Back to blog
Guides

GitHub, Docker Hub and npm in China: A Developer Setup That Works

Use China mirrors for npm, PyPI and Go, route GitHub, Docker Hub and Hugging Face out of China, and keep SSH responsive. A practical developer setup for 2026.

Updated October 2026.

The short answer

For packages, domestic mirrors such as npmmirror, Tsinghua TUNA and Alibaba Cloud are usually the fastest legitimate path from China, and they use no Throughwire data. GitHub, Docker Hub and Hugging Face need a route out of China. Several well-known public Docker Hub mirrors in China closed or were restricted from 2024, so plan Docker pulls around that.

Table of contents

What works, what's slow and what's blocked

When we checked GreatFire's test results from mainland China on 23 October 2026:

  • GitHub is unreliable: 66% of the last 62 tests of github.com showed interference.
  • Docker Hub is blocked: the latest test of hub.docker.com failed.
  • Hugging Face is blocked: all of the last 16 tests of huggingface.co failed.
  • Go's module proxy is unreliable: both recent tests of proxy.golang.org showed interference.
  • The npm registry and PyPI are reachable: the latest tests of registry.npmjs.org and pypi.org connected normally. Large installs still cross busy international links, so they can be slow.

The practical answer is a split setup. Packages come from mirrors inside China, which are usually fast and use no Throughwire data. Everything else goes through Throughwire. On a Throughwire router, that split happens by itself: the mirrors below stay on your normal China line, while GitHub, Docker Hub, Hugging Face, PyPI's and npm's own servers and other international sites go through Throughwire. In our apps, the same China-direct rule applies.

Packages: use domestic mirrors

These mirrors are run in China, serve the same public packages, and are usually the quickest option from a Chinese connection. We checked each one responded on 23 October 2026.

# npm, pnpm: npmmirror
npm config set registry https://registry.npmmirror.com

# Python: Tsinghua TUNA (Alibaba Cloud's https://mirrors.aliyun.com/pypi/simple/ also works)
pip config set global.index-url https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple

# Go modules: goproxy.cn
go env -w GOPROXY=https://goproxy.cn,direct
  • npmmirror copies the public npm registry continuously. Its registry reported packages synced on the day we checked.
  • Tsinghua TUNA mirrors PyPI, Homebrew, Node.js releases, Anaconda, the crates.io index, rustup, Docker CE packages, and Ubuntu, Debian and Alpine, among others.
  • Alibaba Cloud's mirror site covers PyPI, npm, Maven, Go modules, RubyGems, Docker CE packages and the main Linux distributions.
  • goproxy.cn says it also proxies Go's checksum database, so Go's normal integrity checks keep working.

Two habits keep this safe. Commit your lockfiles: npm checks every package against the hashes in package-lock.json, and Go checks go.sum, so a mirror can't quietly change what you install. And if your CI runs outside China, let it use the default registries; the mirrors are for machines in China.

Docker Hub in 2026: what happened to the mirrors

For years, developers in China pulled Docker Hub images through public mirrors. Several have since closed or been restricted, starting in June 2024. Two examples we checked:

  • USTC (University of Science and Technology of China) paused its Docker Hub cache on 6 June 2024, citing force majeure, and its help page still says all image caches are paused (checked 23 October 2026).
  • Alibaba Cloud's image accelerator is now, in its own words, for individual developers only, with no commercial use. Its address works only from Alibaba Cloud ECS servers (other machines get an HTTP 403), and it has stopped syncing the latest images (Alibaba Cloud documentation, checked 23 October 2026).

Community lists of other mirrors change often. An image from a mirror you don't control may be out of date. Pin images by digest (image@sha256:...) so you get exactly what you tested.

