What should I do if the Docker image cannot be downloaded from the NAS? When I installed Immich, it got stuck for 37 minutes and timed out three times. I tried all the possible ways, but these two are the only ones that are stable.

Last month, I wanted to install an Immich tube photo for my wife on Feiniu. I clicked Install in the application center. The progress circle scrolled for 37 minutes, and finally a line of red text popped up.: timeout. I tried again for the second time and changed the Jellyfin image in the container. This time it was more straightforward and the TLS handshake timeout was reported immediately after two minutes. The machine is not broken, the network is not disconnected, and the internal network speed is very good, but the image cannot be pulled down. That night I worked from 8 o'clock to 12:30, trying all the methods I could find. This article is the pitfall record - let me talk about the conclusion first.: The accelerator-changing path taught online has a very low probability of being successful in 2026. Don’t waste your time on it. .

First figure out which step you are stuck at, so that you don’t get the wrong medicine.

There is more than one kind of circle timeout. I later learned to look at the last line of the error report first. The location of the card was different, and the root cause of the problem was completely different.:

• pull timeout, TLS handshake timeout, EOF: This is The mirror warehouse cannot be connected , the network layer, this article mainly talks about this.
• manifest unknown, tag not found: The image name or label is wrong. Check whether latest is spelled as ltest in the command you copied.
• no space left on device: When the disk is full, clean up the old image first. My 4T Feiniu was once filled with an 11G floating image.
• The pull is successful but the container cannot be started.: That's another matter. Issues of configuration, port, and mounting. I mentioned it before The article about troubleshooting if the container cannot be opened I wrote in, don’t waste your time here.

Immich The first mistake I made that time was not to read the error report. There is only one line for timeout in the Feiniu interface. I thought the NAS performance was not good enough, so I almost restarted the system in the background. Later, I went in through SSH and manually typed the command to see clearly that the TLS handshake was not completed - the warehouse door was not even opened, and it had nothing to do with the N100 at home.

Why is changing the accelerator less and less effective?

Search for "docker pull timeout" and you will find nine out of ten articles for you to change. daemon.json Add registry-mirrors and a string of accelerator addresses. This method is correct in itself, but the problem lies in the shelf life of those addresses. my own experience: Several university sources and public welfare sources that can still be used in 2024 will be closed one after another by 2025. ； Another batch will be dumped in mid-2025 ； On the night I installed Immich, eight of the ten addresses posted in the tutorials I could search for were no longer responding.

The reason is not complicated. Docker Hub's direct connection in China is intermittent. The essence of public accelerators is that someone has built a transit channel at their own expense. If the number of users increases, the bandwidth cannot handle it, or they simply receive a shutdown notice. So if you look at the accelerator address, The tutorial is written to be alive on that day, but it may not be that day when you see it. . I've suffered this loss: According to a post from early 2025, I configured three sources and restarted the Docker service. As a result, none of them worked, and I wasted 40 minutes in vain.

But the accelerator path is not to be completely abandoned. The key is not to copy the address, but to learn Test before matching . a matter of command:

curl -s -o /dev/null -w "%{http_code} %{time_total}s" https://候选地址/v2/

It can be used if it returns 200 or 401 (401 is normal, the warehouse requires authentication, but it means that the channel is alive). If it returns 000 or times out for a few seconds, skip it directly. The night I installed Immich, I later tested the two sources. After pairing them, the image did indeed move. The speed was about 2MB/s, which was bearable. But I know the ceiling of this method: Next month these two sources will be down, and I will have to do it all over again. So the latter two paths are what I want to take advantage of.

Stupid but very stable road: Moving images manually

It was one of the last practices I settled on. The idea is very crude: If you can't pull it at home, use a computer with Internet access to pull it, and then move the files back to the NAS.

