nerdexam
Docker

DCA · Question #30

How do you configure Docker engine to use a registry that is not configured with TLS certificates from a trusted CA?

The correct answer is D. Pass the '--insecure.-registry' flag to the daemon at run time. To allow the Docker engine to communicate with a registry that lacks trusted TLS certificates, the --insecure-registry flag must be passed to the daemon.

Submitted by kavita_s· Apr 18, 2026Installation and Configuration

Question

How do you configure Docker engine to use a registry that is not configured with TLS certificates from a trusted CA?

Options

  • ASet IGNORE_TLS in the 'daemon.json' configuration file.
  • BSet and export the IGNORE_TLS environment variable on the command line
  • CSet INSECURE_REGISTRY in the '/etc/docker/default' configuration file
  • DPass the '--insecure.-registry' flag to the daemon at run time

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    6% (1)
  • C
    11% (2)
  • D
    78% (14)

Why each option

To allow the Docker engine to communicate with a registry that lacks trusted TLS certificates, the `--insecure-registry` flag must be passed to the daemon.

ASet IGNORE_TLS in the 'daemon.json' configuration file.

There is no standard Docker configuration key named `IGNORE_TLS` in the `daemon.json` file for this purpose; the correct key is `insecure-registries`.

BSet and export the IGNORE_TLS environment variable on the command line

`IGNORE_TLS` is not a recognized environment variable used by the Docker daemon to configure insecure registries.

CSet INSECURE_REGISTRY in the '/etc/docker/default' configuration file

While some Linux distributions might use `/etc/default/docker` for environment variables, `INSECURE_REGISTRY` is not the canonical configuration method for modern Docker, and `/etc/docker/default` is not a standard Docker configuration file path.

DPass the '--insecure.-registry' flag to the daemon at run timeCorrect

The `--insecure-registry` flag is passed directly to the `dockerd` command at runtime (or configured in `daemon.json`) to specify a registry that the Docker daemon should connect to even if it uses plain HTTP or untrusted TLS certificates. This bypasses the default TLS certificate verification.

Concept tested: Docker insecure registry configuration

Source: https://docs.docker.com/engine/reference/commandline/dockerd/#insecure-registries

Topics

#Docker Daemon Configuration#Insecure Registry#TLS Bypass#Daemon Flags

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DCA Practice