Cannot Pull Image from mcr.microsoft.com — Fails with EOF on Local Machine

Docker Engine General
1

Hi Docker Community,

I’m running into an issue when trying to pull a dev container image locally. The same container works fine in GitHub Codespaces, but on my local Windows machine, pulling fails consistently with an EOF error.

Issue:
When I run the following command:

powershell

docker --debug pull mcr.microsoft.com/devcontainers/universal:2

I get this error:

Error response from daemon: failed to resolve reference "mcr.microsoft.com/devcontainers/universal:2"

What I’ve Tried:

  • Restarting Docker and PC
  • Disabling Windows firewall and antivirus temporarily
  • Reinstalling Docker Desktop
  • Switching between WSL 2 and Hyper-V backend
  • Running with --debug for more details
  • Confirmed that mcr.microsoft.com is reachable with curl

Any help or suggestions would be greatly appreciated!

2

Can you pull any other image? For example the hello-world from Docker Hub?

docker pull hello-world
3

Yes, I can pull hello-world from Docker Hub.

PS C:\WINDOWS\system32> docker pull hello-world
Using default tag: latest
latest: Pulling from library/hello-world
e6590344b1a5: Pull complete
Digest: sha256:ec153840d1e635ac434fab5e377081f17e0e15afab27beb3f726c3265039cfff
Status: Downloaded newer image for hello-world:latest
docker.io/library/hello-world:latest
4

Interesting: it works on docker-ce, but fails on Docker Desktop for Windows.

I tried: docker pull mcr.microsoft.com/devcontainers/universal:3.0.3-linux

Update: Seems the different is that my Windows host prefers the resolved ipv6 address for mcr.microsoft.com, while my Linux host prefers the ipv4 address.

Update2: just fyi: it is unrelated to whether containerd is used as image store or not.

5

Hi meyay,

thanks for your observations. I have blocked ipv6 in Docker Engine temporarily but it still does not work. I will try docker-ce.

6

It is not about Docker Engine settings, but how your host machine resolves domain names to IP addresses.

As a temporary “solution”, you can change your hosts file on Windows. I tried this to reproduce the issue with IPv6 address and the docker pull command worked only when I chose the ipv4 address.

nslookup mcr.microsoft.com

You will find ipv4 and ipv6 addresses. Choose one IPv4 address and add the following line:

X.X.X.X  mcr.microsoft.com

to

C:\Windows\System32\drivers\etc\hosts

as an administrator.

So it could be an issue on Microsoft’s side with the IPv6 address.

1 Like
7

I deactivated ipv6 on the network adapter: works right away.

with ipv6 disabled:

PS C:\Users\metin> docker pull mcr.microsoft.com/devcontainers/universal:3.0.3-linux
3.0.3-linux: Pulling from devcontainers/universal
525f01266ef3: Pulling fs layer
fd3754bf6f6d: Pulling fs layer
e3ad49aa9380: Pulling fs layer
8f7bbca1cbf1: Pulling fs layer
525f01266ef3: Downloading [>                                                  ]  5.243MB/607.6MB
b08e2ff4391e: Pulling fs layer
81605091c733: Download complete
a24b563b5ca1: Pulling fs layer
249df95056b3: Download complete
fe0618dcba1b: Download complete
6fbfc654754e: Pulling fs layer
7d48bbf2b9a7: Pulling fs layer
53890cca0259: Download complete
e88e302b36a3: Pulling fs layer
f235049d795d: Pulling fs layer
6f380ee28767: Pulling fs layer
427aed9506b2: Pulling fs layer
bc09415bf884: Pulling fs layer
4f4fb700ef54: Already exists
f88e8cbd1443: Download complete
eddb1e513ecc: Pulling fs layer
b8931413ef67: Pulling fs layer
6ac6df7580bb: Pulling fs layer
735822d60006: Pulling fs layer
9454b84e3d77: Pulling fs layer
2573692d82a2: Download complete
d658540a6b56: Pulling fs layer
d1923e350d72: Pulling fs layer
928e27e0ef8a: Pulling fs layer
f940ab671666: Pulling fs layer
f16cb30633a6: Pulling fs layer
786657300ed9: Pulling fs layer
8645ff9aca84: Pulling fs layer

With ipv6 enabled:

PS C:\Users\metin> docker pull mcr.microsoft.com/devcontainers/universal:3.0.3-linux
Error response from daemon: failed to resolve reference "mcr.microsoft.com/devcontainers/universal:3.0.3-linux": failed to do request: Head "https://mcr.microsoft.com/v2/devcontainers/universal/manifests/3.0.3-linux": EOF
1 Like
8

Now the question is whether ipv6 support is required for any website. If not, disabling ipv6 is better than modifying the hosts file as it could also cause problems when IP addresses change.

9

I would prefer to override the dns entry, rather then deactivating the ipv6 stack.

10

I would also prefer fixing the DNS, but I’m not at Microsoft :slight_smile: What do you think, @vrapolinario ?

11

Hi All,

I turned off the ipv6 from network adapter and it also works for me now. Thanks so much.

12

We don’t recommend disabling IPv6, unless you are absolutely sure any other applications won’t use it, and even then some Windows services might require it.

After reading the thread, it’s unclear to me why this happens. Any other pull from MCR works? Is it just this image? Is it with just one version of Docker? I’d rather fogure out why this is failing with IPv6 enabled and fix that than disabling IPv6.

13

Same problem/error, if i try to pull these images:

  • mcr.microsoft.com/playwright/mcp:latest
  • mcr.microsoft.com/azurelinux/base/nginx:latest:

I am on latest Docker Desktop 4.43.2

Though, this is not the first topic about Docker Desktop and failing pulls from MCR

Update: e.g. this one Docker on Windows fails to pull mcr.microsoft.com/devcontainers/base:0-alpine-3.20 due to connection reset

If you google for “docker desktop pull mcr” there will be plenty of results, showing various docker versions being affected.

14

I agree, as you pointed out in the other thread, that this should be raised as an issue directly with the MCR team. I don’t think they have an open/external channel of communication (like the Windows containers, AKS teams for example) so I’ll raise this internally. I can report back once I have news from that team.

2 Likes
15

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.