Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to pull docker images in Iran #369

Closed
siavashs opened this issue Sep 28, 2015 · 69 comments
Closed

Unable to pull docker images in Iran #369

siavashs opened this issue Sep 28, 2015 · 69 comments
Labels

Comments

@siavashs
Copy link

I recently noticed that it's not possible to pull any docker images in Iran.

This is the output from my Mac, using latest docker toolbox:

$ docker pull hello-world
Using default tag: latest
latest: Pulling from library/hello-world

535020c3e8ad: Pulling fs layer
af340544ed62: Pulling fs layer
af340544ed62: Layer already being pulled by another client. Waiting.

This message is confusing, but after trying to pull the image on our production server which has been running docker for some time, I got a better error message:

# docker pull hello-world
Pulling repository hello-world
af340544ed62: Error pulling image (latest) from hello-world, Server error: Status 403 while fetching image layer (535020c3e8add9d6bb06e5ac15a261e73d9b213d62fb2c14d752b8e189b2b912)
c15a261e73d9b213d62fb2c14d752b8e189b2b912) s
FATA[0009] Error pulling image (latest) from hello-world, Server error: Status 403 while fetching image layer (535020c3e8add9d6bb06e5ac15a261e73d9b213d62fb2c14d752b8e189b2b912)

At first I thought that the government telecom has made a mistake and filtered the repository.
But after some digging around I found out that CloudFront has blocked our IP addresses:

# curl -i --location-trusted -I -X GET -H "Authorization: Token signature=269b05c5abaa55f6bea92fee7ee0f47cea6d7e43,repository="library/hello-world",access=read" https://registry-1.docker.io/v1/images/af340544ed62de0680f441c71fa1a80cb084678fed42bae393e543faea3a572c/layer
HTTP/1.1 302 FOUND
Server: gunicorn/18.0
Date: Mon, 28 Sep 2015 13:01:52 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 999
Location: https://dseasb33srnrn.cloudfront.net/registry-v2/docker/registry/v2/blobs/sha256/a3/a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4/data?Expires=1443445372&Signature=jGR026naoxUshm~NlXcWDqXv-ugJplaHCu8ur6bR0oQ5UVbq3cF4ociQc26GbyG-b3Wk~eqq~qSgSVmwt~Q-WJI2pak~UEsH1FiVQlXrDi1h5jW32PpqXbx5P563LQzo4TaqpyVv0Q492aG0zGvvy07iNEjRHkK8cxvbAR9qwS0_&Key-Pair-Id=APKAJECH5M7VWIS5YZ6Q
X-Docker-Registry-Version: 0.8.3
X-Docker-Registry-Config: prod
Strict-Transport-Security: max-age=31536000

HTTP/1.1 403 Forbidden
Server: CloudFront
Date: Mon, 28 Sep 2015 13:01:53 GMT
Content-Type: text/html
Content-Length: 622
Connection: keep-alive
X-Cache: Error from cloudfront
Via: 1.1 9cb7069f75bd5e93aca96cf4ab157188.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NYwHUVgcOIk_UBBxE6sHgR4gt1tcPJMmeWpBTei57RB2fLeDMCAvvQ==

I tested from 3 different data centers and all are blocked!
Did you guys enable the CloudFront's Geo Restrictions or intentionally blocked Iranian users?

@na3r
Copy link

na3r commented Sep 29, 2015

I have the same issue

This is the output from runnig docker pull command on linux

$ docker pull centos
Using default tag: latest
Pulling repository docker.io/library/centos
Error: Status 403 trying to pull repository library/centos: "<html><body><h1>403 Forbidden</h1>\nRequest forbidden by administrative rules.\n</body></html>\n\n"

@zarezadeh
Copy link

Same problem here, it seems docker hub banned all ips from iran. Why is that?

@parhamdoustdar
Copy link

Same here. This seems to have happened recently?

@jawnsy
Copy link

jawnsy commented Oct 4, 2015

On the mailing list (https://goo.gl/52fp8W), Solomon @shykes notes that this is a result of a legal restriction given that:

a) Docker Inc. is a US-based company; and
b) Trade with Iran is restricted according to US Law

It's understandable that Docker must abide by the laws of the United States, however, perhaps a more detailed/descriptive error message would help here.

@siavashs
Copy link
Author

siavashs commented Oct 5, 2015

@jawnsy thanks for clarifying this issue.

