1. Error message

When pulling an image, you will occasionally run into the following error:

1
2
3
4
5
6
7
8

docker pull node:10.16-alpine

10.16-alpine: Pulling from library/node
e7c96db7181b: Already exists
50958466d97a: Pulling fs layer
56174ae7ed1d: Pulling fs layer
284842a36c0d: Pulling fs layer
error pulling image configuration: Get https://production.cloudflare.docker.com/registry-v2 /docker/registry/v2/blobs/sha256/b9/b95baba1cfdbfa8b789137179d8e fff08b9768f1906725a8758cf0c431b59621/data? verify=1636603895-lbb1QIruPZBdfgfhBZ95ArGK0wU%3D: dial tcp 104.18.124.25:443: i/o timeout

2. Main solutions

2.1 Change the DNS address

On CentOS, just edit the /etc/resolv.conf file and add a line nameserver 8.8.8.8.

On Ubuntu, you need to edit /etc/systemd/resolved.conf and add the following:

[Resolve]
DNS=8.8.8.8

Then run systemctl restart systemd-resolved to restart the service.

2.2 Too large a time skew between the local machine and the server

Run the following command to synchronize the time:

1

ntpdate time.windows.com

2.3 Configure an image accelerator

After configuring an image accelerator, if the image to be pulled already exists on the mirror, the image layer data is pulled directly from the mirror.

1
2
3

{
  "registry-mirrors": ["https://ustc-edu-cn.mirror.aliyuncs.com"]
}

3. Possible causes

3.1 The Cloudflare IP is blocked

DockerHub relies on Cloudflare’s network to distribute images. In the domestic environment, the availability of Cloudflare IPs cannot be guaranteed, and some IPs are blocked.

Changing the nameserver alters the service IP address that production.cloudflare.docker.com points to, switching the attempt to a different IP. Time synchronization, on the other hand, addresses the invalid-certificate problem; here it may have no effect at all, and merely buys time so that the DNS pointing can change. After configuring an image accelerator, the IP used to pull the image changes, which may also solve the problem.

3.2 DockerHub’s strategy to boost revenue

Since the vast majority of DockerHub users are free users, it is hard to shoulder the enormous bandwidth and storage costs, so availability suffers for free users.