dial tcp: lookup registry.invalid: no such host at the end of a docker pull error means the registry host name in the image reference does not resolve in DNS. For the three references tested here, the host Docker tried to contact was the name before the first slash, and the message names it after lookup: check that name for a typo.

The fix is the registry name, not Docker: correct the host in the image reference. A name that resolves gets past this step, as the test below shows.

The error

PS> docker pull registry.invalid/library/alpine
Using default tag: latest
Error response from daemon: failed to resolve reference "registry.invalid/library/alpine:latest": failed to do request: Head "https://registry.invalid/v2/library/alpine/manifests/latest": dialing registry.invalid:443 container via direct connection because Docker Desktop has no HTTPS proxy: connecting to registry.invalid:443: dial tcp: lookup registry.invalid: no such host
exit=1

Why it happens

Docker took registry.invalid, the part before the first slash, as the registry host: the request in the message is https://registry.invalid/v2/library/alpine/manifests/latest, and the lookup of that host name failed. The test used only names ending in .invalid, as stand-ins for a misspelled or internal registry name, and Resolve-DnsName returned nothing for registry.invalid either.

The long middle of the message, dialing registry.invalid:443 container via direct connection because Docker Desktop has no HTTPS proxy, describes how Docker Desktop connected; the failure is the last part, no such host. The same ending appeared with a port in the reference and with a made-up host: 

PS> docker pull registry.invalid:5000/fix10-dc/app:1.0
Error response from daemon: failed to resolve reference "registry.invalid:5000/fix10-dc/app:1.0": failed to do request: Head "https://registry.invalid:5000/v2/fix10-dc/app/manifests/1.0": dialing registry.invalid:5000 container via direct connection because Docker Desktop has no HTTPS proxy: connecting to registry.invalid:5000: dial tcp: lookup registry.invalid: no such host
exit=1

The fix

Check the host on its own, then check that the registry answers for a name that resolves:

PS> (Resolve-DnsName registry.invalid -ErrorAction SilentlyContinue) -ne $null
False
...
PS> (Resolve-DnsName mcr.microsoft.com -ErrorAction SilentlyContinue | Select-Object -First 1).Name
mcr.microsoft.com
...
PS> docker manifest inspect mcr.microsoft.com/dotnet/aspnet:10.0 | Select-Object -First 4
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
   "manifests": [
exit=0

docker manifest inspect printed the image's manifest list from the registry, which shows that the host resolved and the registry answered for that reference. If a host resolves on its own but not for Docker, that case was not part of this test.

How it was reproduced

Docker client and engine 29.9.3 with Docker Desktop on Windows, from Windows PowerShell 5.1. The three references were registry.invalid/library/alpine, registry.invalid:5000/fix10-dc/app:1.0 and fix10-dc.invalid/app; each ended in no such host for its own host name and exited with 1. Only names ending in .invalid were pulled, and DOCKER_CONFIG pointed at an empty folder of the test's own so no stored credentials were involved. The image paths after the host are the test's own.

Frequently asked

What does dial tcp lookup no such host mean in docker pull?
The registry host name in the image reference did not resolve in DNS, For registry.invalid/library/alpine in the test, Docker tried the host registry.invalid, the name before the first slash, and the message named it after lookup.
Why does the docker pull error mention Docker Desktop has no HTTPS proxy?
That middle part describes how Docker Desktop connected. The failure is at the end of the line, dial tcp: lookup registry.invalid: no such host in the test, which means the host name did not resolve.
How can I check that a registry answers for an image reference?
Run docker manifest inspect with the full reference. In the test it printed the manifest list for mcr.microsoft.com/dotnet/aspnet:10.0 and exited with 0.

More decoded errors in the Fixes category. The same DNS failure from Ollama's own client is in Ollama pull: dial tcp lookup.