@shykes I think these restriction are wrong for following reasons:

  1. Docker is an open source project and this move is against the spirit driving the open source community.
  2. Docker hub is a repository, I'm not a lawyer but I think Docker Inc. does not own the docker images, it only hosts them.
  3. You are not trading the docker images with Iranians.
  4. You can let the users choose to limit the availability of docker images, like SourceForge, Apple Store and Google Play Store do.
  5. You are too late. After all these years, you decided to ban us just after a deal has been reached and sanctions are being lifted.

@jawnsy
Copy link

jawnsy commented Oct 5, 2015

Siavash @siavashs,

I'm not a lawyer but I think Docker Inc. does not own the docker images, it only hosts them.
You are not trading the docker images with Iranians.

Probably none of us here are attorneys, hence why we're the wrong people to be making this sort of call. While this is certainly inconvenient, there's no reason to believe that Docker Inc was acting in bad faith when it chose to impose this restriction: perhaps a lawyer has advised them to make this change, or maybe they've made the change to err on the safe side while they discuss with qualified legal professionals.

That said, I agree with you and think this decision should be reconsidered. Given that Docker is open sourced under one of the most permissive licenses out there, they clearly have an interest in having the largest userbase possible. However, sometimes technical folks like us are forced to do things that we disagree with, for legal reasons -- it would not serve the rest of Docker's userbase, either, if Docker Inc were to get into legal trouble over this.

@ashkang
Copy link

ashkang commented Oct 5, 2015

I think there is a revised version of General License D issued by Treasury Department’s Office of Foreign Assets Control, according to which such sanctions and restrictions are lifted. I can't be sure of this matter, but this is what one understands from the text itself (section a3): http://www.treasury.gov/resource-center/sanctions/Programs/Documents/iran_gld1.pdf

It'd be awesome if these matters could be communicated with Docker Inc. legal team somehow, if they're willing to dedicate some time, dive a bit deeper into this legal issue and make a helpful decision as it's causing an awful lot of trouble for people actively using this project and are residing in Iran.

@behnam-marandi
Copy link

Please reconsider this decision. It is not fair.

@siavashs
Copy link
Author

siavashs commented Oct 5, 2015

As I checked you have also blocked access to https://hub.docker.com/ website.
The website was reachable when I opened this issue last week.
Not cool.

@remohammadi
Copy link

This is a legal issue, and like @ashkang, I beleive it should be solved when the legal team of docker review the General License D document. I believe the legal team doesn't check github!

Can a project collaborator please link us to the legal team, and also ask them about a more descriptive reason on this blockage? There are different sanction acts, and most of them are related to financial transactions and shipment insurance. There is no general sanction banning all type of interactions between Iranians and the other people on the planet earth.

@MohammadsM
Copy link

Same for me :(
I'm using docker on ubuntu snappy
it's a bout few days my apps on docker are not working
"...Since Docker is a US company, we must comply with us export control regulations. In an effort to comply with these, we now block all IP addresses that are located in Cuba, Iran, North Korea, Sudan, and Syria. ..."
I'm a developer, not a terrorist or even a soldier
Hope this madness soon get finished

@na3r
Copy link

na3r commented Oct 15, 2015

Hi mohammad

you can setup your own registery on a server outside of iran and mirror it
to hub.docker.io
its easy to setup :)

On Thu, Oct 15, 2015 at 9:40 PM, Mohammad Moradi notifications@github.com
wrote:

Same for me :(
I'm using docker on ubuntu snappy
it's a bout few days my apps on docker are not working
"...Since Docker is a US company, we must comply with us export control
regulations. In an effort to comply with these, we now block all IP
addresses that are located in Cuba, Iran, North Korea, Sudan, and Syria.
..."
I'm a developer, not a terrorist or even a soldier
Hope this madness soon get finished


Reply to this email directly or view it on GitHub
#369 (comment)
.

Best Regards
Naser Kholghi
http://kholghi67.blog.ir

@MohammadsM
Copy link

Hi Naser
Thanks for the replay
But is there any way to run local apps?
:(

@na3r
Copy link

na3r commented Oct 15, 2015

what do you mean by local apps?

On Thu, Oct 15, 2015 at 11:02 PM, Mohammad Moradi notifications@github.com
wrote:

Hi Naser
Thanks for the replay
But is there any way to run local apps?
:(


Reply to this email directly or view it on GitHub
#369 (comment)
.

Best Regards
Naser Kholghi
http://kholghi67.blog.ir

@MohammadsM
Copy link

I have owncloud image in my ubuntu
but docker will not run it

Docker is jammed (no pull, no run)

@24js
Copy link

24js commented Nov 1, 2015

restriction is a violation of Section 5 of the open source definition which states licenses must not discriminate "against any person or group of persons."

