docker registry-mirrors is not used for fqdn images

I have a docker server behind a firewall, so I cannot pull images directrly from any registry besides internal servers.

I have configured two registry mirrors (registry-1.docker.io and mcr.microsoft.com), following docs.

My daemon.json looks like:

{
  "registry-mirrors": [
          "https://registry_1_docker_io.example.com",
          "https://mcr_microsoft_com.example.com"
  ] 
}

I can successfully pull images from docker hub by executing i.e:

$ docker pull nginx:1
1: Pulling from library/nginx
....
Status: Downloaded newer image for nginx:1

My problem is that I cannot pull images from microsoft registry:

# docker pull mcr.microsoft.com/mssql/server:2017-latest
Error response from daemon: Get "https://mcr.microsoft.com/v2/": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

The docker tries to connect directly to mcr and ignores my mirror. If I use short image name (mssql/server:2017-latest instead of mcr.microsoft.com/mssql/server:2017-latest) it works, but it might get the image from docker hub instead of microsoft's mcr if the tag is the same on both.

Additionally, If I look at logs, docker tries all proxies for the image in order, so there might be a situation when image is fetched from wrong repository.

Is there any way to mark a mirror as a mirror for specific registry?

Is there any way to mark a mirror as a mirror for specific registry?

No, this is a limitation of the docker engine, registry-mirrors is only for Docker Hub. You can follow issue 18818 for more details.

This may change when docker swaps out the image handling from docker to containerd in the near future, since containerd has a different configuration for handling mirrors.