A ZimaOS user in Ireland reported that Docker image pulls sometimes reached regional proxy domains such as ghcr.1panel.live or daocloud.io, even after attempts to clear the configuration. The affected pulls failed with TLS certificate or regional-access errors instead of completing through the expected official registry.
The replies initially described these proxies as forced mirrors, but a later ZimaOS team response added an important correction: ZimaOS first tries Docker Hub and uses a proxy only after that pull fails. The thread therefore documents a fallback-path problem and a request for an “official registries only” control, not proof that every image pull is sent to a regional proxy from the beginning.
What the User in Ireland Experienced
lucslav reported repeated Docker image-installation failures while using ZimaOS in Ireland. The behavior appeared both through the graphical interface and through terminal-based pulls, and manual attempts to clear the mirror configuration did not appear to make the change permanent.
The most specific error copied into the thread was:
tls: failed to verify certificate: x509: certificate signed by unknown authorityThe failed request named proxy or mirror domains rather than only the expected official image registry. Because a direct connection to official registries was more reliable from the user's location, lucslav asked for a permanent way to disable these regional paths.
The Two Additional Errors Reported Later
In a follow-up, lucslav recalled seeing two other types of messages. One said that the service was available only in mainland China. The other said that the certificate had expired or was not yet valid.
These messages strengthened the user's view that the fallback endpoint was not appropriate for every region. A region-restriction response prevents the service from being used outside its intended area, while an expired or not-yet-valid certificate prevents the TLS connection from being trusted.
The requested product change remained simple throughout the discussion: add a setting that allows users to disable regional mirrors and require direct connections to official registries such as GitHub Container Registry and Docker Hub.
How gelbuilding Interpreted the Failure
gelbuilding agreed that the reported behavior did not look like an ordinary loss of internet connectivity. Their interpretation was that the Docker request reached a registry mirror whose certificate could not be validated, causing Docker to stop the pull.
After lucslav added the mainland-China-only and certificate-validity messages, gelbuilding treated the endpoint itself as the failing branch. From this perspective, the mirrors were no longer improving reliability for European users; they were creating a hard installation failure.
The proposed interface solution was an option similar to Use Official Registries Only. No such option or confirmed configuration procedure was provided in the thread, so the reply should be understood as a product suggestion rather than an available step.
A Similar Failure Was Reported From the United States
connorb later joined the discussion from the United States after receiving a similar error while attempting to install a Docker image. This showed that the issue described in the thread was not limited to the original user's location in Ireland.
connorb asked whether a workaround existed. lucslav replied that they had not found one and suggested looking for an alternative image where possible. The discussion did not establish whether that alternative image would use another registry, another repository owner, or a different application package.
The ZimaOS Team Clarified the Pull Order
raller1028 added the most important behavior clarification near the end of the thread: when ZimaOS pulls an image, it first attempts to retrieve it through Docker Hub. The proxy is tried only when the original pull fails.
This changes how the earlier reports should be interpreted. The community members experienced proxy-related failures, but the team response indicates that the proxy was a fallback path rather than the first destination for every pull.
The clarification also leaves an unanswered question: why did the original Docker Hub request fail before the system moved to the proxy? The thread contains no logs or follow-up tests that identify whether the first failure resulted from connectivity, authentication, rate limiting, image availability, DNS, or another condition.
What the Discussion Did Not Resolve
No participant supplied a confirmed permanent method for disabling the proxy fallback. lucslav reported that manual attempts to clear the configuration did not persist, but the exact file, setting, or service involved was not included in the post.
The thread also did not confirm that the certificate itself had expired in every case. Three different messages were discussed: unknown certificate authority, expired or not-yet-valid certificate, and a mainland-China-only restriction. They may involve different proxy endpoints or different stages of the fallback process.
Finally, no final ZimaOS release, setting, or workaround was posted in this discussion. The concrete outcome was a product request: expose a persistent direct-only policy for regions where regional mirrors are unnecessary or inaccessible.
Information Worth Preserving When Reporting the Same Issue
The original post was valuable because it included the user's region, the proxy hostnames, the fact that both the UI and terminal were affected, and the exact x509 message. The later replies added two more visible error conditions and a similar report from another country.
A useful follow-up report should therefore preserve the same type of evidence: ZimaOS version, country or region, original image reference, whether the pull began in the UI or terminal, the first official-registry failure, the fallback hostname, and the complete certificate or region-restriction message.
That information would allow the ZimaOS team to distinguish a failed official pull from a failed proxy fallback. Users can use the existing ZimaOS Docker application guide for the normal installation workflow.
FAQ From the Community Discussion
Were the regional mirrors the first pull path?
According to the ZimaOS team reply, no. ZimaOS first attempts the image pull through Docker Hub and tries the proxy only after that pull fails.
Which errors were actually reported?
The thread includes an unknown-certificate-authority error, a recalled expired or not-yet-valid certificate message, and a service-only-available-in-mainland-China message.
Did the discussion provide a switch for disabling proxies?
No. The “Use Official Registries Only” switch was a feature request from community members, not an existing setting demonstrated in the thread.
Was there a confirmed workaround?
No permanent workaround was confirmed. One participant suggested finding an alternative image, while the team clarification explained the official-registry-first and proxy-second pull order.
Was the problem limited to Europe?
No. The original report came from Ireland, but another user later reported a similar Docker image-installation error from the United States.
