Can we optimize download speed in mainland China

[MichaelSimons]

Copied from dotnet/dotnet-docker#1269 by ZhangGaoxing

Steps to reproduce the issue

Every time I pull a image from mcr.microsoft.com, the speed is very slow(about 200k/s). It's painful
☹. Other products download speed of .NET are normal, such as direct from .NET homepage download installation package.

[rotata]

We will look at this right away and update you shortly. Could you provide us some logs around the usage.

[expcat]

This is my docker pull information.

PS C:\> docker pull mcr.microsoft.com/dotnet/core/sdk:3.1
3.1: Pulling from dotnet/core/sdk
dc65f448a2e2: Pulling fs layer
346ffb2b67d7: Downloading [===>                                               ]  489.6kB/7.812MB
dea4ecac934f: Downloading [=>                                                 ]  342.2kB/9.996MB
8ac92ddf84b3: Waiting
d6bef01952b9: Waiting
9311becdb99f: Waiting
cdbf4d78a668: Waiting
error pulling image configuration: Get https://mcrea0.cdn.mscr.io/b29889755b1f4e46b6b44eb3182530c5-0joxcrfl25//docker/registry/v2/blobs/sha256/0a/0a4c7c13f9d63ac865ae05b9253eda176556b748ab87cfbc59ca45b5a8beff9b/data?P1=1581968369&P2=1&P3=1&P4=FSwgCGN3ter9PmlpK9LN27dMwIN3WYFXV4X0oKhBN20%3D&se=2020-02-17T19%3A39%3A29Z&sig=W3x5AjBpCbXHXP1Y0T1NlOg2OeI63Dc%2FS6dS7LhOWD8%3D&sp=r&sr=b&sv=2016-05-31&regid=b29889755b1f4e46b6b44eb3182530c5: net/http: TLS handshake timeout
PS C:\> ping mcrea0.cdn.mscr.io

正在 Ping a-0016.a-msedge.net [204.79.197.219] 具有 32 字节的数据:
请求超时。   <-- timeout
请求超时。   <-- timeout
来自 204.79.197.219 的回复: 字节=32 时间=51ms TTL=117
来自 204.79.197.219 的回复: 字节=32 时间=51ms TTL=117

204.79.197.219 的 Ping 统计信息:
    数据包: 已发送 = 4，已接收 = 2，丢失 = 2 (50% 丢失)，  <--50% lost
往返行程的估计时间(以毫秒为单位):
    最短 = 51ms，最长 = 51ms，平均 = 51ms 

docker logs

[03:19:20.753][ApiProxy          ][Info   ] time="2020-02-18T03:19:20+08:00" msg="proxy >> HEAD /_ping\n"
[03:19:20.754][ApiProxy          ][Info   ] time="2020-02-18T03:19:20+08:00" msg="proxy << HEAD /_ping (1.0004ms)\n"
[03:19:22.647][ApiProxy          ][Info   ] time="2020-02-18T03:19:22+08:00" msg="proxy >> POST /v1.40/images/create?fromImage=mcr.microsoft.com%2Fdotnet%2Fcore%2Fsdk&tag=3.1\n"
[03:19:22.648][VpnKit            ][Info   ] vpnkit.exe: Connected Ethernet interface f6:16:36:bc:f9:c6
[03:19:22.650][APIRequestLogger  ][Info   ] [1f5dc5cd] <Server start> POST http://unix/usage
[03:19:22.650][APIRequestLogger  ][Info   ] [1f5dc5cd] <Server end> POST http://unix/usage -> 200 OK (took 0ms)
[03:19:22.648][VpnKit            ][Info   ] vpnkit.exe: UDP interface connected on 192.168.65.1
[03:19:22.906][VpnKit            ][Info   ] vpnkit.exe: Connected Ethernet interface f6:16:36:bc:f9:c6
[03:19:22.906][VpnKit            ][Info   ] vpnkit.exe: UDP interface connected on 13.75.34.159
[03:19:26.995][VpnKit            ][Info   ] vpnkit.exe: Connected Ethernet interface f6:16:36:bc:f9:c6
[03:19:26.995][VpnKit            ][Info   ] vpnkit.exe: UDP interface connected on 204.79.197.219
[03:19:39.624][ApiProxy          ][Info   ] time="2020-02-18T03:19:39+08:00" msg="proxy << POST /v1.40/images/create?fromImage=mcr.microsoft.com%2Fdotnet%2Fcore%2Fsdk&tag=3.1 (16.9766979s)\n"
[03:19:39.625][ApiProxy          ][Info   ] time="2020-02-18T03:19:39+08:00" msg="Cancel connection..."

[kkbruce]

China Internet is special, especially GFW. It's not easy.

[LiangZugeng]

I think there are two ways to solve the problem:

1. Microsoft adds MCR CDN nodes in China or in Hongkong where the access speed is acceptable from China mainland.
2. For each every docker image hosted in MCR, Microsoft publishes a public image, which simply uses its MCR version as the image in Dockerfile but nothing else, on Docker hub, so docker registry mirrors in China (like docker CN or Aliyun docker mirrors) can pick those images up and sync to servers in China mainland.

The first solution is preferred but I'm not sure if CDN nodes can be added considering Chinese government requires a local registered domain name to leverage CDN nodes in China (apparently mcr.microsoft.com is not a local registered domain in China), but Microsoft may come up with other means as workarounds.

The second way requires additional Dockerfile files to be produced by Microsoft but I guess it can totally be automated, actually ElasticSearch uses this technique to generate public images on Docker Hub, see their Dockerfile (https://github.com/docker-library/elasticsearch/blob/master/7/Dockerfile).

[wjsgzcn]

why don't microsoft place a copy on docker hub? then we can use mirrors in china to get the images.

[bariscaglar]

The whole point of Microsoft Container Registry is to be a trustable endpoint for official Microsoft container images. Mirroring them elsewhere defeats this core purpose. That said, we understand the pain of low download speeds and are looking into ways to make the experience better.

[shikelong]

+1.

[taoyouh]

mcr.microsoft.com is very very slow. However, nuget.org is much faster.

[taoyouh]

Microsoft Store installation, Windows Update, NuGet package restoring and Visual Studio Installation are all much faster than pulling from mcr.microsoft.com in my network environment. This issue has a critical impact on the usability of Microsoft Container Registry.

[PMExtra]

Since last week, Azure disable mcr.azk8s.cn from Public Internet. We can't find any alternative.
Could you make a consultation with Azure China?

[jackytse]

I can't pull image from mcr.azk8s.cn. any other mirrors?

[dorthl]

+1

[stratosblue]

Is anybody there? Help the kids!!!

[toddysm]

To update this thread - we are evaluating options to have a MCR replica in China region. It will take a while but we will try to keep you updated.