Docker pull postgres - Forbidden

Hello,

I am trying to pull a postgressql Databas on an ubuntu 22.04. I do:

docker pull docker.io/postgres:18-alpine3.21
and get the following error Message:

18-alpine: Pulling from library/postgres
6a0ac1617861: Already exists
2d60466be50c: Retrying in 1 second
6389c679d448: Retrying in 2 seconds
561ed1490a5c: Retrying in 2 seconds
bad9a60af1cb: Waiting
6964af6a9400: Waiting
2f94990e3c9b: Waiting
5993a5f08046: Waiting
fe238b783bbd: Waiting
error pulling image configuration: download failed after attempts=6: Forbidden

What can I check. The Image is part of a netbox installation. Netbox itself
docker pull docker.io/netboxcommunity/netbox:v4.6-5.0.1
works fine.
I am behind a proxy.

Thanks

This command works as is.
If you images then your proxy must either have been configured properly, or you had the image in your local image cache already.

Please share the output of docker info, so we can see what version you use on what distribuion.

Answering is a little bit difficult, can not upload an attachment, too many URLs…
I hope the docker info can be read. The name of the server and proxy are anonymized
Maybe I have to whitelist some more URLs. I have whitelisted the following URLS:
*.docker.io
*.github.com
*.docker.com

Use markdown to insert temrinal output, logs and any special text as a codeblock as you would on other technical forums, including GitHub. Or click on the </> button to insert the code block.

A little help: https://forums.docker.com/t/how-to-format-your-forum-posts/127295#p-202628-dockerfiles-compose-files-logs-and-code-4

Postgres is an official image, netbox is a Sponsored Opensource image. (OSS) I assume that is the difference as some rules are different for OSS projects. When you are logged in with a paid subscription, both should be downloaded from production.cloudflare.docker.com, which you covered by setting *.docker.com, but when you are not logged in with a paid subscription, postgres seems to be downloaded from docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com.

I started a proxy server locally to test it. You can do the same when you have no access to the proxy that returns the error or if you have access to it, check the logs or enable verbose logs if possible to see all traffic. I usually used squid as it was the first I learned about, but I used mitproxy on macOS now.

So basically you should add docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com to the proxy. Not for Docker CE, but the allowlist for Docker Desktop could be still useful:

It also contains the domain I quoted above from cloudflare.

Thank you very much for your help. It works now. Cloudfare was missing…