diff --git a/evalharness/sandbox/docker.py b/evalharness/sandbox/docker.py
index 860dd8d..3a647fc 100644
--- a/evalharness/sandbox/docker.py
+++ b/evalharness/sandbox/docker.py
@@ -36,14 +36,20 @@ def ensure_image(img: str) -> None:
         return
     if _run(['docker', 'image', 'inspect', img]).returncode == 0:
         return
-    r = _run(['docker', 'pull', img], timeout=1800)
-    if r.returncode != 0:
+    # CN-mirror fallback chain (daocloud -> 1ms.run -> baidubce -> sjtu ->
+    # rat.dev), mirroring the SWE prefetch path; a hit is retagged to the
+    # canonical name so the recipe never knows which mirror answered
+    from .prefetch import _pull_one
+    try:
+        _pull_one(img)
+        return
+    except RuntimeError as e:
         raise RuntimeError(
-            f'sandbox image {img!r} is not available: not local, and '
-            f'docker pull failed: {(r.stderr or "")[:200]}. '
-            'Fix: pull/build it first (for bigcodebench the official image '
+            f'sandbox image {img!r} is not available: not local, and every '
+            f'mirror failed. {str(e)[:200]}. '
+            'Fix: pull/build it manually (for bigcodebench the official image '
             'is bigcodebench/bigcodebench-evaluate:latest), then re-run with '
-            '--rescore to score the cached predictions.')
+            '--rescore to score the cached predictions.') from e
 
 
 @register_sandbox('docker')
diff --git a/evalharness/sandbox/prefetch.py b/evalharness/sandbox/prefetch.py
index ab6fa50..0a9b768 100644
--- a/evalharness/sandbox/prefetch.py
+++ b/evalharness/sandbox/prefetch.py
@@ -21,6 +21,7 @@ from ..data.dataset import Dataset
 # fall through: daemon default -> 1ms.run -> baidubce -> sjtug.
 _CN_MIRROR_FALLBACKS = [
     '{img}',  # daemon default (uses its own registry-mirrors config)
+    'docker.m.daocloud.io/{img}',
     'docker.1ms.run/{img}',
     'mirror.baidubce.com/{img}',
     'docker.mirrors.sjtug.sjtu.edu.cn/{img}',