Tell HN: docker pull fails in spain due to football cloudflare block

514 points - today at 12:28 PM


I just spent 1h+ debugging why my locally-hosted gitlab runner would fail to create pipelines. The gitlab job output would just display weird TLS errors when trying to pull a docker images. After debugging gitlab and the runner, I realized after a while I could not even run "docker pull <image>" on my machine as root:

> error pulling image configuration: download failed after attempts=6: tls: failed to verify certificate: x509: certificate is not valid for any names, but wanted to match docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com

First blaming tailscale, dns configuration and all other stuff. Until I just copied that above URL into my browser on my laptop, and received a website banner:

> El acceso a la presente direcciĂłn IP ha sido bloqueado en cumplimiento de lo dispuesto en la Sentencia de 18 de diciembre de 2024, dictada por el Juzgado de lo Mercantil nÂş 6 de Barcelona en el marco del procedimiento ordinario (Materia mercantil art. 249.1.4)-1005/2024-H instado por la Liga Nacional de FĂştbol Profesional y por TelefĂłnica Audiovisual Digital, S.L.U. https://www.laliga.com/noticias/nota-informativa-en-relacion-con-el-bloqueo-de-ips-durante-las-ultimas-jornadas-de-laliga-ea-sports-vinculadas-a-las-practicas-ilegales-de-cloudflare

For those non-spanish speakers: It means there is football match on, and during that time that specific host is blocked. This is just plain madness. I guess that means my gitlab pipelines will not run when football is on. Thank you, Spain.

Comments

danirod today at 2:31 PM
Heh, lucky you, at least you get a message. My ISP just drops traffic to the affected IPs. No ping, no traceroute, just a spinner in the browser until it says "page not found".

Every response and comment from LaLiga, the football organization responsible for this, has been so far that this is a minor issue that only affects a few bunch of nerds who talk about "docker images" or "github repositories" or "whatever that means".

Meanwhile, there are testimonies of smart home devices like anti-theft alarms or automatic doors, that stop working whenever there is a football match, because their backends rely on Cloudflare.

Last week, a woman asked for help on social media, as the GPS tracking app she uses to see where her father with dementia is, went offline during a match. It was getting late and he still wasn't back home, and she couldn't locate the tag he was wearing to find him: https://www.infobae.com/america/agencias/2026/04/05/laliga-d...

It's hard to say this, because no one should experience an event like this, but as stressful as these are, it's the only way to make the mainstream people care about this censorship. "I cannot pull a docker image" will never be on nightly news, but safety and personal security is a more powerful driver for discourses.

utrack today at 1:44 PM
They block the whole of Cloudflare R2, I believe the Docker hub is just (heh) a collateral.

When the La Liga match starts, everything that's proxied via CF (including zero access reverse tunnels) stops working.

There's even a website made for checking if the match is on: https://hayahora.futbol/

You can check if your host is affected: https://hayahora.futbol/#comprobador&domain=docker-images-pr...

mrvaibh today at 2:49 PM
This is a great example of why blanket IP blocking is such a terrible enforcement mechanism. Cloudflare hosts hundreds of thousands of services behind shared IP ranges — blocking one IP to stop a piracy stream takes out everything else on that IP, including Docker registries, API endpoints, and CDNs that have nothing to do with football.

  The real fix on your end until Spain sorts this out: set up a pull-through registry cache (e.g. registry:2 with proxy.remoteurl) on a VPS outside Spain, and point your Docker daemon's mirror config at it. Your
  GitLab runner pulls from the cache, the cache pulls from Docker Hub via a non-blocked IP. Also insulates you from Docker Hub rate limits.

  But yeah, the fact that a court order about football streaming can break docker pull for an entire country is genuinely absurd.
jjcm today at 4:51 PM
Barring an Internet giant suing them in court, it really feels like this is unlikely to change as most just don’t understand the why or the effect.

