Pulling user images from DockerHub consistently fails with EOF, but official images and GHCR work fine

[lusu007]

Hi Docker Team,

I'm running into a consistent problem when pulling community images from DockerHub (e.g. itzg/minecraft-server).
The downloads frequently fail with:

failed to copy: httpReadSeeker: failed open: failed to do request:
Get "https://production.cloudflare.docker.com/registry-v2/...": EOF

This happens reliably on my freshly installed Windows 11 system (and inside WSL2).

Key points:

• Official images (alpine, ubuntu, etc.) pull fine.
• Community images (hosted on DockerHub’s Cloudflare backend) fail mid-download.
• GHCR mirrors (e.g. ghcr.io/itzg/minecraft-server) pull without any issue.
• Tested on:
  • Windows 11 (fully updated)
  • Docker Desktop (latest stable)
  • WSL2 (Ubuntu 22.04)
  • Multiple networks (home broadband + mobile hotspot)
• Certificates and TLS are correct (Root CA store is up-to-date).
• Tried:
  • Disabling IPv6 in Docker
  • Reducing max-concurrent-downloads to 1
  • Disabling HTTP/2 for containerd
  • Same behavior across all tests

This seems to point to a Cloudflare edge/CDN issue specifically for user images on DockerHub.

Steps to Reproduce:

1. Fresh Windows 11 install
2. Install Docker Desktop (latest)
3. Run docker pull itzg/minecraft-server
4. Observe the pull failing after downloading a few layers with EOF.

Expected Behavior:

All layers should download and extract successfully.

Actual Behavior:

Download fails mid-layer with EOF even with --max-concurrent-downloads 1.

Additional Info:

• TLS handshake now succeeds (was a CA store issue at first).
• curl to the same signed layer URLs succeeds on my Raspberry Pi but fails on Windows with connection reset before Root CAs were updated — after updating CAs I get valid HTTP responses.
• Reproducible across different networks → not ISP issue.

Environment:

• Docker Desktop: [paste output of docker version]
• OS: Windows 11 x64 (latest updates)
• WSL2: Ubuntu 22.04
• Network: Tested on LAN + 5G hotspot (same behavior)

[github-actions]

Thank you for your feedback 👍.

Our team will review your issue shortly.
In the meantime, feel free to provide as many details as possible, as this will speed up the resolution.

If you need assistance rather than providing feedback, please contact the Docker support team via https://www.docker.com/support/ for a prompt response, and close this issue.

[jcarter3]

The infrastructure for serving community images vs official images is identical for authenticated users. Can you clarify "frequently fails..."? What area of the world are you pulling from?

[lusu007]

Okay that's weird. I'm pulling from Germany.

I created another issue here (docker/for-win/issues/14936) because I didnt know which repo was the right one.

[lusu007]

A temporary workaround is setting up a registry mirror.

E.g. :

"registry-mirrors": [
    "https://mirror.gcr.io"
]

[vdamery]

Hello @lusu007,

Is this still an issue on your side without the workaround ?

Can you try to pull another big image like ai/gemma3:latest (LLM) for example and give us the result ?

[vdamery]

Closing this one due to inactivity.

Feel free to reopen it.