pullistFirewall openings needed to pull container images.

Microsoft (mcr.microsoft.com)

Microsoft Artifact Registry - dotnet, SQL Server, AKS components, Windows base images.

HostPortsPurpose
mcr.microsoft.com443Registry API (manifests, blob requests)required
*.data.mcr.microsoft.com443Regional CDN data endpoints (redirect targets for layers)required

Notes

Layer content comes from regional data endpoints like eastus.data.mcr.microsoft.com or westeurope.data.mcr.microsoft.com. If the firewall cannot do wildcards, Microsoft publishes the regional endpoint list in the mcr-firewall-rules documentation.

Copy-paste

Plain domain list: mcr.txt · JSON: mcr.json · connectivity test: check-mcr.sh

mcr.microsoft.com
*.data.mcr.microsoft.com

Verify from inside the network

curl -fsSL https://pullist.d0t.se/check-mcr.sh | sh

Sources

Last verified: 2026-06-12 · data file: data/mcr.yaml