--insecure-regitsry, request for way to enable for all registries, without listing each registry.

[octalthorpe]

We run internal unsecured docker registries in all CI and production datacenters. I must say that it would be very useful to simply enable access to all insecure registries without having to list them out one by one. We have multiple registries in each environment for HA, so the list is very long and as we add more datacenters we need to make certain we update that list.

Can we have an option to simply allow insecure registry access to any remote? i.e. --insecure-registry-all or something like that.

[justinclayton]

+1. Having everyone hand update their docker daemon arguments within boot2docker is a real pain.

[daniel-garcia]

This topic is related to #8887.

[abourget]

Why not docker pull --insecure and docker search --insecure .. and just sidestep the --insecure-registry from the daemon in that case ?

[proppy]

The culprid seems to be 6a1ff02

But I couldn't find the corresponding PR or issues where that change was discussed.

@tiborvass any ideas?

[crosbymichael]

What about --insecure-registry *?

[octalthorpe]

"*" will work for me, assuming that would be --insecure-registry='*' to avoid shell expansion. 

[jbeda]

A more flexible way to do insecure whitelists would be great. Ideally, if I trust the physical security of my local network, I should be able to whitelist that. Can we support it based on a CIDR?

--insecure-registry='*' -> --insecure-registry='0.0.0.0/0'

But we could also do --insecure-registry='127.0.0.0/8' or --insecure-registry=10.0.0.0/8.

[bacongobbler]

+1 for support via CIDR. allowing a way to only allow insecure registries from a trusted network would be awesome, rather than the current implementation of having to whitelist every host a registry could land on.

For our use case, we're running our registry on Fleet, backed by cephfs. Fleet can re-schedule the registry on any node in the cluster. With docker 1.3.1 we have to supply --insecure-registry for each node in the cluster. If we can just supply a CIDR then it's less of a maintenance burden on our end when we eventually introduce more nodes to the cluster, as they'd automatically be whitelisted.

[proppy]

@jbeda or @bacongobbler can you file a different issue about CIDR, and details how it behaves wrt to port number (only 5000, all ports, separate flag or syntax?)

[tiborvass]

Fixed by #9100