The Windows computer in my study has an agent installed, Docker Desktop is installed, and pull is stress-free.:

docker pull immich-app/immich-server:release docker save immich-app/immich-server:release -o immich.tar

The tar file saved by docker, Immich's server image is 1.2G, copy it to the NAS via SMB on the intranet, and then SSH into it to load it.:

docker load -i immich.tar

After loading the docker images, there will be this image in it. Return to the Feiniu interface to create the container, and everything will be as usual. The whole process may feel tedious the first time you run it, but it will go smoothly the second time. What took 37 minutes to spin around in circles was solved in 6 minutes . The only trouble is that applications like Immich, which have a set of multiple containers, have to be moved one by one. The components of machine translation and ML add up to five packages, and I moved them three times that night.

There is another detail that I only know after stepping through it.: When saving, the image name must be written in full, including the warehouse name and tag. The name must be correct when loading. If the abbreviation is used when pulling, it will become a dangling image without a warehouse name when loaded. It cannot be found in the interface when creating a container, and the name must be filled in by docker tag.

The road to peace once and for all: Own transit warehouse

There is a residual problem with the transportation method: Change the NAS, reinstall the secondary system, or upgrade the container (yes, Container upgrade If you want to pull a new image), you have to move it again. Later, I upgraded the solution to my own transit warehouse and used Alibaba Cloud's container image service personal version for free.

The process is like this: Pull it on the computer and push it to my personal warehouse or NAS. daemon.json I configured this warehouse as a trusted address. In the future, the NAS will be pulled directly from my own warehouse, using Alibaba Cloud's domestic nodes. The speed is stable and compared with public accelerators. This is a channel in your own name. There is no chance that it will be suddenly closed by someone one day. .

docker pull immich-app/immich-server:release docker tag immich-app/immich-server:release registry.cn-hangzhou.aliyuncs.com/我的命名空间/immich-server:release docker push registry.cn-hangzhou.aliyuncs.com/我的命名空间/immich-server:release

When the NAS side pulls, it uses the address of its own warehouse and connects in seconds. The personal version has a limitation on the number of warehouses and some functions in the namespace, which is enough for home use. I transferred a dozen commonly used images and spent half a night on it. I have never cared about the accelerator since then. My cousin installed Home Assistant on his Synology DS920+ last month with the same karaoke image. I moved this set over and it was done in ten minutes. He said he would have known better and would not have searched for those tutorials.

For the configuration to take effect, you need to move the configuration file of the Docker service. Feiniu and Synology have different locations, which is also a pitfall.:

Before changing the configuration, make sure that the json format is not broken. If there is a missing comma, the Docker service will not start, and all containers will be stuck. The first time I changed it, I lost the square brackets of insecure-registries. Fortunately, SSH was still connected and I copied the backup file back to save it. Before changing any system configuration, cp a copy of .bak. This is my rule for exchanging blood.

The order of decision-making given to you, don’t follow the order in which I stepped on the trap.

My path that night was actually: Change the accelerator (40 minutes of failure), search for new tutorials to change the accelerator (40 minutes of failure), give up treatment and sleep, carry it manually the next day (success), and build your own warehouse in the third week (once and for all). If you were stuck here today, it would be much more efficient to walk backwards:

• First check the error report to confirm that it is a pull problem, not a container configuration problem. Don’t treat the wrong problem.
• Have a computer with normal Internet access at hand: Directly docker save and load, it will be solved in ten minutes, don't compete with the accelerator.
• Pulling a mirror will happen every three months.: Register an Alibaba Cloud personal image warehouse and transfer commonly used images into it. daemon.json Point to the past, and be quiet from now on.
• Only if the computer can't pull it, then test the public accelerator. Remember to use the curl command to test first and then configure it. Don't copy the dead address in the tutorial.

Finally, to be honest, the difficulty of pulling images with Docker is actually a tax shared by all domestic players. It is not a problem with your NAS, nor is it a misconfiguration. Just pick a stable road and go around it. Wouldn't it be nice to save time by looking at the photo wall? I am here Docker concept article I mentioned what mirrors are here, and with the moving methods in this article, novices can also take this path.