infra/modules/docker-registry/config-proxy.yaml.tpl

version: 0.1
log:
  fields:
    service: registry-${name}
storage:
  cache:
    blobdescriptor: inmemory
  filesystem:
    rootdirectory: /var/lib/registry
  delete:
    enabled: true
  maintenance:
    uploadpurging:
      enabled: true
      age: 24h
      interval: 4h
      dryrun: false
http:
  addr: :5000
  draintimeout: 60s
  headers:
    X-Content-Type-Options: [nosniff]
health:
  storagedriver:
    enabled: true
    interval: 10s
    threshold: 3
proxy:
  remoteurl: ${remote_url}
  ttl: 0
[ci skip] Fix pull-through cache for all registries Replace deprecated wildcard containerd mirror with per-registry config_path approach. Add proxy containers for ghcr.io, quay.io, registry.k8s.io, and reg.kyverno.io on the docker-registry VM. Set static IP for docker-registry VM to avoid DHCP issues. 2026-02-14 13:09:03 +00:00			`version: 0.1`
			`log:`
			`fields:`
			`service: registry-${name}`
			`storage:`
			`cache:`
			`blobdescriptor: inmemory`
			`filesystem:`
			`rootdirectory: /var/lib/registry`
			`delete:`
			`enabled: true`
			`maintenance:`
			`uploadpurging:`
			`enabled: true`
			`age: 24h`
			`interval: 4h`
			`dryrun: false`
			`http:`
			`addr: :5000`
harden pull-through cache: intercept errors, reduce lock timeout, add healthz - Add proxy_intercept_errors + error_page for 502/503/504 on blob locations to prevent caching truncated upstream responses (root cause of repeated ImagePullBackOff across services) - Reduce proxy_cache_lock_timeout from 15m to 5m — fail fast, let containerd retry instead of all concurrent pulls waiting on a failed first download - Add proxy_cache_valid any 0 — never cache error responses - Add /healthz endpoints on Docker Hub and GHCR servers - Add draintimeout and proxy.ttl to registry proxy configs 2026-03-23 11:33:06 +02:00			`draintimeout: 60s`
[ci skip] Fix pull-through cache for all registries Replace deprecated wildcard containerd mirror with per-registry config_path approach. Add proxy containers for ghcr.io, quay.io, registry.k8s.io, and reg.kyverno.io on the docker-registry VM. Set static IP for docker-registry VM to avoid DHCP issues. 2026-02-14 13:09:03 +00:00			`headers:`
			`X-Content-Type-Options: [nosniff]`
			`health:`
			`storagedriver:`
			`enabled: true`
			`interval: 10s`
			`threshold: 3`
			`proxy:`
			`remoteurl: ${remote_url}`
registry: set proxy TTL to 0 to prevent stale :latest images Blob caching (content-addressed by SHA256) is unaffected — only manifest re-validation changes. Every pull now checks upstream for the current manifest digest, eliminating stale :latest tag issues. 2026-03-30 00:02:48 +03:00			`ttl: 0`