The insecure-registries setting tells the Docker daemon to treat a registry as insecure, meaning it has no TLS or its certificate is not trusted. Docker says to enable it only for testing, because it creates security vulnerabilities. The fix is to add your CA to the system trust store.
What it does
In daemon.json the key is insecure-registries, a list. The command line flag is --insecure-registry. Entries can be a host and port such as myregistry:5000, or a CIDR range such as 10.1.0.0/16.
A registry counts as insecure if it does not use TLS or if its certificate is not trusted by the daemon. Without the setting, docker pull, docker push and docker search return errors for such registries.
Docker also notes that local registries in the 127.0.0.0/8 range are marked insecure automatically, a behaviour that dates from Docker 1.3.2.
Why it is risky
With the setting, the daemon will talk to that registry over plain HTTP or accept any certificate. Anyone on the network path can read the traffic, including credentials, and can alter responses. That includes the image layers you are about to run.
A CIDR entry is wider still. It trusts every host in the range, so a new machine that appears in that address block is trusted without anyone deciding so.
The Docker reference says directly that the option should only be enabled for testing purposes because its use creates security vulnerabilities.
What to do instead
Docker recommends adding your CA to the system's list of trusted CAs. For an internal registry that means three things.
- Issue the registry certificate from a CA your machines already trust, or from your own internal CA.
- Distribute that CA to build hosts, CI runners and cluster nodes through your normal configuration management.
- Remove the registry from
insecure-registriesonce the certificate validates.
The registry deployment guide says the same from the server side: self-signed certificates and insecure registries are for testing, and a production registry must be protected by TLS.
Finding where it is set
| Place | What to look for |
|---|---|
/etc/docker/daemon.json | an insecure-registries list |
| Service unit or startup flags | --insecure-registry |
| CI runner images | baked in daemon configs |
| Developer machines | local Docker Desktop settings |
Sweep these quietly and build a list. Often the entry was added months ago for a test and never removed.
A safe test registry
If you do need a throwaway registry on a laptop, bind it to localhost and keep it off shared networks. Do not copy that config into a shared environment.
Safeguard can scan container images and generate SBOMs for what your registry serves, and there is a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the demo and watch how a result ties back to a specific artifact, which is what you want from any registry you run.
Quick check
Does insecure-registries disable TLS verification globally?
No, it applies to the registries listed. But each listed host or range loses the protection of verified TLS.
Is localhost insecure by default?
Docker documents that registries in 127.0.0.0/8 are marked insecure automatically.
Sources
Last reviewed: 19 October 2026.