Seems docker is following some closed source limited to group of persons terms of service
The laws deal primarily with U.S. export control regulations , Also I'd like to point out there are plenty of American based services that are not blocking IPs from these ( iran , syria , sudan, etc ) countries, which makes me believe this is more of a choice rather than a force of law In which case, this would not only be breach of the GPL license terms but also it could be considered as a racism act in my opinion, since its choosing to block out people based on their nationality or place of residency.

Hope docker realize that, i did dropped using docker entirely which was such a pain after developing my entire dev platforms on top of that , but after a while i found rocket and i definitely encourage people to use that instead of docker "Docker process model - where everything runs through a central daemon - is fundamentally flawed."

There is a lot of new implementations and none of them blocking Iran , do your research and find whats best for you flockport , rocket , ...

https://coreos.com/blog/rocket/
https://www.flockport.com/

@arastu
Copy link

arastu commented Jan 17, 2016

International prohibition against Iran lifted, and now you can remove Iran from your blocking list.

@schmunk42
Copy link

If this is still a problem you could work around this issue by setting up a cache in another country, from which you can pull in Iran, see https://github.com/docker/distribution/blob/master/docs/mirror.md

@remohammadi
Copy link

Statement Relating to the Joint Comprehensive Plan of Action “Implementation Day” of January 16, 2016: https://www.treasury.gov/resource-center/sanctions/Programs/pages/iran.aspx

I believe this statement will satisfy even the most conservative lawyers that providing Docker hub services to Iranians is completely legal now.

I know it may not be like a high priority task for your team to review the statement and undo the blocking, but please consider it as a symbol of respect for minorities in your great community 😄

Thank you very much
@shykes

@maysam
Copy link

maysam commented Feb 8, 2016

I think if we're not purchasing, it's not a trade and hence doesn't fall under any sanctions, even if there is one that would apply

@Dev-l0p
Copy link

Dev-l0p commented Mar 15, 2016

دوستان از تحریم درومدیم حالا هنوز نمیتونیم از داکر استفاده کنیم ؟
اگه راهی برای دور زدن هست لطفآ به من هم بگین .
خیلی ضروریه .

@maysam
Copy link

maysam commented Mar 16, 2016

@clacki ازین تحریما در نیومدیم

@Dev-l0p
Copy link

Dev-l0p commented Mar 16, 2016

@meysam https://groups.google.com/forum/#!topic/software-taak/xRmFWrozRoo
اینجا رو ببینید . فکر کنم یه کاری کرده دور زده .
اما چون من تازه واردم و با نسخه کامنت لاین کار میکنم نفهمیدم درست چه کنم؟
این کار عملیه ؟

@maysam
Copy link

maysam commented Mar 16, 2016

@clacki jalebe, dastet dard nakone, test nakardam vali bayad kar kone

@Dev-l0p
Copy link

Dev-l0p commented Mar 16, 2016

@meysam تونستی به منم یاد بده چیکار کنم .
ایمیل یاهو و اسکایپ ویا ... داری ؟بفرست

@maysam
Copy link

maysam commented Mar 16, 2016

it's @maysam not @meysam

hala to sal e jadid ishala test mikonam bebinam chetor mishe

@vahobrsti
Copy link

vahobrsti commented Apr 14, 2016

For those who are still looking for a way to work with Docker and have problem with pulling images from docker hub, I solved my problem with the following solution:
OS: Ubuntu 15.10
Docker Version: 1.11.0

Open your Terminal and enter the following command:
sudo gedit /etc/default/docker
then add this line to the file
DOCKER_OPTS="--registry-mirror https://docker.mirrors.ustc.edu.cn"
save the file, close the editor and then enter the following commands:
sudo mkdir -p /etc/systemd/system/docker.service.d
then
sudo gedit /etc/systemd/system/docker.service.d/myconfig.conf
copy and paste following code:

EnvironmentFile=-/etc/default/docker
ExecStart=
ExecStart=/usr/bin/docker daemon -H fd:// $DOCKER_OPTS \


save, close and then enter the following commands:
sudo systemctl daemon-reload
then
sudo service docker restart
If everything goes well, then you'll be able to use docker images. Just to make sure that everything is fine, run the following command:
ps -ef | grep docker
you'll probably see something like:
root 6468 1 0 11:17 ? 00:00:01 /usr/bin/docker daemon -H fd:// --registry-mirror https://docker.mirrors.ustc.edu.cn
root 6473 6468 0 11:17 ? 00:00:00 docker-containerd -l /var/run/docker/libcontainerd/docker-containerd.sock --runtime docker-runc

