Docker Compose Pull 超时与代理踩坑记录

问题一：docker compose pull 直接超时

报错

> docker compose pull
Error response from daemon: Get "https://registry-1.docker.io/v2/": dial tcp 108.160.170.33:443: i/o timeout (Client.Timeout exceeded while awaiting headers)

原因

Docker daemon 无法直连 Docker Hub（国内网络被阻断）。

解决办法

给 Docker 配代理，让 daemon 走代理访问外网。

sudo mkdir -p /etc/systemd/system/docker.service.d
sudo vi /etc/systemd/system/docker.service.d/proxy.conf

内容

[Service]
Environment="HTTP_PROXY=http://172.24.48.1:7890"
Environment="HTTPS_PROXY=http://172.24.48.1:7890"
Environment="NO_PROXY=localhost,172.24.48.1"

然后

sudo systemctl daemon-reload
sudo systemctl restart docker

问题二：配置代理后仍然失败

报错

> docker compose pull
Error response from daemon: Get "https://registry-1.docker.io/v2/": read tcp 172.24.48.247:60752->172.24.48.1:7890: read: connection reset by peer

定位方式

curl -I https://registry-1.docker.io/v2/ --proxy http://172.24.48.1:7890

结果

HTTP/1.1 200 Connection established 
curl: (35) OpenSSL SSL_connect: Connection reset by peer in connection to registry-1.docker.io:443

原因

docker域名没有设置代理规则，走了直连

解决办法

在代理（如 Clash）中强制 Docker Hub 走代理

rules:
  - DOMAIN,registry-1.docker.io,PROXY
  - DOMAIN,auth.docker.io,PROXY
  - DOMAIN-SUFFIX,docker.com,PROXY
  - DOMAIN-SUFFIX,docker.io,PROXY

重启 Clash，再试

最终验证

curl -I https://registry-1.docker.io/v2/ --proxy http://172.24.48.1:7890
# 成功

docker compose pull
# 成功

优化

1. 为避免每次拉取新的clash配置时重置自定义 rules，将上述 docker rules 设置到 mixins 中

module.exports.parse = ({ content, name, url }, { yaml, axios, notify }) => {
  const rules = [
    // ...

    // docker
    "DOMAIN-SUFFIX,docker.com,PROXY",
    "DOMAIN-SUFFIX,docker.io,PROXY",
    "DOMAIN,registry-1.docker.io,PROXY",
    "DOMAIN,auth.docker.io,PROXY"
  ]
  content.rules.unshift(...rules)
  return content
}