HN Explorer

Tell HN: Docker pull fails in Spain due to football Cloudflare block

1157 points by littlecranky67 ↗ HN
I just spent 1h+ debugging why my locally-hosted gitlab runner would fail to create pipelines. The gitlab job output would just display weird TLS errors when trying to pull a docker images. After debugging gitlab and the runner, I realized after a while I could not even run "docker pull <image>" on my machine as root:

> error pulling image configuration: download failed after attempts=6: tls: failed to verify certificate: x509: certificate is not valid for any names, but wanted to match docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com

First blaming tailscale, dns configuration and all other stuff. Until I just copied that above URL into my browser on my laptop, and received a website banner:

> El acceso a la presente dirección IP ha sido bloqueado en cumplimiento de lo dispuesto en la Sentencia de 18 de diciembre de 2024, dictada por el Juzgado de lo Mercantil nº 6 de Barcelona en el marco del procedimiento ordinario (Materia mercantil art. 249.1.4)-1005/2024-H instado por la Liga Nacional de Fútbol Profesional y por Telefónica Audiovisual Digital, S.L.U. https://www.laliga.com/noticias/nota-informativa-en-relacion-con-el-bloqueo-de-ips-durante-las-ultimas-jornadas-de-laliga-ea-sports-vinculadas-a-las-practicas-ilegales-de-cloudflare

For those non-spanish speakers: It means there is football match on, and during that time that specific host is blocked. This is just plain madness. I guess that means my gitlab pipelines will not run when football is on. Thank you, Spain.

112 comments

[ 4.5 ms ] story [ 90.9 ms ] thread
sigio
Time to use a VPN in your docker pipelines ;) Or run your systems outside of Spain.

Or can this be avoided by using an alternate DNS?

gred
> run your systems outside of Spain

So much for digital sovereignty :-)

vaylian
This is a know issue and it is completely fucked up: https://www.techradar.com/vpn/vpn-privacy-security/cloudflar...

What Spain does is basically censorship and it's very poorly executed. The docker image registry is only one out of the many collateral victims of this stupid law.

embedding-shape
> What Spain does is basically censorship and it's very poorly executed

Basically? It is censorship, with huge collateral damage and regardless of how much we complain or share evidence that the blocks are actually financially harming us, no one seems to care as long as La Liga gets to freely block whatever hoster of websites as they wish.

utrack
They block the whole of Cloudflare R2, I believe the Docker hub is just (heh) a collateral.

When the La Liga match starts, everything that's proxied via CF (including zero access reverse tunnels) stops working.

There's even a website made for checking if the match is on: https://hayahora.futbol/

You can check if your host is affected: https://hayahora.futbol/#comprobador&domain=docker-images-pr...

micw
Who exactly is blocking and on what legal base? If it's Spanish ISPs and they are massively over blocking, why are there no legal actions against them? (E.g. for not fulfilling their contracts)
ClikeX
The wacky thing is. It's blocked due to legal action.
jojobas
Great, time to proxy through AWS, Azure and GCP so that these muppets block Spain from everything.
mathfailure
Cloudflare is cancer. And the tumor is now too big.
anthk
Yea, La Liga it's crapping out as always. Docker needs either some I2P gateway, or a Tor service.
fc417fc802
The pirate streams need an I2P service that way LaLiga might give up.
anthk
CF could just sue LaLiga and the judge as interrupting and intercepting telecomms it's a really serious crime in Spain. Call the AEPD too because of consumers' right against both ISP and LaLiga's snooping. Another huge fine.

This is not an issue under the civil code (civilian issues), but something to be dealt under penal (criminal) code.

In Spanish

https://www.fiscal.es/memorias/memoria2020/FISCALIA_SITE/rec...

Oh, and BTW, LaLiga has just partnered with a CF rival.

Now CF can just sue both like hell because of unfair competition:

https://nitter.tiekoetter.com/xataka/status/2042658662850724...

pjc50
This is why technology businesses and professionals need to take a little bit of an active role in local politics. Otherwise you get nonsense.
DocTomoe
That's an interesting euphenism for 'spend a massive amount of money on ~~corruption~~ lobbying',
dabinat
We also need more tech-savvy politicians in office. There are a lot of politicians who are expected to legislate on important technology issues that barely know how to use a cellphone.
[deleted]
(comment deleted)
danirod
Heh, lucky you, at least you get a message. My ISP just drops traffic to the affected IPs. No ping, no traceroute, just a spinner in the browser until it says "page not found".

Every response and comment from LaLiga, the football organization responsible for this, has been so far that this is a minor issue that only affects a few bunch of nerds who talk about "docker images" or "github repositories" or "whatever that means".

Meanwhile, there are testimonies of smart home devices like anti-theft alarms or automatic doors, that stop working whenever there is a football match, because their backends rely on Cloudflare.

Last week, a woman asked for help on social media, as the GPS tracking app she uses to see where her father with dementia is, went offline during a match. It was getting late and he still wasn't back home, and she couldn't locate the tag he was wearing to find him: https://www.infobae.com/america/agencias/2026/04/05/laliga-d...

It's hard to say this, because no one should experience an event like this, but as stressful as these are, it's the only way to make the mainstream people care about this censorship. "I cannot pull a docker image" will never be on nightly news, but safety and personal security is a more powerful driver for discourses.

pxc
> Heh, lucky you, at least you get a message. My ISP just drops traffic to the affected IPs. No ping, no traceroute, just a spinner in the browser until it says "page not found".