Someone needs to write a heist movie set in Spain where a key part of the plan is they steal something while La Liga is blocking some key security route.

jcalvinowens today at 4:04 PM
This is the moral equivalent of shutting the water off for a whole city because one dude's house has a leak. The harms to society clearly and obviously outweigh any possible benefits to society. But if that one dude has the power to shut it all off, and doesn't care...
rcarmo today at 8:15 PM
Ah, so that's why my site is "down" there:

https://hayahora.futbol/#sobre-los-bloqueos&domain=taoofmac....

They're blocking the CDN too, not just R2.

torben-friis today at 4:04 PM
As a Spaniard, I would be very happy it cloudflare stops serving Spain. The situation is beyond stupid and I know without international pressure and shaming we're not getting rid of this abuse.
swiftcoder today at 6:41 PM
Hah. I have had to use a US-based VPN to access GitHub pretty much every weekend lately. La Liga's efforts to curb pirate TV streams are basically undermining the internet itself at this point.

This is also not new behaviour - Theo posted a YouTube about it nearly a year ago[1].

[1]: https://www.youtube.com/watch?v=1-geGEYEw7g

Chrisszz today at 8:15 PM
LOL this is so hilarious, blocking a portion of a web infra for a football match
pjc50 today at 2:23 PM
This is why technology businesses and professionals need to take a little bit of an active role in local politics. Otherwise you get nonsense.
yangm97 today at 4:33 PM
Maybe it’s time to reflect upon the reliance on centralized services? Not long ago docker hub started rate limiting access and we all turned to blanket solutions like the GitLab registry cache. I wonder if the IPFS distributed docker registry thing still exists/works.
gchamonlive today at 4:34 PM
Here in Brazil sometimes my ISP goes into a weird state where I can't SSH into a remote machune. Got two ISP links here and still sometimes I need to resort to Mullvad to get stable internet
pfortuny today at 5:31 PM
> instado por la Liga Nacional de FĂştbol Profesional y por TelefĂłnica Audiovisual Digital,

(The trial was initiated by LaLiga and Telefonica...).

"Telefonica" is the (exclusive) distributor for the rights of streaming the matches, and is only (of course?) the main consumer (and business) Telco in Spain: they are in a game they cannot lose. This is such an abuse and no government (this, past, whichever) has done anything about it.

ordersofmag today at 5:40 PM
Interesting alternative. Cloudflare (market cap $58B) buys La liga (market value $5 billion), drops suit.
amarant today at 6:13 PM
I had to Google why this happens, blocking cloudflare during football games seems.. Arbitrary, to say the least. Maybe something to do with hooligans trashing entire cities when their team loses? I could almost get behind that, if I thought it would work..

But no, it's apparently to stop piracy!? Turning off half the internet, and mostly the legitimate parts at that (since when do pirates use cloudflare?) seems like probably the worst method to go about it.

Someone ought to start streaming those games illegally without using cloudflare just to demonstrate how stupid this policy is

jesuslop today at 6:19 PM
Just to confirm it is true. This is LaLiga bringing down essential country-wide infrastructure on soccer hours if your internet access is through main ISPs.
Kamshak today at 5:48 PM
I'm in Spain as well and it sucks a lot. What I do now is I go thorough Cloudflare 1.1.1.1 VPN (set up on my router). Fixes the issue and there is practically no latency or bandwidth impact.
giorgioz today at 4:37 PM
POSSIBLE FIX:

I think changing your default DNS servers to Google 8.8.8.8 or Cloudflare 1.1.1.1 might bypass the spanish sunday ban on Cloudlflare.

macOS + Cloudlfare 1.1.1.1 https://developers.cloudflare.com/1.1.1.1/setup/macos/

Google 8.8.8.8 https://developers.google.com/speed/public-dns/docs/using

vaylian today at 1:32 PM
This is a know issue and it is completely fucked up: https://www.techradar.com/vpn/vpn-privacy-security/cloudflar...

