3f0ecda737
- Add proxy_intercept_errors + error_page for 502/503/504 on blob locations to prevent caching truncated upstream responses (root cause of repeated ImagePullBackOff across services) - Reduce proxy_cache_lock_timeout from 15m to 5m — fail fast, let containerd retry instead of all concurrent pulls waiting on a failed first download - Add proxy_cache_valid any 0 — never cache error responses - Add /healthz endpoints on Docker Hub and GHCR servers - Add draintimeout and proxy.ttl to registry proxy configs
41 lines
871 B
YAML
41 lines
871 B
YAML
version: 0.1
|
|
log:
|
|
fields:
|
|
service: registry
|
|
storage:
|
|
cache:
|
|
blobdescriptor: inmemory
|
|
filesystem:
|
|
rootdirectory: /var/lib/registry
|
|
delete:
|
|
enabled: true
|
|
maintenance:
|
|
uploadpurging:
|
|
enabled: true
|
|
age: 24h
|
|
interval: 4h
|
|
dryrun: false
|
|
readonly:
|
|
enabled: false
|
|
http:
|
|
addr: :5000
|
|
draintimeout: 60s
|
|
headers:
|
|
X-Content-Type-Options: [nosniff]
|
|
debug:
|
|
addr: ":5001"
|
|
# Enable proxy on nodes - https://github.com/containerd/containerd/blob/main/docs/cri/registry.md
|
|
# https://ops.tips/gists/retrieving-docker-registry-metrics-using-prometheus/
|
|
prometheus:
|
|
enabled: true
|
|
path: "/metrics"
|
|
health:
|
|
storagedriver:
|
|
enabled: true
|
|
interval: 10s
|
|
threshold: 3
|
|
proxy:
|
|
remoteurl: https://registry-1.docker.io
|
|
username: vbarzin@gmail.com
|
|
password: ${password}
|
|
ttl: 168h
|