Nexus 3 as Docker Registry behind Traefik v.2 - pushing fails

Question

On the same linux VM with docker v.19.03.11 I'm running:

Nexus:

version: '3.7'

services:
  nexus:
    container_name: nexus
    image: sonatype/nexus3
    volumes:
      - nexus-data:/nexus-data
    networks:
      - web
    ports:
      - 8081
      - 8082
      - 8083
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      # admin.nexus.xxx.intern
      - "traefik.http.routers.nexus.rule=Host(`admin.nexus.xxx.intern`, `maven.nexus.itools.intern`)"
      - "traefik.http.services.nexus.loadbalancer.server.port=8081"
      - "traefik.http.routers.nexus.service=nexus"
      - "traefik.http.routers.nexus.entrypoints=web"
      # docker.nexus.xxx.intern
      - "traefik.http.routers.docker.rule=Host(`docker.nexus.xxx.intern`)"
      - "traefik.http.services.docker.loadbalancer.server.port=8083"
      - "traefik.http.routers.docker.service=docker"
      - "traefik.http.routers.docker.entrypoints=web"

networks:
  web:
    external: true
volumes:
  nexus-data:
    external: true

in Nexus Repository Manager Dashboard I created one hosted docker repository and assigned it port 8083.

and Traefik:

version: '3.7'

services:
  traefik:
    container_name: traefik
    image: traefik
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./conf:/conf
      - ../ssl:/ssl:ro
    networks:
      - web
    ports:
      - 80:80
      - 443:443
    restart: always
    command:
      # Enabling docker provider
      - "--providers.docker=true"
      # Do not expose containers unless explicitly told so
      - "--providers.docker.exposedbydefault=false"
      # Enable API (listening on port 8080)
      - "--api.insecure=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      # Enable the file provider to define routers / middlewares / services in file
      # EMPTY AT THE TIME!
      - "--providers.file.directory=/conf"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.rule=Host(`traefik.xxx.intern`)"
      - "traefik.http.routers.traefik.entrypoints=web"
      - "traefik.http.routers.traefik_tls.tls=true"
      - "traefik.http.routers.traefik_tls.rule=Host(`traefik.xxx.intern`)"
      - "traefik.http.routers.traefik_tls.entrypoints=websecure"
      - "traefik.http.routers.traefik_tls.service=api@internal"
networks:
  web:
    external: true

I can login into the docker repository form anywhere:

docker login -u user -p password1234 docker.nexus.xxx.intern
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded

but I cannot push into the registry:

docker push docker.nexus.xxx.intern/hello-world
The push refers to repository [docker.nexus.xxx.intern/hello-world]
af0b15c8625b: Preparing
error parsing HTTP 404 response body: invalid character 'p' after top-level value: "404 page not found\n"

When I expose the port 8083 and bypass Traefik, everything works fine and I can push into the Nexus Registry. The problem is I can only expose ports 80 and 443.

Did anyone have a similar issue and knows how to solve it?

Update 1

Have also tried with Harbor - the same result - cannot push behind traefik.

Answer 1

Same issue for me. I've tried Option 1 : add prefix on path for v2 as Docker is putting a /v2 prefix

• traefik.http.routers.docker.rule=Host(`docker.nexus.xxx.intern`) && PathPrefix(`/{version:(v1|v2)}/`)

Option 2 : add prefix to request and remove it with a middleware replacepathregex

• traefik.http.middlewares.replace-path.replacepathregex.regex=^/(v1|v2)/(push|pull)/(.*)
• traefik.http.middlewares.replace-path.replacepathregex.replacement=/$$1/$$3
• traefik.http.routers.docker.rule=Host(`docker.nexus.xxx.intern`) && PathPrefix(`/{version:(v1|v2)}/push/`)
• traefik.http.routers.nexus-registry-push.middlewares=replace-path

Answer 2

Try adding to the Nexus container in docker-compose file

    environment:
       - "REGISTRY_HTTP_RELATIVEURLS=true"