Whenever I try to pull amazoncorretto or another Docker image on my Windows 11 host, the pull fails with a TLS handshake timeout:
```text
Using default tag: latest
Error response from daemon: failed to resolve reference "docker.io/library/amazoncorretto:latest": failed to do request: Head "https://registry-1.docker.io/v2/library/amazoncorretto/manifests/latest": net/http: TLS handshake timeout
```
The same pulls work when I connect through my phone's hotspot, and they also work in WSL, but fail when Docker Desktop uses my regular Wi‑Fi connection. What should I check or change to fix this?
3 Answers
You can measure the path MTU from PowerShell with:
```powershell
ping -f -l 1472 8.8.8.8
```
The payload plus 28 bytes of headers corresponds to an MTU of 1500. If fragmentation is reported, lower the value until the ping succeeds consistently, then add 28 to that payload size. You can also see Windows’ configured adapter values with:
```powershell
netsh interface ipv4 show subinterfaces
```
Using 1464 as the Docker MTU is reasonable if it is the largest value that works reliably. There is no need to reduce it further unless pulls still fail; a slightly lower value can provide extra margin.
Another possibility with nearly identical symptoms is broken IPv6. Compare these commands:
```powershell
curl -4 -sI https://registry-1.docker.io/v2/
curl -6 -sI https://registry-1.docker.io/v2/
```
If IPv4 responds but IPv6 hangs, the Wi‑Fi network or router may be advertising unusable IPv6. Fixing or disabling that IPv6 path would address the issue without changing Docker’s MTU.
This strongly suggests an MTU issue on the Wi‑Fi path. Larger TLS packets may be getting fragmented or dropped, while the mobile connection uses a smaller MTU and avoids the problem. In Docker Desktop, open Settings → Docker Engine and add or update the MTU setting, for example:
```json
{
"mtu": 1400
}
```
Apply the change and restart Docker Desktop. If that fixes the pulls, you can test higher values to find the largest reliable MTU.
I tested the packet size and found that 1464 worked without the fragmentation error. I set Docker’s MTU to 1464, and the image pulled successfully. Is that a suitable value?