pullistFirewall openings needed to pull container images.

GitHub (ghcr.io)

GitHub Container Registry. Two hosts, both required.

HostPortsPurpose
ghcr.io443Registry API and token authenticationrequired
pkg-containers.githubusercontent.com443Blob storage (redirect target for layer downloads)required

Notes

Auth tokens come from ghcr.io itself, but layer downloads redirect to pkg-containers.githubusercontent.com. With only ghcr.io open, pulls authenticate fine and then stall on the first layer.

Copy-paste

Plain domain list: ghcr.txt · JSON: ghcr.json · connectivity test: check-ghcr.sh

ghcr.io
pkg-containers.githubusercontent.com

Verify from inside the network

curl -fsSL https://pullist.d0t.se/check-ghcr.sh | sh

Sources

Last verified: 2026-06-12 · data file: data/ghcr.yaml