Force docker login / pull to only use TLSv1.3

[RaymiiOrg]

Sometimes the docker login command, or subsequent docker push / pull commands negotiate a TLSv1.2 connection (as seen in tcpdump). I want to force it to always use TLSv1.3. The docker daemon config files has no such option, can it be forced via an env var or global go setting?

[christianalberto]

Docker is written in Go and uses Go's standard crypto/tls package rather than OpenSSL. Because of this, standard OpenSSL environment variables or global system TLS configs do not affect the Docker CLI or Daemon unless you are using a FIPS/BoringCrypto build tailored for Linux crypto-policies.

Currently, neither the Docker Daemon configuration (daemon.json) nor the Docker CLI provide an environment variable to set MinVersion / MaxVersion for outgoing client TLS handshakes.

Here are the standard approaches to enforce TLS 1.3 for Docker operations:

1. Server-Side / Registry Enforcement (Recommended)

The most reliable way to enforce TLS 1.3 is to configure your container registry or reverse proxy (Nginx, Traefik, HAProxy, AWS ALB) in front of the registry to only accept TLS 1.3:

• Nginx example: ssl_protocols TLSv1.3;
• Traefik example: minVersion = "VersionTLS13"

When the registry refuses TLS 1.2 during the initial handshake negotiation, the Go HTTP client in Docker is forced to negotiate TLS 1.3.

2. System Crypto-Policies (Enterprise Linux / RHEL / Fedora)

If you are running Docker on RHEL/Fedora and using system-provided Go / Docker packages built with FIPS/BoringCrypto integration, you can set the system-wide crypto policy:

sudo update-crypto-policies --set FUTURE