Error: pull model manifest: Get "https://registry.ollama.ai/v2/library/all-minilm/manifests/latest": dial tcp: lookup registry.ollama.ai on ... — ollama pull could not even find the address of the model registry. The model name is fine; the machine (or container) running the Ollama server has no network or no working DNS. Fix the network of the server, not the command.

The words after lookup registry.ollama.ai on tell you which DNS server was asked and how it failed. network is unreachable means there is no network at all; connection refused means the DNS server address points at nothing. Give the server a working network and DNS, and the same pull succeeds.

The error

With no network at all (a container started with --network none):

PS> docker exec fix8-ol-nonet ollama pull all-minilm
pulling manifest
Error: pull model manifest: Get "https://registry.ollama.ai/v2/library/all-minilm/manifests/latest": dial tcp: lookup registry.ollama.ai on 192.168.65.7:53: dial udp 192.168.65.7:53: connect: network is unreachable

With a network but a DNS server that does not answer (--dns 127.0.0.1):

PS> docker exec fix8-ol-baddns ollama pull all-minilm
pulling manifest
Error: pull model manifest: Get "https://registry.ollama.ai/v2/library/all-minilm/manifests/latest": dial tcp: lookup registry.ollama.ai on 127.0.0.1:53: read udp 127.0.0.1:56317->127.0.0.1:53: read: connection refused

Why it happens

A pull starts with one HTTPS request for the model's manifest at registry.ollama.ai. Before it can connect, the server must turn that name into an IP address. In the test that lookup failed, the pull stopped after pulling manifest, and the error carried the whole chain: the URL, the failed dial tcp, a name server address and the low-level reason. The address in the first error, 192.168.65.7:53, is the nameserver line of the container's /etc/resolv.conf, as cat /etc/resolv.conf in the same container showed; in the second it is the dead --dns address.

Note that the download is done by the Ollama server, not by the ollama command you typed. If the CLI talks to a server in a container, in WSL or on another machine, it is that server's network that counts. The two causes reproduced here: a container with no network (--network none), and a --dns setting pointing at an address where no name server answers.

The fix

PS> docker run -d --name fix8-ol-net ollama/ollama
...
PS> docker exec fix8-ol-net ollama pull all-minilm
pulling manifest
...
verifying sha256 digest
writing manifest
success
exit code: 0
PS> docker exec fix8-ol-net ollama list
NAME                 ID              SIZE     MODIFIED
all-minilm:latest    1b226e2802db    45 MB    Less than a second ago

The same image on Docker's default bridge network, with the DNS Docker provides, pulled the model at once. So the fix is to give the server a network and a name server that answers: drop --network none or the dead --dns option, and check the nameserver line with cat /etc/resolv.conf where the server runs.

How it was reproduced

Docker Desktop on Windows 11 with the ollama/ollama image (Ollama 0.40.8 inside). Three containers were started, and the names fix8-ol-nonet, fix8-ol-baddns and fix8-ol-net are the test's own: one with --network none, one with --dns 127.0.0.1 where nothing listens, and one on the default network. ollama pull all-minilm was run in each with docker exec; the first two failed as shown, the third succeeded. All three were removed afterwards with docker rm -f -v.

Frequently asked

Why does ollama pull say dial tcp lookup registry.ollama.ai?
The Ollama server could not resolve the registry's name. It has no network, no working DNS server, or a DNS setting that points at nothing. The model name is not the problem.
Which machine needs internet access for ollama pull?
The machine running the Ollama server. The ollama command only asks the server to download; if the server runs in a container, WSL or on another host, that environment needs DNS and internet access.
How do I tell which DNS server Ollama asked?
Read the address after 'lookup registry.ollama.ai on' in the error. In the test it was 192.168.65.7:53, the name server Docker Desktop writes into a container's /etc/resolv.conf, and 127.0.0.1:53 when a dead --dns was set.

More decoded errors in the Fixes category. If the pull reaches the registry but fails with a different message, see 'pull model manifest: file does not exist'.