Transit containers cannot pull because air-gap registry mirrors on the Docker daemon are wrong. What should ops fix?
Select an answer to reveal the explanation.
Short Explanation
You can get air-gapped transit pulls working by correcting the Docker daemon’s mirror configuration, then trying again. Sending pulls through an arbitrary public registry or deleting needed NGC images misses the problem, and permanently disabling TLS is not a safe fix.
Full Explanation
Transit containers that cannot pull in an air-gapped environment usually need the Docker daemon registry mirror configuration corrected for civic pulls. In disconnected or restricted sites, the daemon’s registry-mirrors and related insecure or allowed registry settings must point to the municipal mirror hosting approved NGC and transit images. Correcting that map restores pulls without opening ad hoc firewall access for every developer. Routing all pulls through an arbitrary public registry fails by concept: it abandons air-gap policy, invites unvetted content, and may still fail when egress is blocked by design. Permanently disabling TLS on all municipal registries violates security baselines; fix certificate issues with proper certificates or controlled exceptions, not a permanent downgrade. Deleting the NGC images needed by the job removes required artifacts and cannot resolve a mirror misconfiguration. Exam caveat: a registry mirror problem is in daemon configuration, such as daemon.json or equivalent CRI configuration, not an application Dockerfile typo, though either can produce a pull failure. Also distinguish mirror reachability, including DNS, routing, and firewall access to the mirror, from authentication to a private Harbor; the stated issue is wrong mirrors, so correct the mirror map first. Practical check: compare the daemon configuration with the transit air-gap runbook, reload Docker, test pulling a known mirrored digest from a worker, confirm Kubernetes or CRI pulls succeed for the transit deployment, and record the mirror endpoints in change control so an image sync cannot silently rewrite them.