FIXED: Docker EOF Errors (Caused by ISP DNS Interference)
Hey all, I've been sick as a chip with this issue for months — pulling Docker images would constantly throw "unexpected EOF" or "context cancelled". I was ready to install a Virgin line on the 24th. BUT... today I gave it one last go with some AI help, and this fix looks solid so far (1+ hour of clean pulling — more than I’ve ever managed).
What’s Causing It?
Since late 2023, many of us on this ISP have experienced image pulls randomly crashing. Turns out, it’s DNS hijacking or TLS interference by the ISP. This messes with Docker registry traffic — especially for large, multi-layer images — and causes them to fail.
The Fix in Short:
- Run Unbound on your Pi/home server — your own recursive DNS resolver
- Point Pi-hole (or Docker or system-wide) at it
- All DNS now avoids Google, Cloudflare, AND your ISP
- Result? No more EOFs, secure DNS, faster pulls
What You Need:
- Raspberry Pi (or any Linux box)
- Docker (Portainer optional)
- Pi-hole (optional but helpful)
- Around 15 mins of setup
Setup Steps:
1. Create the config folder:
sudo mkdir -p /portainer/files/appdata/config/unbound
cd /portainer/files/appdata/config/unbound
2. Download root DNS hints:
sudo nano root.hints
Paste the contents from https://www.internic.net/domain/named.root
3. Create unbound.conf:
sudo nano unbound.conf
Paste the following:
server:
verbosity: 1
interface: 0.0.0.0
port: 53
do-ip4: yes
do-udp: yes
do-tcp: yes
access-control: 0.0.0.0/0 allow
root-hints: "/opt/unbound/etc/unbound/root.hints"
edns-buffer-size: 1232
prefetch: yes
cache-min-ttl: 3600
cache-max-ttl: 86400
forward-zone:
name: "."
forward-addr: 1.1.1.1
forward-addr: 1.0.0.1
4. Set file permissions:
sudo chown -R 1000:1000 /portainer/files/appdata/config/unbound
sudo chmod -R 755 /portainer/files/appdata/config/unbound
5. Deploy Unbound in Docker:
version: "3.8"
services:
unbound:
image: mvance/unbound-rpi:latest
container_name: unbound
restart: unless-stopped
ports:
- "5335:53/udp"
- "5335:53/tcp"
volumes:
- /portainer/files/appdata/config/unbound:/opt/unbound/etc/unbound
6. Point Pi-hole to it:
Go to Pi-hole > Settings > DNS
Enter 127.0.0.1#5335
Uncheck all other upstreams (Cloudflare, Google, etc.)
Save and restart DNS
Test That It Works:
Run this:
dig +short example.com @127.0.0.1 -p 5335
If you get a valid IP back — it’s working
Optional Docker Pull Test Script:
Create a file called docker-pull-test.sh with this content:
#!/bin/bash
IMAGES=(
linuxserver/nextcloud
portainer/portainer-ce
qmcgaw/gluetun
postgres:15
mongo:7
nginx
node:18
wordpress
redis:alpine
homeassistant/home-assistant
)
for IMAGE in "${IMAGES[@]}"; do
echo "Pulling $IMAGE..."
docker pull $IMAGE
done
echo "Cleaning up..."
for IMAGE in "${IMAGES[@]}"; do
docker rmi -f $IMAGE
done
Make it executable:
chmod +x docker-pull-test.sh
Run it:
./docker-pull-test.sh
Conclusion:
No VPN split-tunneling needed. No Gluetun wrappers. Just clean, recursive DNS.
If this helps anyone else, I’ll be buzzing — let me know and I’ll share full root hints or docker-compose templates.
Will update after 24–48hrs of use, but so far? Rock solid.
Happy pulling,
Rob
