Skip to content

docs: say HttpHeaders stay on client-to-daemon calls - #7211

Open
locker95 wants to merge 1 commit into
docker:masterfrom
locker95:docs/httpheaders-client-only
Open

docs: say HttpHeaders stay on client-to-daemon calls#7211
locker95 wants to merge 1 commit into
docker:masterfrom
locker95:docs/httpheaders-client-only

Conversation

@locker95

Copy link
Copy Markdown

HttpHeaders in config.json sounded like they ride along on every request. they only go on CLI-to-daemon calls, not on the daemon's registry pulls.

See docker/docs#11456

@locker95
locker95 requested review from a team and thaJeztah as code owners August 18, 2026 07:48
@thaJeztah

Copy link
Copy Markdown
Member

This doesn't look correct; headers are forwarded, but (currently) restricted to headers prefixed with X-Meta- / x-meta-. Those headers are forwarded to the registry;

Fake registry; dumps every request, including headers.

docker run -d --quiet --rm --name registry-echo -e LOG_WITHOUT_NEWLINE=true -e DISABLE_REQUEST_LOGS=true -p 5001:8080 mendhak/http-https-echo:41

Configure the client with custom headers and pull an image (this will fail because it's not an actual registry);

DOCKER_CUSTOM_HEADERS='X-Meta-Test=forwarded,X-Test=not-forwarded' docker pull 127.0.0.1:5001/test:latest

Check the logs of the fake registry;

docker logs -n2 registry-echo | jq .headers
{
  "host": "127.0.0.1:5001",
  "user-agent": "docker/29.7.1 go/go1.26.5 git-commit/c5b8ce9 kernel/6.12.76-linuxkit os/linux arch/arm64 containerd-client/2.3.3+unknown storage-driver/overlayfs UpstreamClient(Docker-Client/29.7.1 \\(darwin\\))",
  "accept": "application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*",
  "baggage": "trigger=api",
  "x-meta-test": "forwarded",
  "accept-encoding": "gzip"
}
{
  "host": "127.0.0.1:5001",
  "user-agent": "docker/29.7.1 go/go1.26.5 git-commit/c5b8ce9 kernel/6.12.76-linuxkit os/linux arch/arm64 containerd-client/2.3.3+unknown storage-driver/overlayfs UpstreamClient(Docker-Client/29.7.1 \\(darwin\\))",
  "accept": "application/json, */*",
  "accept-encoding": "zstd;q=1.0, gzip;q=0.8, deflate;q=0.5",
  "baggage": "trigger=api",
  "x-meta-test": "forwarded"
}

@thaJeztah thaJeztah left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See above

@locker95

Copy link
Copy Markdown
Author

yeah — i had that backwards. X-Meta-* is what gets forwarded on pull; the rest stays on the client-to-daemon request. updated.

@thaJeztah

Copy link
Copy Markdown
Member

Thanks for updating; could you squash the commits?

HttpHeaders go on client-to-daemon calls. Names that start with
X-Meta- are also passed through on pull and similar.

Signed-off-by: Dean Chen <862469039@qq.com>
@locker95
locker95 force-pushed the docs/httpheaders-client-only branch from 0a828d8 to 24a5213 Compare August 18, 2026 13:42
@locker95

Copy link
Copy Markdown
Author

squashed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants