code: func isCIDRMatch(cidrs []*registrytypes.NetIPNet, URLHost string) bool {
  	host, _, err := net.SplitHostPort(URLHost)
  	if err != nil {
  		// Assume URLHost is of the form `host` without the port and go on.
  		host = URLHost
  	}
  
  	addrs, err := lookupIP(host)
  	if err != nil {
  		ip := net.ParseIP(host)
  		if ip != nil {
  			addrs = []net.IP{ip}
  		}
  
  		// if ip == nil, then `host` is neither an IP nor it could be looked up,
  		// either because the index is unreachable, or because the index is behind an HTTP proxy.
  		// So, len(addrs) == 0 and we're not aborting.
  	}
  
  	// Try CIDR notation only if addrs has any elements, i.e. if `host`'s IP could be determined.
  	for _, addr := range addrs {
  		for _, ipnet := range cidrs {
  			// check if the addr falls in the subnet
  			if (*net.IPNet)(ipnet).Contains(addr) {
  				return true
  			}
  		}
  	}
  
  	return false
  }
docs: // isCIDRMatch returns true if URLHost matches an element of cidrs. URLHost is a URL.Host (`host:port` or `host`)
  // where the `host` part can be either a domain name or an IP address. If it is a domain name, then it will be
  // resolved to IP addresses for matching. If resolution fails, false is returned.