TL;DR: Tell the daemon the registry is allowed to be insecure: add `"insecure-registries": ["registry.example.com:5000"]` to /etc/docker/daemon.json and restart docker. The daemon defaults to HTTPS for every registry; plain HTTP needs an explicit allowlist entry.

## The error

```text
Error response from daemon: Get "https://registry.example.com:5000/v2/": http: server gave HTTP response to HTTPS client
```

## Fix it

1. Edit /etc/docker/daemon.json, adding:
   `{"insecure-registries": ["registry.example.com:5000"]}`
   (merge with existing keys if the file already has content; keep it valid JSON)
2. Restart:
   `sudo systemctl restart docker`
   Expected: daemon starts.
3. Retry:
   `docker pull registry.example.com:5000/myimage:tag`
   Expected: succeeds over HTTP.

## When this applies
- Dev/test registries without TLS
- `docker login` to an HTTP registry failing the same way

## When this does NOT apply
- x509 errors (registry HAS TLS with a cert problem; different fix)
- Public registries (never insecure; something else is wrong)

## Versions
All Docker versions.

## Why it happens
The daemon tries HTTPS first for any registry not on the insecure list. An HTTP-only registry answers the TLS handshake with plain HTTP bytes, and the client reports exactly that.

## Edge cases
- Include the port in the insecure-registries entry; `YOUR_REGISTRY_HOST` without `:5000` does not match `YOUR_REGISTRY_HOST:5000`.
- CIDR ranges are allowed (`"insecure-registries": ["CONTAINER_IP/8"]`) for lab networks.
- Production registries should get real TLS instead; insecure mode sends credentials unencrypted.
- Docker Desktop: edit via Settings > Docker Engine JSON, not the Linux path.