How to fix Error response from daemon: Get https://myregistry:5000/v2/: net/http: request canceled (Client.Timeout exceeded) in Docker

First, check if the registry is reachable from your host machine (outside of Docker):

# For a private registry
curl -v https://myregistry:5000/v2/

# For Docker Hub
curl -v https://registry-1.docker.io/v2/

# Test DNS resolution
nslookup myregistry
# or
dig myregistry

# Test network connectivity
ping myregistry
telnet myregistry 5000

If curl works but Docker fails, the issue is likely Docker-specific configuration (proxy, DNS, or certificates). If curl also fails, the issue is at the network level.

Ensure your firewall allows outbound connections to the registry:

# Check if port is open (Linux)
sudo iptables -L -n | grep 5000

# For Docker Hub, ensure port 443 is open
sudo iptables -L -n | grep 443

# Test connection with nc (netcat)
nc -zv myregistry 5000

# On macOS, check Application Firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

Common ports to allow:
- Port 443: Docker Hub, ghcr.io, and most cloud registries
- Port 5000: Default port for self-hosted Docker Registry
- Port 5001: Often used for registry authentication

If behind a corporate firewall, contact your IT team to whitelist the registry domain and port.

If you're behind a corporate proxy, Docker needs explicit configuration:

Linux (systemd):

# Create drop-in directory
sudo mkdir -p /etc/systemd/system/docker.service.d

# Create proxy configuration
sudo nano /etc/systemd/system/docker.service.d/http-proxy.conf

Add your proxy settings:

[Service]
Environment="HTTP_PROXY=http://proxy.company.com:8080"
Environment="HTTPS_PROXY=http://proxy.company.com:8080"
Environment="NO_PROXY=localhost,127.0.0.1,myregistry,.company.internal"

Reload and restart Docker:

sudo systemctl daemon-reload
sudo systemctl restart docker

Docker Desktop (Windows/Mac):
Go to Settings > Resources > Proxies and configure your proxy settings there.

Verify proxy is applied:

sudo systemctl show --property=Environment docker

DNS issues are a common cause of registry timeouts. Configure Docker to use reliable DNS servers:

# Edit Docker daemon configuration
sudo nano /etc/docker/daemon.json

Add DNS configuration:

{
  "dns": ["8.8.8.8", "8.8.4.4", "1.1.1.1"]
}

Restart Docker:

sudo systemctl restart docker

For private registries, ensure the hostname is resolvable:

# Add to /etc/hosts if needed
echo "192.168.1.100 myregistry" | sudo tee -a /etc/hosts

For Docker Desktop: Go to Settings > Docker Engine and add the DNS configuration to the JSON editor.

If your private registry uses a self-signed certificate, Docker won't trust it by default. You have two options:

Option 1: Add certificate to Docker's trust store (recommended)

# Create certificate directory
sudo mkdir -p /etc/docker/certs.d/myregistry:5000

# Copy the registry's CA certificate
sudo cp ca.crt /etc/docker/certs.d/myregistry:5000/ca.crt

# Restart Docker
sudo systemctl restart docker

Option 2: Configure as insecure registry (not recommended for production)

sudo nano /etc/docker/daemon.json

Add:

{
  "insecure-registries": ["myregistry:5000"]
}

sudo systemctl restart docker

Note: Using insecure registries exposes you to man-in-the-middle attacks. Only use this for testing or isolated networks.

IPv6 can cause DNS resolution delays on some networks:

# Check if IPv6 is causing issues
curl -4 -v https://myregistry:5000/v2/  # Force IPv4
curl -6 -v https://myregistry:5000/v2/  # Force IPv6 (may fail)

If IPv4 works but IPv6 fails, disable IPv6:

# Add to /etc/sysctl.conf
sudo nano /etc/sysctl.conf

Add:

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1

Apply and restart Docker:

sudo sysctl --system
sudo systemctl restart docker

VPNs often interfere with Docker registry connections:

1. Test without VPN: Temporarily disconnect your VPN and try the Docker command again.

2. If it works without VPN, configure split tunneling to exclude registry traffic:

Most VPN clients allow you to exclude specific domains or IP ranges. Add these to your VPN's split tunnel configuration:
- Your private registry domain (myregistry)
- Docker Hub: registry-1.docker.io, auth.docker.io, production.cloudflare.docker.com

3. Alternative: Use VPN's internal DNS if your registry is inside the VPN network:

# Configure Docker to use VPN's DNS
sudo nano /etc/docker/daemon.json

{
  "dns": ["10.0.0.1"]  // Your VPN's DNS server
}

On slow or unstable connections, reduce the number of parallel operations:

sudo nano /etc/docker/daemon.json

Add:

{
  "max-concurrent-downloads": 1,
  "max-concurrent-uploads": 1
}

sudo systemctl restart docker

This reduces bandwidth usage per operation, making each individual request less likely to timeout. The default values are 3 for downloads and 5 for uploads.

For very slow connections, you can also try pulling during off-peak hours when network congestion is lower.

If the issue is intermittent, retry with additional debugging information:

# Enable Docker daemon debug mode
sudo nano /etc/docker/daemon.json

Add:

{
  "debug": true
}

sudo systemctl restart docker

# Watch Docker logs while running your command
sudo journalctl -u docker -f &

# Try your command
docker pull myregistry:5000/myimage:latest

For transient issues, implement retry logic:

# Retry script
for i in {1..5}; do
  docker pull myregistry:5000/myimage:latest && break
  echo "Attempt $i failed, waiting 10 seconds..."
  sleep 10
done

Don't forget to disable debug mode after troubleshooting:

{
  "debug": false
}