How do I configure firewall for GitHub Container Registry

[lpc921]

Select Topic Area

Question

Body

When running docker pull from GitHub Container Registry, I got the following message:
Download failed, retrying (2/5): dial tcp 185.199.111.154:443: i/o timeout

We have allowed ghcr.io and *.github .com in the firewall.

If I reverse loop up the IP address and run curl https://cdn-185-199-109-154.github.com, then the docker pull works

How should the firewall be configured to make docker pull work seamlessly with GHCR? Or maybe there is a docker daemon config to force a DNS lookup?

[KittyChiu]

There are more addresses for GitHub Packages. Use Meta API and navigate to packages node to get the latest list of addresses for whitelisting.

At the time of typing this comment, the list is

        "packages": [
            "mavenregistryv2prod.blob.core.windows.net",
            "npmregistryv2prod.blob.core.windows.net",
            "nugetregistryv2prod.blob.core.windows.net",
            "rubygemsregistryv2prod.blob.core.windows.net",
            "npm.pkg.github.com",
            "npm-proxy.pkg.github.com",
            "npm-beta-proxy.pkg.github.com",
            "npm-beta.pkg.github.com",
            "nuget.pkg.github.com",
            "rubygems.pkg.github.com",
            "maven.pkg.github.com",
            "docker.pkg.github.com",
            "docker-proxy.pkg.github.com",
            "containers.pkg.github.com",
            "*.github.com",
            "*.pkg.github.com",
            "*.ghcr.io",
            "*.githubassets.com",
            "*.githubusercontent.com"
        ],

[lpc921]

Thanks for your answer. I needed to whitelist pkg-containers.githubusercontent.com