This is generally how the GFW works in China. Instead of an overbearing nanny like a school or corporation's DNS blocker, you're left with a sense that you're on a version of the Internet that is just intermittently and somewhat mysteriously broken.

And indeed, in China, a lot of things that probably aren't fully intended to be blocked are not reliably accessible. Implementation varies, so you get strange routing and peering issues. It feels like an Internet that isn't fully formed, that hasn't finished coming together yet.

Nation states and corporations obviously gain some things sometimes by having Internet censorship/blocking frameworks in place. Maybe, sometimes, ordinary people even benefit, too, if it helps shut down illegal and genuinely harmful businesses.

But it feels like the whole world is gradually trending towards more and more Internet censorship without realizing that we are un-building a miraculous thing that took enormous effort and cleverness and expense to build. I wish we could think about this not only in terms of freedom (and we absolutely should think about it in terms of freedom), but how we are disintegrating the infrastructure of communication and computing.

the_gipsy
It's ridiculous and wrong what LaLiga does. But it's also a weakeup call to consider ditching cloudflare's centralization.
boredatoms
Perhaps its time to put a VPN into all your CI jobs
tobz1000
> there are testimonies of smart home devices like anti-theft alarms or automatic doors, that stop working whenever [...] because their backends rely on Cloudflare.

The fault here lies 100% with horribly designed IoT devices that turn into bricks when they lose internet connection.

xp84
Who cares if she can’t find her elderly father? A small price to pay to preserve the stratospheric prices on football TV rights!!!!
matheusmoreira
> Every response and comment from LaLiga, the football organization responsible for this, has been so far that this is a minor issue that only affects a few bunch of nerds who talk about "docker images" or "github repositories" or "whatever that means".

Translation: go away kid, we're trying to make money here.

[deleted]
(comment deleted)
mrvaibh
This is a great example of why blanket IP blocking is such a terrible enforcement mechanism. Cloudflare hosts hundreds of thousands of services behind shared IP ranges — blocking one IP to stop a piracy stream takes out everything else on that IP, including Docker registries, API endpoints, and CDNs that have nothing to do with football.

  The real fix on your end until Spain sorts this out: set up a pull-through registry cache (e.g. registry:2 with proxy.remoteurl) on a VPS outside Spain, and point your Docker daemon's mirror config at it. Your
  GitLab runner pulls from the cache, the cache pulls from Docker Hub via a non-blocked IP. Also insulates you from Docker Hub rate limits.

  But yeah, the fact that a court order about football streaming can break docker pull for an entire country is genuinely absurd.
tom1337
just wait until they block Azure as well so the official La Liga site also stops working
embedding-shape
> This is a great example of why blanket IP blocking is such a terrible enforcement mechanism

AFAIK, they're not doing "blanket IP blocking", they're intercepting requests based on DNS and IP, and try to serve their own certificates and their own content. Obviously, in most cases it fails, as the certificate doesn't match the site, so the browser rejects it, but as far as I can see and tell, there is no "blanket IP blocks", more like "DNS and IP interception".

The difference doesn't really matter in practice, sucks regardless, but I thought I'd clarify for the ones who are not experiencing these blocks themselves at least.

richwater
Spain is a failing country. Their economy is in shambles and the government has ceded internet control to a private corporation who runs football games.
estebank
To note that this isn't the executive or legislative but the judiciary doing the bidding.
embedding-shape
Spain isn't a perfect country, I don't think any is. But the economy isn't in shambles, only someone who doesn't know what they're talking about would say anything like that. It does suck that La Liga can wield so much power, agree, but this is not related to the economy at all...
chrz
Are you spanish and never went to another country? I only heard such things from never-stop complaining locals that never traveled anywhere. Yeah La Liga is a religion here, but Spain is one of the worlds top of life quality mate
Jare
It's a disgrace, but apparently all relevant forces still consider soccer the most important thing in the country.
jcalvinowens
This is the moral equivalent of shutting the water off for a whole city because one dude's house has a leak. The harms to society clearly and obviously outweigh any possible benefits to society. But if that one dude has the power to shut it all off, and doesn't care...
torben-friis
As a Spaniard, I would be very happy it cloudflare stops serving Spain. The situation is beyond stupid and I know without international pressure and shaming we're not getting rid of this abuse.
yangm97
Maybe it’s time to reflect upon the reliance on centralized services? Not long ago docker hub started rate limiting access and we all turned to blanket solutions like the GitLab registry cache. I wonder if the IPFS distributed docker registry thing still exists/works.
Magnets
BT used to block the entire streamable.com site during football matches
gchamonlive
Here in Brazil sometimes my ISP goes into a weird state where I can't SSH into a remote machune. Got two ISP links here and still sometimes I need to resort to Mullvad to get stable internet
lofaszvanitt
Good. Cloudflare is the next evil entity on the internet.
breppp
Vote early, vote often
jjcm
Barring an Internet giant suing them in court, it really feels like this is unlikely to change as most just don’t understand the why or the effect.

Someone needs to write a heist movie set in Spain where a key part of the plan is they steal something while La Liga is blocking some key security route.