Private Docker registry with Nginx HTTPS and native authentication

25 real isolated checks passed with Distribution3.1.2, Nginx1.24.0 and Python3.12.3 on Ubuntu24.04. The exact official-image registry binary ran as a nonroot child; the proxy retained the published directives with fixture paths and loopback listeners. A private-CA TLS OCI HTTP client proved missing/wrong/correct bcrypt auth, challenge/API header, Host rejection, trusted HTTPS upload Location despite spoofed headers, real chunked PATCH/commit, OCI manifest push, fresh exact manifest/config/layer pull, disabled deletion, nonroot storage ownership, restart persistence,413 upload cap, readonly write denial and stopped-writer GC dry-run followed by another exact pull. No host ports were published.

Your acceptance still requires a real managed Docker client/helper login, independent push/pull, trusted DNS/TLS from the intended network, a suitable large-layer transfer, renewal, host reboot, encrypted off-host backup and isolated restoration. A browser setting, successful schema validation or generated DEMO hero is not runtime evidence.

The fixture did not execute Docker Engine/container publishing or pass/GPG helper login, public ACME/renewal, every-OS installation, real large-layer performance, systemd/host reboot, HA or actual backup restoration. It tested OCI transfer semantics, not a production acceptance certificate.

Seven additional exact published Python creation/bcrypt/config/secret checks passed inside the same disposable container, including no-clobber and repeat-secret refusal. Separate327 source/schema/syntax/settings checks include20 correct/wrong OS guard executions; they are not327 service tests. Some Ubuntu package-catalog requests timed out; no unverified package version pin was invented.

Before connecting CI, assign ownership for disk/inode/certificate-expiry and failed-auth monitoring, credential rotation, encrypted recovery and digest-pinned deployment. Choose repository authorization and retention rules for your actual teams. Benchmark the intended layer sizes and concurrency; this tutorial makes no throughput, HA, SLA or universal security compliance claim.