I had a private registry container that was causing this issue. my fix for this was to re-push the affected images. the manifests from a recent change were affected. the only change that I had done was to move the underlying registry folder on the local docker instance node from /docker-registry to /mnt/nfs/docker-registry. When I rsync'd the files, something must have affected the manifest sha sum. Not sure if that is the "exact" root cause, but that's the only thing I can think happened, and the fix was to repush the images, which was super fast since all the layers were already present, it created a new manifest sha sum instantly and I was able to pull again.