Over 2024 and 2025, the public Docker mirror sites run by Alibaba Cloud, Tencent Cloud, NetEase, iFlytek, and various universities were shut down or throttled in wave after wave. By 2026, “pulling an image feels like surviving a tribulation” is no longer a joke.

Many people’s first reaction is to curse the big companies for being stingy. But honestly, it’s not that simple.

The mountain of compliance can’t be gone around

Docker Hub is a globally open community — anyone can push an image to it, and no one does content review at the entrance. That means it contains everything: images with vulnerabilities, images carrying malware, even content that crosses domestic regulatory red lines, all mixed in.

The problem is that the moment Alibaba Cloud’s servers sync these things down and forward them to users, Alibaba Cloud naturally becomes the “man in the middle.” Under the current regulatory logic, a platform can’t say “I’m just a mirror, the content isn’t mine” — if you provide the channel for distribution, you’re responsible. No big company is willing to shoulder that joint liability for a free service.

The bandwidth math doesn’t add up

Docker images are fundamentally different from package dependencies like npm or pip — they’re just heavy. An ordinary Node.js base image starts at a few hundred MB, and anything with a bit of CUDA or PyTorch environment easily runs to several GB.

The crowd using mirror sources in China is also especially varied: developers, CI/CD pipelines, and tens of thousands of home NAS boxes — Synology, Terra Master, and the like — many set to auto-update on a schedule, running 24 hours a day. All of this is public egress traffic; the big companies can’t collect a cent for it and still have to pay for the bandwidth themselves.

This kind of thing used to count as a community-reputation investment, but now that everyone is cutting costs and boosting efficiency, a “pure bleed, zero conversion” project gets axed without hesitation.

The big companies haven’t given up on acceleration — they’ve just changed the game

Alibaba Cloud and Tencent Cloud didn’t take the whole image-acceleration capability offline; they fenced it in.

The logic now goes roughly like this: if you’ve bought their ECS and pull images from within the internal network, it’s still fast and free. If you want to use it over the public internet, you have to register an account, activate ACR (Container Registry service), and generate a dedicated acceleration address bound to your identity. The moment your account behaves abnormally, it can be traced and banned at any time.

In other words, the big companies’ attitude has become: you’re my paying user, or at least a real-name user, and I can give you special treatment; if you want to freeload anonymously, that service is gone.

So what does everyone do now?

The community has mainly worked out a few paths.

One is to find vertical, compliant mirror sites, like the OpenAtom Foundation’s AtomHub — but it only hosts a few hundred security-audited base images, so the odds of finding what you want aren’t high. There are also some mixed commercial/nonprofit services, like Xuanyuan Mirror and Millisecond Mirror, with decent reputations, though there’s no telling how long they’ll last.

Another is to activate a personal ACR on Alibaba Cloud or Tencent Cloud, get a dedicated link, and use it honestly under your real name.

The most thorough approach is to spin up a cheap VPS in Hong Kong or Singapore and build your own reverse proxy with Nginx or Cloudflare Workers, for your own use only, not open to the public. Speed is guaranteed, and you don’t have to worry about others leeching traffic and dragging it down. Many enterprises internally, and developers who enjoy tinkering, basically go this route now.