DockerDesktop + WSL2

在宿主机开启代理且 WSL2 终端能正常联网的情况下，执行 docker login 或 docker pull 出现如下错误：

1
Error response from daemon: Get "https://registry-1.docker.io/v2/": writing response to registry-1.docker.io:443: reading HTTP CONNECT: unexpected EOF

下面是我相关的软件版本号和一些配置

配置

WSL2

版本号：Ubuntu 22.04 LTS

wslconfig：在 Windows 用户目录（%USERPROFILE%）中配置 .wslconfig，让 WSL2 与 Windows 共享网络栈，并启用 DNS 隧道和自动代理。

1
2
3
4
5
6
7
8
[wsl2]
networkingMode=mirrored
dnsTunneling=true
autoProxy=true

[experimental]
# requires dnsTunneling but are also OPTIONAL
bestEffortDnsParsing=true

Docker Desktop

1
docker version
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
Client:
 Version:           27.1.1
 API version:       1.46
 Go version:        go1.21.12
 Git commit:        6312585
 Built:             Tue Jul 23 19:57:57 2024
 OS/Arch:           windows/amd64
 Context:           desktop-linux

Server: Docker Desktop 4.33.1 (161083)
 Engine:
  Version:          27.1.1
  API version:      1.46 (minimum version 1.24)
  Go version:       go1.21.12
  Git commit:       cc13f95
  Built:            Tue Jul 23 19:57:19 2024
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.19
  GitCommit:        2bf793ef6dc9a18e00cb12efb64355c2c9d5eb41
 runc:
  Version:          1.7.19
  GitCommit:        v1.1.13-0-g58aa920
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
1
docker info
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
Client:
 Version:    27.1.1
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.16.1-desktop.1
    Path:     C:\Program Files\Docker\cli-plugins\docker-buildx.exe
  compose: Docker Compose (Docker Inc.)
    Version:  v2.29.1-desktop.1
    Path:     C:\Program Files\Docker\cli-plugins\docker-compose.exe
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.34
    Path:     C:\Program Files\Docker\cli-plugins\docker-debug.exe
  desktop: Docker Desktop commands (Alpha) (Docker Inc.)
    Version:  v0.0.14
    Path:     C:\Program Files\Docker\cli-plugins\docker-desktop.exe
  dev: Docker Dev Environments (Docker Inc.)
    Version:  v0.1.2
    Path:     C:\Program Files\Docker\cli-plugins\docker-dev.exe
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.25
    Path:     C:\Program Files\Docker\cli-plugins\docker-extension.exe
  feedback: Provide feedback, right in your terminal! (Docker Inc.)
    Version:  v1.0.5
    Path:     C:\Program Files\Docker\cli-plugins\docker-feedback.exe
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.3.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-init.exe
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-sbom.exe
  scout: Docker Scout (Docker Inc.)
    Version:  v1.11.0
    Path:     C:\Program Files\Docker\cli-plugins\docker-scout.exe

Server:
 Containers: 6
  Running: 0
  Paused: 0
  Stopped: 6
 Images: 11
 Server Version: 27.1.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 2bf793ef6dc9a18e00cb12efb64355c2c9d5eb41
 runc version: v1.1.13-0-g58aa920
 init version: de40ad0
 Security Options:
  seccomp
   Profile: unconfined
  cgroupns
 Kernel Version: 6.18.33.2-microsoft-standard-WSL2
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 20
 Total Memory: 7.62GiB
 Name: docker-desktop
 ID: b5c6ab7d-854e-41b9-b4c9-c349ffdd10ae
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Labels:
  com.docker.desktop.address=npipe://\\.\pipe\docker_cli
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  127.0.0.0/8
 Registry Mirrors:
  https://registry-1.docker.io/
 Live Restore Enabled: false

WARNING: daemon is not using the default seccomp profile

这里的 HTTP Proxy: http.docker.internal:3128 和 HTTPS Proxy: http.docker.internal:3128 是 Docker Desktop 使用的内部代理地址，不等同于宿主机代理软件的 7897 端口。是否使用外部代理，应以 Docker Desktop 的 Settings → Resources → Proxies 配置为准。

问题排查

排查 WSL 配置问题

先检查 WSL2 是否可以访问 Docker Registry。

1
curl -i https://registry-1.docker.io/v2/

  • 正常情况下可能返回 401 Unauthorized，这表示已经成功连接到 Registry，只是请求未携带认证信息。

  • 如果出现连接失败、超时或无法解析域名，说明 WSL2 的网络或代理配置有问题。可以参考上述配置部分，或者参考配置 Win+WSL 环境下的网络代理。

排查代理和防火墙问题

如果 WSL2 可以访问外网，但 docker login 或 docker pull 仍然出现以下错误：

1
Error response from daemon: Get "https://registry-1.docker.io/v2/": writing response to registry-1.docker.io:443: reading HTTP CONNECT: unexpected EOF

unexpected EOF 表示 Docker daemon 在通过 HTTP 代理建立 HTTPS CONNECT 隧道时，连接在握手阶段被关闭或重置。可能原因包括

  • 代理监听地址或端口错误
  • 防火墙拦截
  • 代理协议不匹配
  • Docker Desktop 没有使用正确的代理配置

执行下述命令，测试当前 WSL 环境是否能通过代理访问 Registry（将 your_proxy_port 替换为宿主机实际监听端口，例如 7897）：

1
curl -i -x http://127.0.0.1:your_proxy_port https://registry-1.docker.io/v2/

如果该命令失败，说明当前 WSL 到代理的连接仍有问题。此时检查代理是否监听在 127.0.0.1、端口是否正确，以及 Windows 防火墙是否拦截了该端口。必要时，可以在 Windows 中以管理员身份运行 PowerShell，放行代理端口：

1
New-NetFirewallRule -DisplayName "WSL-Proxy-7897" -Direction Inbound -LocalPort 7897 -Protocol TCP -Action Allow

注意：该规则会允许所有来源访问此端口，实际使用时应根据安全要求限制 -RemoteAddress 或调整防火墙规则。仅添加规则并不能证明问题一定由防火墙引起。

再次测试

1
2
3
4
5
6
7
8
9
10
11
> curl -i -x http://127.0.0.1:7897 https://registry-1.docker.io/v2/

HTTP/1.1 200 Connection established

HTTP/2 401
date: Sun, 27 Sep 2026 09:56:27 GMT
content-type: application/json
content-length: 87
docker-distribution-api-version: registry/2.0
www-authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io"
strict-transport-security: max-age=31536000

如果上面的测试成功，在 Docker Desktop 中打开 Settings → Resources → Proxies，启用 Manual proxy configuration，将 HTTP 和 HTTPS 代理都设置为：

1
http://127.0.0.1:7897

Bypass 为:

1
localhost,127.0.0.1,docker.internal

alt text

后续就可以正常使用啦 :)

1
2
3
4
5
6
7
8
9
docker pull ubuntu:16.04
16.04: Pulling from library/ubuntu
58690f9b18fc: Pull complete
b51569e7c507: Pull complete
da8ef40b9eca: Pull complete
fb15d46c38dc: Pull complete
Digest: sha256:1f1a2d56de1d604801a9671f301190704c25d604a416f59e03c04f5c6ffee0d6
Status: Downloaded newer image for ubuntu:16.04
docker.io/library/ubuntu:16.04