Force docker login / pull to only use TLSv1.3

[RaymiiOrg]

Sometimes the docker login command, or subsequent docker push / pull commands negotiate a TLSv1.2 connection (as seen in tcpdump). I want to force it to always use TLSv1.3. The docker daemon config files has no such option, can it be forced via an env var or global go setting?

[rksharma-owg]

The short version is that there is not a Docker CLI flag or environment variable that forces registry connections to use TLS 1.3.

docker login, pull, and push talk to the Docker daemon, and the daemon owns the registry-side TLS connection. A setting on the client shell cannot change the Go TLS configuration used by the daemon. The same applies to a global Go setting: it would only affect a process you build/run yourself, not the already-running Docker Engine.

If TLS 1.3-only behavior is a compliance requirement, the practical enforcement point is the network boundary: use a proxy or egress gateway that requires TLS 1.3, or enforce it on the registry/load-balancer side if you control that endpoint. Then verify the connection from the daemon host, rather than from the CLI client, since a client-side curl test can be using a different network path.

It is also worth checking the full connection chain in your capture: the registry API connection and the later blob-layer connection may terminate at different hosts, so both need to meet the same policy.