Whitelist the Following If Your Docker Registry Is Behind Firewalls and Proxy Servers

When using Artifactory as a Docker registry (which might be behind a firewall and reverse proxy servers, such as Nginx and Apache), you might need to allow access to external hosts, as Docker Hub uses several hosts and its Content Delivery Network (CDN) to serve content.
 
You may allow traffic to the following domains, based on the link here.

 
Note: For AWS machines with a VPC handling traffic, dockerhub bypasses the production.cloudflare.docker.com backend and requests go directly to the docker-images-prod S3 bucket in the region the machine is in. In these scenarios, you can add a docker-images-prod* rule to the VPC to allow all of docker’s S3 buckets, or find the specific one your machine is hitting. You can see which redirect you have by getting a token from docker 
 
curl https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/hello-world:pull
 
and then using that token to hit one of the layers

curl -vvv -L -I https://registry-1.docker.io/v2/library/hello-world/blobs/sha256:feb5d9fea6a5e9606aa995e879d862b825965ba48de054caab5ef356dc6b3412 -H "Authorization: Bearer $TOKEN"

which will show a redirect either to production.cloudflare.docker.com, or docker-images-prod.s3.*
 

Troubleshooting

If you’re seeing Docker layer download failures, such as unknown blob or one of the layers failing to download, you might need to trace requests by adding the below loggers, to the $ARTIFACTORY_HOME/etc/logback.xml file. A restart will not be required for such a change to take effect.

Loggers for Artifactory version 6:- 
<appender name="http" class="ch.qos.logback.core.rolling.RollingFileAppender">
<File>${artifactory.home}/logs/http.log</File>
<encoder>
<pattern>%date ${artifactory.contextId}[%thread] [%-5p] \(%-20c{3}:%L\) - %m%n</pattern>
</encoder>
<rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
<FileNamePattern>${artifactory.home}/logs/http.%i.log</FileNamePattern>
<maxIndex>13</maxIndex>
</rollingPolicy>
<triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
<MaxFileSize>10MB</MaxFileSize>
</triggeringPolicy>
</appender>

 <logger name="org.apache.http" additivity="false">
<level value="TRACE"/>
<appender-ref ref="http"/>
</logger>

Loggers for Artifactory version 7:-

<appender name="http" class="ch.qos.logback.core.rolling.RollingFileAppender">
<File>${log.dir}/artifactory-http.log</File>
<rollingPolicy class="org.jfrog.common.logging.logback.rolling.FixedWindowWithDateRollingPolicy">
<FileNamePattern>${log.dir.archived}/artifactory-http.%i.log.gz</FileNamePattern>
<maxIndex>10</maxIndex>
</rollingPolicy>
<triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
<MaxFileSize>25MB</MaxFileSize>
</triggeringPolicy>
<encoder class="ch.qos.logback.core.encoder.LayoutWrappingEncoder">
<layout class="org.jfrog.common.logging.logback.layout.BackTracePatternLayout">
<pattern>%date{yyyy-MM-dd'T'HH:mm:ss.SSS, UTC}Z [jfrt ] [%-5p] [%-16X{uber-trace-id}] [%-30.30(%c{3}:%L)] [%-20.20thread] - %m%n</pattern>
</layout>
</encoder>
</appender>

<logger name="org.apache.http" additivity="false">
<level value="TRACE"/>
<appender-ref ref="http"/>
</logger>

By using loggers, you can trace requests to determine if they are reaching the correct endpoints. Note: You should remove loggers once requests have been captured because their ongoing operation on a production server may eventually result in performance degradation.
 
You can also trace traffic flows to intended endpoints by using a forward proxy, such as Charles (see screenshot below).