I would split image-specific failure from Railway registry egress first.

Try a boring public image in the same service/env, for example nginx:alpine.

If nginx:alpine fails too, this is almost certainly not PocketBase config; include the deployment IDs and ask Railway to check image-pull egress for that environment. If nginx:alpine works, pin the PocketBase image to a concrete tag/digest or build it from a tiny Dockerfile instead of relying on the current image reference.