Docker via VPN leads to DNS/TLS/etc. errors

[logopk]

I move my Mac with a VMWare debian bookworm docker container from my home network - where everything runs fine - to the office or my gf and run it through a VPN.

Docker version is

Server: Docker Engine - Community
 Engine:
  Version:          24.0.7
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.10
  Git commit:       311b9ff
  Built:            Thu Oct 26 09:08:15 2023
  OS/Arch:          linux/arm64
  Experimental:     true
 containerd:
  Version:          1.6.24
  GitCommit:        61f9fd88f79f081d64d6fa3bb1a0dc71ec870523
 runc:
  Version:          1.1.9
  GitCommit:        v1.1.9-0-gccaecfc
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
``

I cannot get consistent updates from my images with various errors, that I could not really track down.

Mon, 06 Nov 2023 09:00:19 CET WRN github.com/crazy-max/diun/v4/internal/app/job.go:199 > Cannot get remote manifest error="cannot get image digest from HEAD request: Get "https://auth.docker.io/token?scope=repository%3Aroundcube%2Froundcubemail%3Apull&service=registry.docker.io\": dial tcp: lookup auth.docker.io on 127.0.0.11:53: server misbehaving" image=docker.io/roundcube/roundcubemail:latest-apache provider=file

or

Mon, 06 Nov 2023 12:00:22 CET WRN github.com/crazy-max/diun/v4/internal/app/job.go:199 > Cannot get remote manifest error="cannot get image digest from HEAD request: Get "https://auth.docker.io/token?scope=repository%3Aprom%2Fprometheus%3Apull&service=registry.docker.io\": net/http: TLS handshake timeout" image=docker.io/prom/prometheus:latest provider=file

or

Mon, 06 Nov 2023 15:00:54 CET WRN github.com/crazy-max/diun/v4/internal/app/job.go:199 > Cannot get remote manifest error="cannot get image digest from HEAD request: Head "https://registry-1.docker.io/v2/smallstep/step-cli/manifests/latest\": dial tcp: lookup registry-1.docker.io on 127.0.0.11:53: server misbehaving" image=docker.io/smallstep/step-cli:latest provider=file

When running ping or curl inside the container I can reach the registry and even get results.

I have even implemented a go program that does a lookup in the registry, that has the same network settings: there is no problem!

I have read about MTU sizes somewhere. I have reduced the MTU of docker to 
  "mtu":1300
in /etc/docker/daemon.json as my interface has 1500. This did not have an effect.

Any idea what may be the problem? Any more debug information that may be helpful?

Thank you

Peter