What works now:

  1. Pull Docker Hub through Throughwire. On a Throughwire router, docker pull just works, with no daemon settings. Sign in with docker login before you pull: Docker Hub allows 100 pulls per 6 hours per IP address for anonymous users and 200 for signed-in Personal accounts (Docker Docs). Without our dedicated IP add-on, your traffic leaves from an address shared with other customers, so signing in keeps the limit yours.
  2. Run a pull-through cache for a team. Docker documents running its open-source registry as a Docker Hub mirror (Docker Docs). Put one in the office, and each image crosses the border once. Docker notes only Docker Hub can be mirrored this way.
  3. Keep your own images close to where they run. For servers in China, push to a registry in China, such as Alibaba Cloud Container Registry in a mainland region, which stays on your local line. GitHub Container Registry (ghcr.io) goes through Throughwire.

GitHub: HTTPS, SSH and big repositories

On a Throughwire router, GitHub's website, git over HTTPS and git over SSH all go through Throughwire, along with raw.githubusercontent.com, release downloads, GitHub Container Registry and Copilot.

  • HTTPS is the simplest: use a credential helper or a personal access token as usual.
  • SSH works the same way. If SSH hangs on a network that blocks port 22 (some company, hotel and campus networks do), GitHub documents SSH over the HTTPS port. Test with ssh -T -p 443 git@ssh.github.com, then add this to ~/.ssh/config:
Host github.com
    Hostname ssh.github.com
    Port 443
    User git
  • Big repositories download faster and use less data with a shallow or partial clone:
git clone --depth 1 https://github.com/owner/repo.git
git clone --filter=blob:none https://github.com/owner/repo.git

Git LFS files and release binaries count towards your Throughwire data like any other download. For some popular projects, TUNA also mirrors GitHub release files, which stay local.

Hugging Face and model downloads

Hugging Face is blocked in mainland China, so on a Throughwire router it goes through Throughwire. Model weights are large, and they count towards your data: a 15 GB model uses about 15 GB on High Speed and about 37.5 GB on Ultra. Download big models on High Speed, ideally once per office into a shared folder or cache.

Many open models, Qwen among them, are also published on ModelScope, Alibaba's model community. ModelScope is in China, so on our router it stays on your local line and uses no Throughwire data.

AI coding tools such as Copilot, ChatGPT and Claude go through Throughwire, and each provider's own country rules still apply. Our guide to ChatGPT, Claude and Gemini in China explains what each one officially supports.

SSH, remote development and the Ultra route

Typing over SSH, VS Code Remote, remote desktops and chatty database clients feel every millisecond of delay. Data volume is usually small, so this is where our Ultra route earns its 2.5 times data count.

From Shanghai, our app shows typical round trips of about 90 ms to Los Angeles (High Speed), about 30 to 55 ms to Osaka and about 65 to 95 ms to Singapore (both Ultra). We have not published measured latency yet, so treat these as typical. Osaka is the low-delay choice for eastern China.

Where your server is matters too. Ultra helps most when the server is in Asia, for example in Tokyo, Hong Kong or Singapore cloud regions. For a server in the United States, the Los Angeles route is already on the way, so try both and keep the one that feels better. A useful split: SSH and remote desktop sessions on Ultra, big downloads on High Speed.

The setup at a glance

ToolFrom China by defaultFast optionThrough Throughwire or local
npm packagesReachable; large installs can be slownpmmirrornpmmirror local; registry.npmjs.org through Throughwire
Python packagesReachable, large installs can be slowTsinghua TUNA or Alibaba Cloud mirrorMirrors local; pypi.org through Throughwire
Go modulesproxy.golang.org unreliablegoproxy.cngoproxy.cn local; Go's own servers through Throughwire
Linux packages, HomebrewOfficial servers are abroadTUNA or Alibaba Cloud mirrorsMirrors local
Docker HubBlocked; several public mirrors closed or restrictedPull through Throughwire, or an office pull-through cacheThrough Throughwire
Your own container imagesDepends on registryAlibaba Cloud Container Registry (mainland region) for servers in ChinaAlibaba Cloud mainland regions local; ghcr.io through Throughwire
GitHubUnreliableShallow clones; SSH over port 443 if 22 is blockedThrough Throughwire
Hugging FaceBlockedModelScope where the model is published thereHugging Face through Throughwire; ModelScope local
AI coding tools (Copilot, ChatGPT, Claude)Depends on each provider's own rulesSee our AI guideThrough Throughwire

For teams: one router for every laptop and CI box

A Throughwire router covers every machine on the office network: developer laptops, self-hosted CI runners, build servers, test phones and the meeting-room screen. Nobody configures a proxy for git, Docker or npm, and new hires are working the moment they join the Wi-Fi.

