Tell HN: Docker pull fails in Spain due to football Cloudflare block

Article Summary

A developer in Spain discovered that Docker image pulls were failing with TLS certificate errors because Cloudflare R2 storage IPs — used by Docker Hub — were being court-ordered blocked during La Liga football matches. The block stems from a December 2024 Barcelona court ruling allowing La Liga and Telefonica to block IPs associated with illegal streaming, but the enforcement sweeps up entire Cloudflare IP ranges, taking down unrelated infrastructure like CI/CD pipelines, Docker registries, and developer tools as collateral damage. The developer lost over an hour debugging before realizing the root cause had nothing to do with their configuration.

Discussion

• Broad collateral damage is routine and worsening: Commenters confirm this happens every weekend during matches, affecting not just Docker but Cloudflare Zero Trust tunnels, Google Maps, app video playback, and more — with some ISPs silently dropping traffic rather than showing a block page, making diagnosis even harder.
• LaLiga dismisses technical complaints: LaLiga’s public response characterizes affected developers as “a few nerds” talking about incomprehensible things, showing no intent to refine the blocking.
• Workarounds exist but are band-aids: Switching to a DNS resolver outside Spain (e.g. AdGuard DNS via DoH/DoT) avoids blocked IP pools, and Docker registry mirrors (e.g. mirror.gcr.io) can bypass the issue, but these do not address the underlying problem.
• Centralized infrastructure is the vulnerability: Several commenters argue this highlights the danger of routing global infrastructure through a single CDN, with calls for services like Docker to self-host rather than rely on Cloudflare.
• Growing international awareness: Similar HN threads have appeared multiple times in recent months; Spanish developers are calling for international pressure and public shaming as the primary lever for change.

Discuss on HN