Container Images

What is a pull-through cache?

A pull-through cache sits between a container client and an upstream registry. The first time an image is requested, the service pulls it from the upstream registry and caches it. Later requests can use the local cache, reducing repeated Internet transfers and improving pull speeds on campus. If an image is not yet cached, the first pull still depends on the availability and network performance of the upstream registry.

This service is available only from the ZJU campus network and does not require authentication. Do not publish the proxy address to off-campus users or use it as a public-facing service dependency.

This service maintains an allowlist, and only images on the allowlist are served. The allowlist is based on allows.txt from the DaoCloud public-image-mirror project: that file is the public list of the m.daocloud.io mirroring service, which has completed ICP filing in China, so the images it allows are guaranteed to be compliant and safe.

If an image you need is not on the allowlist, please open an issue at DaoCloud/public-image-mirror to request its addition.

Usage

Add registry.mirrors.zjusct.io/ before the original image name and retain the original registry hostname. For example:

docker pull registry.mirrors.zjusct.io/ghcr.io/owner/image:tag
docker pull registry.mirrors.zjusct.io/registry.k8s.io/pause:3.10
docker pull registry.mirrors.zjusct.io/quay.io/prometheus/prometheus:latest

Docker Hub images

Docker Hub image names often omit the registry hostname, and official images also omit the library/ namespace. Both parts must be explicit when pulling through this proxy:

In other words:

• if an image name has no registry hostname, add hub.docker.com/;
• if it has only one path component, it is a Docker Official Image, so also add library/;
• finally, add registry.mirrors.zjusct.io/ before the complete name.

The same complete image name works in Pod manifests, Compose files, and other tools compatible with OCI/Docker registries. For example:

image: registry.mirrors.zjusct.io/hub.docker.com/library/redis:7

Proxied registries

Proxy caches are currently available for these upstream registries: