Hi! my Dockerfile builds are failing at the base-image pull step, before any

of my code is copied in. The builder gets a 401 pulling Microsoft's public

.NET 10 images from mcr.microsoft.com.

Exact error:

failed to solve: mcr.microsoft.com/dotnet/sdk:10.0: failed to resolve source

metadata for mcr.microsoft.com/dotnet/sdk:10.0: unexpected status from HEAD

request to https://mcr.microsoft.com/v2/dotnet/sdk/manifests/10.0: 401 Unauthorized

(An earlier attempt failed the same way on the token endpoint:

"failed to fetch anonymous token ... GET https://mcrprod.azurecr.io/oauth2/token

?scope=repository:dotnet/aspnet:pull&service=mcrprod.azurecr.io: 401 Unauthorized")

Details:

• Builder: Metal builder "builder-emkgde"

• Base images (Dockerfile): mcr.microsoft.com/dotnet/sdk:10.0 and

  mcr.microsoft.com/dotnet/aspnet:10.0

• Fails on "load metadata for ...:10.0" — i.e. pulling the base image, before COPY.

Why I believe this is on the build infrastructure's path to MCR, not my project:

• The "10.0" tag is valid and current (it's the GA tag, resolving to 10.0.9) —

  it pulls fine from other networks.

• These are public, anonymous-pull images; no auth is expected.

• There's no MCR outage reported on github.com/dotnet/dotnet-docker/issues, so

  this isn't a Microsoft-wide incident.

• This Dockerfile built successfully on Railway previously; nothing in my image

  definition changed.

What I've tried:

• Redeployed several times over 30 minutes, but I get the same 401 each time.

Is this builder is being rate-limited or blocked when

pulling anonymously from mcr.microsoft.com / mcrprod.azurecr.io, or whether a

registry pull-through cache / different builder can be used? I just don't know what further to do. Thanks!