This is the correct answer.

Something that confused me for a while was the path "docker.io" used for pulling containers. There is not actually a container registry at "docker.io" - rather docker and podman are hard coded to convert it to either "registry-1.docker.io" or "index.docker.io".