Docker pulls fail with EOF from Docker Hub (and some Quay images), while other registries work normally

[MickeyLu-ai]

Hi,

I'm trying to determine whether this is an OrbStack issue, a networking issue, or something related to my environment.

Environment

• MacBook Pro M4 (Apple Silicon)
• macOS 26
• OrbStack latest version
• Docker Engine 29.4.0
• No Docker Desktop installed

Problem

Docker can communicate with the daemon normally, but pulling many images fails with EOF.

Examples:

docker pull hello-world

returns

failed to do request:
Head https://registry-1.docker.io/v2/library/hello-world/manifests/latest
EOF

or

failed to copy:
Get ... manifest sha256...
EOF

The same happens with:

docker pull alpine
docker pull ubuntu
docker pull busybox
docker run hello-world

What works

Microsoft Container Registry works:

docker pull mcr.microsoft.com/hello-world
docker run --rm mcr.microsoft.com/hello-world

Both succeed.

Quay partially works.

This succeeds:

docker pull quay.io/prometheus/busybox
docker run --rm quay.io/prometheus/busybox echo success

But another image from the same registry fails:

docker pull quay.io/prometheus/node-exporter

with EOF while downloading blobs.

This makes me think the issue is not Docker Hub-specific.

Network tests

DNS works:

dig registry-1.docker.io
dig auth.docker.io

Both resolve correctly.

Authentication works:

curl https://auth.docker.io/token

returns a valid JWT token.

TLS also works:

curl -v https://registry-1.docker.io/v2/

returns the expected

401 Unauthorized

with proper TLS handshake.

Docker information

docker info

shows:

Operating System: OrbStack
HTTP Proxy: http://proxy.orb.internal:8305
HTTPS Proxy: http://proxy.orb.internal:8305

Docker daemon is running normally.

Additional information

This Mac was migrated from an older Mac using Apple's Migration Assistant.

Cisco Secure Client is installed because I need it for work.

However:

• the VPN is disconnected
• I also tested using a completely different mobile hotspot
• the same EOF errors still happen

So the problem is reproducible without an active VPN connection.

Question

Since DNS, TLS and authentication all work correctly, could OrbStack's internal proxy (proxy.orb.internal) be aborting some registry downloads?

Or is there any known interaction between OrbStack networking and Apple's Network Extension / Cisco Secure Client Socket Filter that could produce EOF during registry blob downloads?

I'd appreciate any suggestions on where to investigate next.

Thanks!