Proxy cache projects on CloudFerro Cloud
Repeatedly downloading the same public container images can slow deployments and add requests to an external registry.
A proxy cache keeps a copy after the first download and serves later pulls from Container Registry. Setting up a cache project and adapting the container image path lets you use the Docker Hub or GitHub Container Registry examples with your own deployments.
Prerequisites
No. 1 Permission to create a project
Sign in using the portal access instructions and select the intended organization and region. Creating the cache project requires RegistryAdmin. Have its name and quota ready.
No. 2 A client and a public upstream image
Prepare Docker using the Docker prerequisites. Choose a public container image from Docker Hub or GitHub Container Registry. After creating the cache project, use Access tokens and logging in on CloudFerro Cloud to create its Pull token and obtain the full token user name and secret. The public status of the upstream image does not grant anonymous access to a private cache project.
Supported upstream registries
The Management API supports two upstreams:
Upstream |
API value |
|---|---|
Docker Hub (hub.docker.com) |
dockerhub |
GitHub Container Registry (ghcr.io) |
ghcr |
Create a proxy cache project
Select Create project.
Enter the name and the quota.
Turn on Proxy cache and select the upstream registry.
Create the project.
Proxy cache mode is set when the project is created. You cannot convert an existing project. Only public upstream container images are supported. Upstream credentials cannot be configured.
Pull through the cache
Create a Pull token for each private proxy cache project you use. A token for my-project does not grant access to dockerhub-cache or ghcr-cache. The examples below use tokens named cache-pull; replace the project and token names with your own values.
Location |
Container image address |
|---|---|
Docker Hub |
docker.io/library/nginx:1.27 |
Your cache project |
registries.waw4-1.cloudferro.com/dockerhub-cache/library/nginx:1.27 |
The cache address adds your registry endpoint and cache project before the upstream repository path.
For Docker Hub, log in with the token for dockerhub-cache, then put the proxy project in front of the upstream path:
docker login registries.waw4-1.cloudferro.com -u 'robot$dockerhub-cache+cache-pull'
# Docker Hub official image (library/...)
docker pull registries.waw4-1.cloudferro.com/dockerhub-cache/library/nginx:1.27
# Docker Hub organization image
docker pull registries.waw4-1.cloudferro.com/dockerhub-cache/bitnami/redis:7.4
For GHCR, log in with the token for ghcr-cache. Replace <owner>, <image>, and <tag> with the upstream image’s values before running the pull command:
docker login registries.waw4-1.cloudferro.com -u 'robot$ghcr-cache+cache-pull'
docker pull registries.waw4-1.cloudferro.com/ghcr-cache/<owner>/<image>:<tag>
For Docker Hub official container images, include library/. You cannot push to a proxy cache project.
Cached container images count towards the project quota.
After a successful pull, check the cache project’s Repositories tab for the downloaded artifact. The client should also report the pulled container image’s digest.
What to do next
Review the project overview and audit log with Manage registry projects on CloudFerro Cloud.
Check cache storage constraints in Quotas and limits on CloudFerro Cloud.
Investigate pull failures with Troubleshooting and frequently asked questions on CloudFerro Cloud.