  • One plan, one bill. Team plans include 50 team seats, so the same people can use our apps at home or travelling.
  • Cache once, share many times. Put a Docker pull-through cache and a shared model folder on an office machine, so large downloads cross the border once.
  • A fixed company IP. The dedicated IP add-on ($9 a month) gives your office its own static address for services that only accept known IPs.
  • Your own private network. With Zero-Trust Relay, you can run Tailscale, WireGuard or SSH inside Throughwire to reach company servers; we carry it without access to its private contents.

When Throughwire isn't the right choice

  • Everything you use has a domestic mirror, and you deploy only to Chinese clouds. Then you may not need us at all.
  • Production systems need a formal link between China and overseas. That is the job of a cross-border line. Alibaba Cloud's cross-border connections, for example, are operated by China Unicom and need business licence documents (Alibaba Cloud).
  • You need to serve users in China. That is an inbound problem. Services such as the Cloudflare China Network deliver content inside China and require an ICP filing. Throughwire is for people in China reaching the global internet.
  • Your CI moves terabytes a month. Mirrors and caches are cheaper than sending all of it across the border on any plan.

Common questions

Why is GitHub so slow in China?

GitHub isn't fully blocked, but it is unreliable from mainland China: GreatFire found interference in 66% of recent tests. Through Throughwire, GitHub works like any other international site; shallow clones help with very large repositories.

Why does docker pull time out in China?

Docker Hub is blocked in mainland China, and several public Docker Hub mirrors closed or were restricted from 2024. Pull through Throughwire after docker login, or run a pull-through cache in the office.

Should I use npmmirror or the official npm registry?

In China, npmmirror is usually faster and uses no Throughwire data. Keep your lockfile committed so npm checks package hashes.

Do the mirrors use my Throughwire data?

No. On a Throughwire router, npmmirror, TUNA, Alibaba Cloud mirrors, goproxy.cn and ModelScope stay on your normal China line. Only international traffic counts towards your allowance.

Is Ultra worth it for developers?

For SSH, remote desktops and remote development, often yes: the delay is lower and the data volume is small. Keep big downloads on High Speed, where data counts once instead of 2.5 times.

My laptop has the app, but git or Docker ignores it. Why?

Command-line tools often ignore system proxy settings. In Hiddify's settings, set Service mode to VPN rather than "Set system proxy" or "Proxy service only" (on Windows, VPN mode may ask you to run the app as administrator). Or use a Throughwire router, which covers every program on every device.

Details for your IT team

  • Routing (catalog version 2026.10): github.com, githubusercontent.com, ghcr.io, docker.io, docker.com, npmjs.org, pypi.org, pythonhosted.org, golang.org, crates.io and huggingface.co go through Throughwire. npmmirror.com, edu.cn mirrors (TUNA, USTC), aliyun.com, Alibaba Cloud mainland endpoints such as registry.cn-hangzhou.aliyuncs.com, goproxy.cn, gitee.com and modelscope.cn go direct. Anything not identified as China-local goes through Throughwire.
  • Transport: the router runs sing-box and connects with VLESS-REALITY; SSH and other non-web traffic are carried inside the tunnel. QUIC (HTTP/3) to international sites is blocked on the router, so clients fall back to TCP.
  • Routes: High Speed exits in Los Angeles over China Telecom's premium CN2 GIA route. Ultra exits in Osaka or Singapore.