Whenever I try to pull Amazon Corretto or another container image on my Windows 11 host, Docker fails with a TLS handshake timeout while contacting Docker Hub. The same pulls work when I connect through my phone's hotspot, and they also work inside WSL, but not through my regular Wi‑Fi connection. The error is: `failed to resolve reference "docker.io/library/amazoncorretto:latest": failed to do request: Head "https://registry-1.docker.io/v2/library/amazoncorretto/manifests/latest": net/http: TLS handshake timeout`. What should I check or change to fix this?
3 Answers
You should also rule out a broken IPv6 route, since it can produce a very similar timeout. Try `curl -4 -sI https://registry-1.docker.io/v2/` and then `curl -6 -sI https://registry-1.docker.io/v2/`. If IPv4 responds but IPv6 hangs, the issue is probably IPv6 rather than MTU. You can also run `netsh interface ipv4 show subinterfaces` to see the MTU values Windows has configured for each network adapter.
The repeated pull command only appears to help because one attempt eventually succeeds; it doesn’t fix the underlying network problem. Since setting the Docker MTU to 1464 allowed the pull to complete, leave it there and verify it with several image pulls. If they continue working, no further adjustment is needed.
This strongly points to a path MTU issue. Your Wi‑Fi connection may not handle Docker’s default packet size correctly, while the hotspot uses a smaller MTU and avoids the problem. In Docker Desktop, open Settings → Docker Engine and add or update the setting like this: `{ "mtu": 1464 }`. Apply the change and restart Docker Desktop. If 1464 works reliably, it’s a reasonable value; you don’t necessarily need to keep lowering it. You can test the limit with PowerShell using `ping -f -l 1472 8.8.8.8`, lowering the number until fragmentation stops. Add 28 bytes to the largest working payload to estimate the network MTU.
I tested the packet size and fragmentation stopped at 1464, so I set Docker’s MTU to 1464 and the image pulled successfully. Is that sufficient, or should I keep adjusting it?