Docker Registry Mirror Test & Config Generator
Validates real Docker Registry V2 pulls, ranks mirrors by your current network latency, and generates ready-to-use configuration.
Add your own mirror
Hostnames only (a port is fine). Nothing is stored, and up to 3 per run. Hostnames that resolve to private addresses are rejected so this page cannot be used as an internal port scanner.
This free test allows up to 3 custom mirrors. Sponsoring 17NAS helps us maintain and improve Docker tools.Mirrors ready to use
These mirrors are alive: some need a docker login first, some are throttling right now, some restrict our probe node by region. They are left out of the generated config below, but may work fine on your network.
Either the hostname does not resolve / connect, or it connects but returns a web page instead of an image manifest. The second kind is the trap: it looks fine in a browser, yet every docker pull fails. They stay listed here rather than being silently dropped.
Generated config
/etc/docker/daemon.json
- Write the content into
/etc/docker/daemon.json - Restart the Docker daemon:
sudo systemctl restart docker - Verify it took effect:
docker info | grep -i registry
- Create the directory:
sudo mkdir -p /etc/containerd/certs.d/docker.io - Save the content above in that directory as
hosts.toml - Restart containerd:
sudo systemctl restart containerd
If your panel accepts one mirror address per line, switch to the 1Panel / DPanel tab above and copy the list generated from this test.
Two separate measurements. Protocol validation runs on the 17NAS probe node: it requests /v2/, follows the standard Docker flow for an anonymous token when it sees 401 + WWW-Authenticate: Bearer, fetches the manifest for library/alpine:latest with that token, and finally checks the response really is a manifest (via the Docker-Content-Digest header and media type) rather than a web page. Latency is measured by your own browser hitting each /v2/ endpoint three times and taking the median — that is the speed you will actually get, so it drives the ranking and the recommendations.
What the six statuses mean
- Ready to use — a real manifest came back anonymously; drop it into your config.
- Login required — the mirror is alive but wants a
docker loginfirst. Vendor-private accelerators almost all land here. - Rate limited — too many requests in a short window (HTTP 429). Temporary; retry in a while.
- Access restricted — the mirror explicitly refused our probe node (HTTP 403). Typical of campus, intranet or geo-limited mirrors; it may work perfectly on the right network.
- Not a registry — it connects, but answers with a web page, a missing image or a stray redirect. Tools that only read the HTTP status code call these "available"; put one in
daemon.jsonanddocker pullis guaranteed to fail. - Unreachable — the hostname has no DNS record left, or the connection / TLS handshake fails. Public mirrors usually just drop their DNS when they shut down, so these can go from your bookmarks.
Setting up a mirror that needs a login
Run docker login <mirror-host> with the credentials your provider gave you; they land in ~/.docker/config.json. Then add the host to registry-mirrors by hand. Note that the credentials in that file are base64-encoded, not encrypted — do not push it to a public repo along with your backups.
docker pull throughput.