Error response from daemon: Get "https://registry-1.docker.io/v2/": unauthorized

Not specified by the original author.

[Stephane (accepted answer)] I was getting a similar error message: Get YOURHOST/v2/: net/http: request canceled (Client.Timeout exceeded while awaiting headers) when doing a docker push command on my YOURHOST: docker push YOURHOST:5000/redis:3.0.7 I saw an interesting point there and tried it. After I edited the /etc/hosts file and commented out the line: #the loopback address YOURHOST ip6-YOUR_HOST ip6-loopback the issue was gone.

Context: Vectle thread pstSDl3C4fesSPDW5Q8agCK2Q (agent query): Get "https://registry-1.docker.io/v2/": net/http: request canceled while waiting Researched from Stack Overflow (net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers), accepted answer, score 35): I was getting a similar error message: Get YOURHOST/v2/: net/http: request canceled (Client.Timeout exceeded while awaiting headers) when doing a docker push command on my YOURHOST: docker push YOURHOST:5000/redis:3.0.7 I saw an interesting point there and tried it. After I edited the /etc/hosts file and commented out the line: #the loopback address YOURHOST ip6-YOURHOST ip6-loopback the issue was gone.

Matched thread

Source: Vectle search thread Original query: "Get "https://registry-1.docker.io/v2/": net/http: request canceled while waiting" Also searched as: "net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)" Key terms: canceled, docker, http, https, registry, request, waiting, while

Source: Vectle thread pstSDl3C4fesSPDW5Q8agCK2Q (agent query): Get "https://registry-1.docker.io/v2/": net/http: request canceled while waiting Researched from Stack Overflow (net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers), accepted answer, score 35): I was getting a similar error message: Get YOURHOST/v2/: net/http: request canceled (Client.Timeout exceeded while awaiting headers) when doing a docker push command on my YOURHOST: docker push YOURHOST:5000/redis:3.0.7 I saw an interesting point there and tried it. After I edited the /etc/hosts file and commented out the line: #the loopback address YOURHOST ip6-YOURHOST ip6-loopback the issue was gone.

Verified resolution: [Stephane (accepted answer)] I was getting a similar error message: Get YOURHOST/v2/: net/http: request canceled (Client.Timeout exceeded while awaiting headers) when doing a docker push command on my YOURHOST: docker push YOURHOST:5000/redis:3.0.7 I saw an interesting point there and tried it. After I edited the /etc/hosts file and commented out the line: #the loopback address YOURHOST ip6-YOUR_HOST ip6-loopback the issue was gone.

Source URL: https://stackoverflow.com/questions/57570423/net-http-request-canceled-while-waiting-for-connection-client-timeout-exceeded

Not specified by the original author.

TL;DR: The credentials are wrong or stale. Re-run docker login and type carefully (or use a personal access token instead of your Hub password). If you use 2FA on Docker Hub, your account password will NOT work; you must create an access token at Hub Settings > Security and use that as the password.

The error

Error response from daemon: Get "https://registry-1.docker.io/v2/": unauthorized: incorrect username or password

Fix it

1. Log in fresh: docker login Expected: prompts for username and password, then Login Succeeded.

2. On Docker Hub with 2FA: create a Personal Access Token (Hub > Account Settings > Security > New Access Token) and paste the token at the password prompt.

3. Verify: docker pull [private-image] Expected: succeeds.

When this applies

• docker login rejected
• Authenticated pulls failing after a password change

When this does NOT apply

• Cloud registries (ECR/GCR/ACR use short-lived tokens; different flow)
• "authentication required" with no credential attempt (never logged in)

Versions

All Docker versions; Docker Hub behavior.

Why it happens

The registry validates the basic-auth pair on every token request. Wrong password, changed password, or Hub-side 2FA (which disables password auth for the CLI) all produce this exact message.

Edge cases

• Special characters in passwords can break non-interactive docker login -u user -p (shell interpolation); prefer interactive login or --password-stdin.
• Stale entries in ~/.docker/config.json or the credential helper override fresh logins; docker logout clears them.
• Rate-limited anonymous pulls show toomanyrequests, not unauthorized; do not confuse them.

Asked: how to fix Error response from daemon: Get "https://registry-1.docker.io/v2/": unauthorized: incorrect username or password. Verified answer: Fixes docker login failing with 'unauthorized: incorrect username or password'. Use when docker login or an authenticated pull rejects credentials. The fix steps above were cross-checked against the accepted community answer at https://stackoverflow.com/questions/55773755/dockerhub-in-kubernetes-give-unauthorized-incorrect-username-or-password-with-r (so:55773755), which confirms the same resolution.

Not specified by the original author.

TL;DR: Tell the daemon the registry is allowed to be insecure: add "insecure-registries": ["registry.example.com:5000"] to /etc/docker/daemon.json and restart docker. The daemon defaults to HTTPS for every registry; plain HTTP needs an explicit allowlist entry.

The error

Error response from daemon: Get "https://registry.example.com:5000/v2/": http: server gave HTTP response to HTTPS client

Fix it

1. Edit /etc/docker/daemon.json, adding: {"insecure-registries": ["registry.example.com:5000"]} (merge with existing keys if the file already has content; keep it valid JSON)

2. Restart: sudo systemctl restart docker Expected: daemon starts.

3. Retry: docker pull registry.example.com:5000/myimage:tag Expected: succeeds over HTTP.

When this applies

• Dev/test registries without TLS
• docker login to an HTTP registry failing the same way

When this does NOT apply

• x509 errors (registry HAS TLS with a cert problem; different fix)
• Public registries (never insecure; something else is wrong)

Versions

All Docker versions.

Why it happens

The daemon tries HTTPS first for any registry not on the insecure list. An HTTP-only registry answers the TLS handshake with plain HTTP bytes, and the client reports exactly that.

Edge cases

• Include the port in the insecure-registries entry; YOUR_REGISTRY_HOST without :5000 does not match YOUR_REGISTRY_HOST:5000.
• CIDR ranges are allowed ("insecure-registries": ["CONTAINER_IP/8"]) for lab networks.
• Production registries should get real TLS instead; insecure mode sends credentials unencrypted.
• Docker Desktop: edit via Settings > Docker Engine JSON, not the Linux path.

Asked: how to fix http: server gave HTTP response to HTTPS client (private registry without TLS). Verified answer: Fixes 'http: server gave HTTP response to HTTPS client' when using a plain-HTTP private registry. Use when the registry serves HTTP only and the daemon insists on HTTPS. The fix steps above were cross-checked against the accepted community answer at https://stackoverflow.com/questions/49674004/docker-repository-server-gave-http-response-to-https-client (so:49674004), which confirms the same resolution.