Docker cannot pull any images, even though the host has normal internet access. Commands such as wget, curl, and apt-get work correctly, but Docker fails while contacting the authentication endpoint for the image registry. The system is Debian 6.1.159 on amd64 with Docker 29.6.1, running behind NAT on a local network. For example, `docker run hello-world` fails with a TCP connection reset while connecting to `auth.docker.io` over HTTPS. Ping to the resolved address succeeds, and there are no intentional outbound firewall restrictions. What could cause Docker's connections to be reset, and how can I narrow it down?
4 Answers
A reset usually means something along the network path is actively terminating the TCP connection rather than simply failing to route it. Test the exact endpoints from the host with curl, tracepath, and packet captures, and compare the results with Docker’s daemon environment. Check for outbound filtering, transparent proxies, traffic shaping, or an upstream policy affecting registry traffic. Trying another registry can also help determine whether the issue is specific to the image registry or affects Docker networking generally.
The error is happening while the daemon is making an HTTPS connection to the registry authentication service, so it is not necessarily an image-layer or container problem. Verify that Docker is using the expected proxy, DNS, route, and firewall settings. Compare `curl` against both the registry URL and the authentication URL, since access to one does not prove the other is allowed.
Check the path MTU, especially when the host is behind NAT, a VPN, or another tunnel. A wrong MTU can allow small requests or ping packets but reset or break larger TCP exchanges. Testing with a lower interface MTU, such as 1400, or configuring Docker’s MTU in `daemon.json` has fixed similar registry failures for some setups.
That is worth checking. I also moved Docker to another virtual machine, so I’m comparing whether the behavior follows the network or the original host.
Try pulling a small image from a different container registry. If that works while the main registry still fails, investigate filtering, routing, or address-specific handling for the registry and authentication domains. If every registry fails in the same way, focus on the host’s network path, MTU, proxy settings, and firewall rules instead.
The host can reach the address with ping, and ordinary curl and package downloads work. I’m planning to test the same setup in a clean VM and compare access to other registries.