I have figured this solution from the links other guys provided here. For other operating systems and linux distros , please view the docker's Documents for finding out about configuration and setting options.
https://docs.docker.com/engine/admin/configuring/
Side-bar:
This solution is likely to work on Ubuntu 15.04 as well.
Bests

@remohammadi
Copy link

The message has been updated a while ago:

403 Forbidden

Since Docker is a US company, we must comply with us export control regulations. In an effort to comply with these, we now block all IP addresses that are located in Cuba, Iran, North Korea, Sudan, and Syria. If you are not in one of these countries and are blocked, please reach out to https://support.docker.com

@hich9n
Copy link

hich9n commented May 14, 2016

some Google sanctions has been removed recently: http://developer.google.com and so on.
any improvement about docker??

@imehdihosseini
Copy link

Hey guys, i think according to U.S Department of the treasury, iran sanctions after 16 January 2016 is lifting as described on this document:

As a result of Iran verifiably meeting its nuclear commitments, the United States is today lifting nuclear-related sanctions on Iran, as described in the JCPOA.

Which refered as a "historic day", and now after 5 month we still have problem with docker and docker team does not respond to any of these comments.

@maysam
Copy link

maysam commented Mar 12, 2017

check this out http://www.docker.ir/

@amiri27
Copy link

amiri27 commented May 28, 2017

@maysam Do you have any info regarding docker.ir? They have stopped their services suddenly..

@azzaea
Copy link

azzaea commented Jun 4, 2017

Update for those using Ubuntu 14.04:
OS: Ubuntu 14.04
Docker Version: 1.13.1

Proceed as in the solution of @vahobrsti, but note that all systemd commands (like systemctl daemon-reload) wouldn't work ( systemd is the init system of Ubuntu 15.04 and newer)

@araselahi
Copy link

For those who use Docker for Windows:

docker jpg

Many thanks to Docker.ir

@khanbaba
Copy link

khanbaba commented Nov 17, 2017

for Linux ubuntu 17.04
go to /etc/ docker/ and create a new json file with name "daemon.json" and add following lines:
{
"registry-mirrors":["http://repo.docker.ir:5000"]
}
then restart docker service.
It worked for me.
good luck.

@Martin-Smith2
Copy link

Martin-Smith2 commented Nov 18, 2017

Docker.ir doesn't seem to include some images
The best way is to use VPN.

@golnazsaraji
Copy link

Thank You for your question @siavashs and the solution of @araselahi worked for me! please enter your question on stackoverflow if it is not submitted before and tell us to rate it ;)

Thank you so much!

@ghost
Copy link

ghost commented Mar 20, 2018

@AmmarRajab
Copy link

Hello guys,

I'm trying also to build a docker image and I'm getting the restriction message (I'm from Syria), I am using docker toolbox on Windows and I tried the Chinese docker mirrors "https://docker.mirrors.ustc.edu.cn" and "https://registry.docker-cn.com" by updating the config.json file and restarting the machine "docker-machine restart default" but I get same error, I also tried the Iranian mirror mentioned above but still same error. I'm new to docker and I'm looking for help.

@dfaramarzi
Copy link

Hello guys,

I'm trying also to build a docker image and I'm getting the restriction message (I'm from Syria), I am using docker toolbox on Windows and I tried the Chinese docker mirrors "https://docker.mirrors.ustc.edu.cn" and "https://registry.docker-cn.com" by updating the config.json file and restarting the machine "docker-machine restart default" but I get same error, I also tried the Iranian mirror mentioned above but still same error. I'm new to docker and I'm looking for help.

I have the same problem, None of them worked for me, But I am still trying...

@dfaramarzi
Copy link

I tried https://shecan.ir/, Change the DNS Server addresses to 178.22.122.100 for preferred DNS server and 185.51.200.2 for Alternate DNS server.

@AmmarRajab
Copy link

Thanks for your reply, it's appreciated

I found another workaround as well, I'll mention a link to it here, it might also be useful.

https://gist.github.com/aliva/06cb2e0d7a2a5990d4d682dab57fb302#gistcomment-2995333

@neo-apz
Copy link

neo-apz commented Oct 7, 2019

The last comment is vulgar, very disrespectful toward a group of people and contains racial hate speech. It should be removed and the user should be reported!

@salemkha
Copy link

salemkha commented Oct 12, 2019

The last comment is vulgar, very disrespectful toward a group of people and contains racial hate speech. It should be removed and the user should be reported!

