diff --git a/CHANGES b/CHANGES
index b594cf6ff..9b077cb59 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2897,4 +2897,5 @@
 [8.2.3]
 * mail: give container a static IP
 * firewall: add masquerading rules for containers to reach each other via public IP
+* docker: fix parsing of optional namespace in image refs
 
diff --git a/src/docker.js b/src/docker.js
index 4b1dfa1f8..5187f95bc 100644
--- a/src/docker.js
+++ b/src/docker.js
@@ -80,12 +80,12 @@ function parseImageRef(imageRef) {
     assert.strictEqual(typeof imageRef, 'string');
 
     // a ref is like registry.docker.com/cloudron/base:4.2.0@sha256:46da2fffb36353ef714f97ae8e962bd2c212ca091108d768ba473078319a47f4
-    // registry.docker.com is registry name . cloudron is namespace . base is image name . cloudron/base is repository path
+    // registry.docker.com is registry name . cloudron is (optional) namespace . base is image name . cloudron/base is repository path
     // registry.docker.com/cloudron/base is fullRepositoryName
     const result = { fullRepositoryName: null, registry: null, tag: null, digest: null };
     result.fullRepositoryName = imageRef.split(/[:@]/)[0];
     const parts = result.fullRepositoryName.split('/');
-    result.registry = parts.length === 3 ? parts[0] : null;
+    result.registry = parts[0].includes('.') ? parts[0] : null; // https://docs.docker.com/admin/faqs/general-faqs/#what-is-a-docker-id
     let remaining = imageRef.substr(result.fullRepositoryName.length);
     if (remaining.startsWith(':')) {
         result.tag = remaining.substr(1).split('@', 1)[0];
diff --git a/src/test/docker-test.js b/src/test/docker-test.js
index 6530c7f78..73e2972d0 100644
--- a/src/test/docker-test.js
+++ b/src/test/docker-test.js
@@ -27,5 +27,6 @@ describe('docker', function () {
         expect(docker.parseImageRef('cloudron/base@sha256:xx')).to.eql({ fullRepositoryName: 'cloudron/base', registry: null, tag: null, digest: 'xx' });
         expect(docker.parseImageRef('cloudron/base:4.2.0@sha256:xx')).to.eql({ fullRepositoryName: 'cloudron/base', registry: null, tag: '4.2.0', digest: 'xx' });
         expect(docker.parseImageRef('registry.com/cloudron/base:4.2.0@sha256:xx')).to.eql({ fullRepositoryName: 'registry.com/cloudron/base', registry: 'registry.com', tag: '4.2.0', digest: 'xx' });
+        expect(docker.parseImageRef('registry.com/base:4.2.0@sha256:xx')).to.eql({ fullRepositoryName: 'registry.com/base', registry: 'registry.com', tag: '4.2.0', digest: 'xx' }); // optional namespace
     });
 });