[BUG] Trusted egress allowlist has wrong Docker CDN host — production.cloudflare.docker.com instead of production.cloudfront.docker.com

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

On Claude Code on the web with Trusted network access, docker pull of any
Docker Hub image fails. Manifests resolve, but blob downloads are blocked.

Official docs confirm discrepancy:

• https://docs.docker.com/desktop/setup/allow-list/
• https://code.claude.com/docs/en/claude-code-on-the-web#container-registries

What Should Happen?

docker run --rm hello-world works with Trusted network access.

Error Messages/Logs

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
docker: unknown: failed to copy: httpReadSeeker: failed open: unexpected status from GET request to https://production.cloudfront.docker.com/registry-v2/docker/registry/v2/blobs/sha256/e2/e2ac70e7319a02c5a477f5825259bd118b94e8b02c279c67afa63adab6d8685b/data?[redacted]: 403 Forbidden

Steps to Reproduce

Ask claude code web to run hello-world docker image.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Code on the web

Platform

Anthropic API

Operating System

Other

Terminal/Shell

Other

Additional Information

_No response_

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
4f55086f7dd0: Pulling fs layer
docker: error pulling image configuration: download failed after attempts=1: denied: Host not in allowlist: production.cloudfront.docker.com. Add this host to your network egress settings to allow access.

docker: toomanyrequests: You have reached your unauthenticated pull rate limit. https://www.docker.com/increase-rate-limit