داداش با پول بابایی سویس حال میده ؟
خدا میدونه بابات چقد اختلاس کرده یا چند نفرو کشته که توی تفاله رو فرستاده اونور
معلم اخلاق! بیا روش

@wincwe
Copy link

wincwe commented Oct 13, 2019

Don't Use docker.ir They are Iranian government spies. The containers on docker.ir have virus and spyware on them.

@uigtfiro
Copy link

uigtfiro commented Oct 13, 2019

من از اینکه چرا ایران رو فیلتر کردن خبر دارم
به خاطر افغانی هایی هست که تو داکر کار میکنن
اگه این چهار تا افغانی رو زمانی که تو ایران بودن و داشتن ادم میشدن میگاییدیم و بهشون تحویل میدادیم این اتفاق نمی افتاد

هر کی به این تامپ اپ میده حسابش فلگ میشه ولی خود نظر پاک نمیشه
مثلا تله درس کردن
خودتونید

@iudgfis
Copy link

iudgfis commented Oct 13, 2019

اینجا رو اینستا نکنید بسه دیگه

@mjzarrin
Copy link

Hey Docker!
Shame on YOU and every other nominate OpenSource projects which helps to crucial restriction on a group of humans.
You are Fake Open Source.
We would never forget this.

@kamysheblid
Copy link

@mjzarrin
Somewhere I saw people saying to use http://docker.ir/. I tried to setup mirroring using that site but I continue to get rate-limited. I found a faster and less hacky way of getting around the western blocking.

Thankfully the Chinese host these images in multiple repositories, and unlike the westerners the Chinese are not hellbent on terrorizing us at every opportunity. They are freely hosting these repos as our friends. Make sure to remember this favor from them.

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF'
{
    "registry-mirrors": [
        "https://1nj0zren.mirror.aliyuncs.com",
        "https://docker.mirrors.ustc.edu.cn",
        "http://f1361db2.m.daocloud.io",
        "https://registry.docker-cn.com"
    ]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

source: https://developpaper.com/docker-hub-mirror-accelerator/

The instructions for those with SysV instead of systemd are the same, except instead of doing sudo systemctl daemon-reload; sudo systemctl restart docker you simply do sudo service docker restart. Make sure to also run sudo service docker status to check that it loaded the docker daemon correctly.

اگر به کمک نیاز دارید ، در صورت تمایل به من پیام دهید
فارسی من هنوز خیلی خوب نیست ، اما سعی می کنم به هموطنانم کمک کنم

@github-actions
Copy link

We are clearing up our old issues and your ticket has been open for 6 months with no activity. Remove stale label or comment or this will be closed in 15 days.

@mahdi-ln
Copy link

I tried with PIA VPN and most of times it doesn't work for docker. I purchased it to support Archlinux (Affiliates page)
If I use these Chinese mirrors still it would check for Docker Inc. signature in images?

@ingshtrom
Copy link
Collaborator

@mahdi-ln what Chinese mirrors are you referring to? Our mirrors in China are no longer running, AFAIK.

@kazemmdev
Copy link

@mjzarrin Somewhere I saw people saying to use http://docker.ir/. I tried to setup mirroring using that site but I continue to get rate-limited. I found a faster and less hacky way of getting around the western blocking.

Thankfully the Chinese host these images in multiple repositories, and unlike the westerners the Chinese are not hellbent on terrorizing us at every opportunity. They are freely hosting these repos as our friends. Make sure to remember this favor from them.

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF'
{
    "registry-mirrors": [
        "https://1nj0zren.mirror.aliyuncs.com",
        "https://docker.mirrors.ustc.edu.cn",
        "http://f1361db2.m.daocloud.io",
        "https://registry.docker-cn.com"
    ]
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker

source: https://developpaper.com/docker-hub-mirror-accelerator/

The instructions for those with SysV instead of systemd are the same, except instead of doing sudo systemctl daemon-reload; sudo systemctl restart docker you simply do sudo service docker restart. Make sure to also run sudo service docker status to check that it loaded the docker daemon correctly.

اگر به کمک نیاز دارید ، در صورت تمایل به من پیام دهید فارسی من هنوز خیلی خوب نیست ، اما سعی می کنم به هموطنانم کمک کنم

Thank you @kamysheblid it's worked for me

@moslemezzati
Copy link

moslemezzati commented Mar 3, 2023 via email

@unnaturalistic
Copy link

as a none Iranian team this is very sad that our fellow devs cannot use this tool. we will try our best to make a work around for this

-from NETFREEDOM team

@TimurShaidulin
Copy link

We're tired of all docker bs, they are anything but open source project now. We decided to move to podman.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests