pullistFirewall openings needed to pull container images.

Hugging Face Hub

Model, dataset, and artifact downloads from Hugging Face Hub.

HostPortsPurpose
huggingface.co443Hub API, repository metadata, authentication, download URL resolutionrequired
hf.co443Short URLs and download redirectsoptional
cdn-lfs.hf.co443Git LFS CDN for large file downloadsrequired
cdn-lfs-us-1.hf.co443Regional Git LFS CDN (US)required
cdn-lfs-eu-1.hf.co443Regional Git LFS CDN (EU)required
cas-bridge.xethub.hf.co443Xet storage bridge used by many newer repositoriesrequired
transfer.xethub.hf.co443Xet blob transfer endpointrequired
cas-server.xethub.hf.co443Xet content-addressable storage APIrequired

Notes

Hugging Face downloads often begin at huggingface.co but are redirected to dedicated CDN or Xet storage endpoints for large files. Common failure mode: - huggingface.co is reachable - repository metadata and model listings work - downloads stall or fail because CDN/Xet hosts are blocked Since Hugging Face has migrated many repositories to the Xet storage backend, allowing only huggingface.co is no longer sufficient. Some environments may observe redirects to provider-managed CDN domains (for example CloudFront-backed endpoints). If downloads still fail after allowing the hosts above, inspect HTTP redirects from a failing download and whitelist any additional CDN hosts returned by your specific model repositories.

Copy-paste

Plain domain list: hugging-face.txt · JSON: hugging-face.json · connectivity test: check-hugging-face.sh

huggingface.co
hf.co
cdn-lfs.hf.co
cdn-lfs-us-1.hf.co
cdn-lfs-eu-1.hf.co
cas-bridge.xethub.hf.co
transfer.xethub.hf.co
cas-server.xethub.hf.co

Verify from inside the network

curl -fsSL https://pullist.d0t.se/check-hugging-face.sh | sh

Sources

Last verified: 2026-06-17 · data file: data/huggingface.yaml