If the image still isn't found, the Docker daemon fetches the image from the canonical repository on Docker Hub.
that's a feature of docker daemon itself. Fallback through the list of configured registry-mirrors.
The key here is that docker pull docker.io/cloudron/base is treated exactly as "docker pull cloudron/base" (implicit hub.docker.com) whereas docker pull registry.docker.com/cloudron/base is ignoring registry-mirror list because it is an explicit registry image ref.
quay.io would also fail in a "restricted" network environment.
One of the other solutions I considered is to allow a "cloudron base registry" option in the installer.
