Docker Hub blocked in Russia: docker pull failing, mirrors and VPN in 2026

On 30 May 2024 Docker Hub suddenly stopped responding from Russia: docker pull failed with 403 and hub.docker.com showed a stub page. Docker cited US export rules; a few days later access returned for most Russian addresses, but since then it's been like the weather: on some ISPs everything works, on others pulls time out, and corporate CI pipelines die mid-build. Here's what to do in 2026: mirrors, VPN and daemon configuration.

Quick fix. On your work laptop turn on Surok: Docker Hub, GitHub and npm go through Europe while Russian sites stay direct. Three days free, then from 220 ₽ a month. For servers, see the mirror option below.

What happened to Docker Hub

Docker, as a US company, must comply with US export controls. In May 2024 it announced it was blocking addresses in Cuba, Iran, North Korea, Crimea, Sudan and Syria, but all of Russia got caught: pulls and the site failed for several days, even through some VPNs. Earlier still, Docker had closed paid subscription purchases and renewals for Russia.

A week later access came back for most people, but Docker never promised it was permanent. In our check on 14 October 2026 from a server in Moscow, hub.docker.com and registry-1.docker.io responded normally. Yet reports of broken pulls from Russia keep appearing, especially on corporate ISPs and in the regions.

How to tell it's an access problem

Typical symptoms:

• Error response from daemon: Get "https://registry-1.docker.io/v2/": dial tcp ... i/o timeout;
• 403 Forbidden on a registry request;
• a large image pull stops on one layer and hangs;
• hub.docker.com doesn't open while GitHub does.

Try another ISP or a VPN. If everything works through the VPN, the route is the problem, not Docker.

Option 1. Docker Hub mirrors

For servers and CI the right path is a registry mirror that answers from Russia. As of autumn 2026 public mirrors are run by Yandex Cloud, GitVerse by SberTech, Timeweb and several hosters. Configure /etc/docker/daemon.json:

{
  "registry-mirrors": [
    "https://mirror.gcr.io",
    "https://dockerhub.timeweb.cloud",
    "https://cr.yandex/mirror"
  ]
}

Then sudo systemctl restart docker. Docker tries the mirrors in order and falls back to Docker Hub itself if they fail. Downsides: mirrors don't cache everything, rare images and fresh tags may come slowly or be missing, and private repositories don't work through a mirror.

Option 2. A VPN on the workstation

On a developer's laptop it's simpler to turn on a VPN: Docker Hub, GitHub, npm, PyPI and other registries then go through a foreign address with no config edits. The VPN must route Russian sites directly, otherwise Yandex, banks and corporate services start complaining about a foreign IP. Surok is built that way: Russian domains bypass the tunnel, foreign ones go through Europe, traffic is unlimited. Check your address on the IP page.

On Mac and Windows, Docker Desktop uses the system VPN automatically. On Linux use the Surok app or a system client with the config from the cabinet.

Option 3. A VPN on the server

If CI or a production server sits in Russia and pulls fail, you can send only Docker's traffic through the VPN: set an HTTP proxy for the daemon in /etc/systemd/system/docker.service.d/proxy.conf with HTTP_PROXY and HTTPS_PROXY pointing to the VPN client's local proxy. The server's other traffic stays unchanged. For production, though, your own registry mirroring the images you need is more reliable: a build that depends on someone else's access will break a deploy sooner or later.

What else breaks for developers

Docker Hub isn't the only dependency restricted for Russia. GitHub is periodically throttled by carriers at the DPI level, npm and PyPI work but their CDNs are slow from Russia, and Intel and NVIDIA have closed downloads of some drivers and SDKs for Russian addresses. See zapret for Discord, YouTube and GitHub and VPN for PC.

FAQ

Is Docker Hub blocked in Russia? Not by Roskomnadzor. Docker itself restricted access in May 2024; it now works for most people, but unreliably.

Does docker pull work through a VPN? Yes, through any VPN with a foreign exit.

Can I buy Docker Pro from Russia? No, Russian cards aren't accepted and subscriptions for Russia are closed.

What's most reliable for production? Your own registry mirroring the images you need. Mirrors and a VPN for development and CI.

In short

Docker Hub from Russia has been unreliable since May 2024. For servers configure mirrors in daemon.json; for a laptop turn on Surok, and pulls go through Europe while Russian sites stay direct. Three days free.