What Spain does is basically censorship and it's very poorly executed. The docker image registry is only one out of the many collateral victims of this stupid law.

Jare today at 3:51 PM
It's a disgrace, but apparently all relevant forces still consider soccer the most important thing in the country.
postepowanieadm today at 6:40 PM
Why are you working instead of watching the match?
Dibby053 today at 5:09 PM
Going to play devil's advocate here but I suspect if Cloudflare had been more cooperative about taking down illegal content, LaLiga would not have resorted to blanket blocking individual IPs.

I would really like to understand more about the process that they should follow but didn't / followed but didn't satisfy them / doesn't exist, in order to remove infringing websites quickly from CloudFlare.

sigio today at 1:31 PM
Time to use a VPN in your docker pipelines ;) Or run your systems outside of Spain.

Or can this be avoided by using an alternate DNS?

thomasjudge today at 7:03 PM
Could you bypass this with a VPN?
LtdJorge today at 5:54 PM
Thankfully, Adamo hasn’t implemented the blockade yet (if ever).
blurb4969 today at 6:36 PM
Welcome to the club, buddies! Here, in Russia, the government doesn't care about collateral damage at all when shutting down whole Internet in cities. They turn on white list mode, when only approved sites and IPs work. Businesses stop working and start losing money? They don't care. Important IT systems stop working? They don't care. People can't communicate with each other? Don't care. And seems like it will happen everywhere else. Sad to see the whole world goes down apart.
Magnets today at 4:34 PM
BT used to block the entire streamable.com site during football matches
jimaek today at 1:51 PM
Off topic but I wonder when Cloudflare is going to launch their own Docker registry as a product.
Myzel394 today at 5:54 PM
Just use a VPN
breppp today at 4:40 PM
Vote early, vote often
mschuster91 today at 6:09 PM
Cloudflare could resolve this without negatively impacting fundamental services... just place all newly registered sites (e.g. <30 days) on a dedicated block of IP addresses. That way, Spain's government-ordered censorship could be limited to (mostly) pirate sites. Or they could invest money in vetting customers properly.

But of course, Cloudflare rather prefers to hold their actual large customers (who don't have much of an alternative to CF) and everyday Spaniard users hostage.

ahachete today at 1:59 PM
Yeah, I know. Welcome to the club :(

https://x.com/ahachete/status/2035783292549755228

anthk today at 2:18 PM
CF could just sue LaLiga and the judge as interrupting and intercepting telecomms it's a really serious crime in Spain. Call the AEPD too because of consumers' right against both ISP and LaLiga's snooping. Another huge fine.

This is not an issue under the civil code (civilian issues), but something to be dealt under penal (criminal) code.

In Spanish

https://www.fiscal.es/memorias/memoria2020/FISCALIA_SITE/rec...

Oh, and BTW, LaLiga has just partnered with a CF rival.

Now CF can just sue both like hell because of unfair competition:

https://nitter.tiekoetter.com/xataka/status/2042658662850724...

anthk today at 2:14 PM
Yea, La Liga it's crapping out as always. Docker needs either some I2P gateway, or a Tor service.
dmitrygr today at 5:22 PM
The last sentence of this submission makes no sense. You are in Spain. Allegedly, the country has a representative government. That means that you should have a way to influence the government to fix this idiocy. If, in fact, you don’t, then it is not a representative government and …ahem… further steps may be warranted to remind the government whom they work for.
deleted today at 2:24 PM
lofaszvanitt today at 4:40 PM
Good. Cloudflare is the next evil entity on the internet.
richwater today at 2:54 PM
Spain is a failing country. Their economy is in shambles and the government has ceded internet control to a private corporation who runs football games.
PocketBot today at 5:56 PM
[dead]
lordmoma today at 4:48 PM
[dead]
renewiltord today at 4:02 PM
[flagged]
mathfailure today at 2:04 PM
Cloudflare is cancer. And the tumor is now too big.