example.internal:8080
      HTTPS_PROXY: http://proxy.example.internal:8080
      NO_PROXY: localhost,127.0.0.1

Merge this with the existing image, storage, authentication and volumes. The fragment is not a complete registry. Its proxy name must be reachable from that container, and the scheme must match the proxy listener.

Confirm the deployed S3 driver and transport. Distribution 2.8.3's cited source uses an AWS SDK session; a custom driver or transport may need another supported configuration.

ConnectionOwner to configure or investigate
Client → registryThe registry's incoming HTTP listener and client route
Daemon → image sourceDocker daemon proxy settings
Registry → S3The registry process's storage HTTP transport

A successful client login proves only the first route. The storage driver makes its own requests to S3; the daemon that previously pulled the registry image does not make those calls.

Inspect redirects during blob downloads too. Distribution can redirect a consumer to object storage, giving that client a direct S3 reachability requirement. Configuring the registry's proxy does not configure the consumer. Changing redirect behavior changes where blob traffic flows, so name the failing sender and operation before adjusting that setting.

Erthyglow kevrennek