Product

Content-addressed all the way down

A registry is a content-addressed blob store with a manifest convention. Getting that right is most of the job.

Details that matter

Cross-repo dedup

Blob identity is global within your organisation, so pushing the same layer into a second repository costs nothing.

Referrers API

SBOMs, signatures, scan results and provenance attach to the image digest and travel with it on copy.

Multi-arch done right

Index manifests with per-platform scanning results, and retention rules that never orphan one architecture.

Fast on cold pulls

Blobs are served from NVMe with range support, so a 4 GB layer streams at line rate on the first pull too.

Immutable tags, optionally

Per-repository setting. Once on, a tag cannot be moved — which removes an entire class of deployment mystery.

Garbage collection online

Unreferenced blobs are swept continuously, with no read-only maintenance window.

Working with it

bash

docker login es-mirror-01.tabserv.link
docker tag api:latest es-mirror-01.tabserv.link/acme/api:2026.8.1
docker push es-mirror-01.tabserv.link/acme/api:2026.8.1

bash

# configure once
ch cache create --upstream docker.io --ttl 168h

# then in the cluster
image: es-mirror-01.tabserv.link/cache/docker.io/library/postgres:17

json

{
  "rules": [
    {"match": "tag ~ '^v\\d+\\.\\d+\\.\\d+$'", "keep": "forever"},
    {"match": "tag ~ '^pr-'", "keep": "14d"},
    {"match": "untagged", "keep": "48h"},
    {"match": "last_pulled > 180d", "keep": "0"}
  ],
  "dry_run": true
}

json

{
  "admission": {
    "require_signature": true,
    "trusted_keys": ["acme-release"],
    "block_on": {"severity": "critical", "fixable": true},
    "exempt_namespaces": ["kube-system"]
  }
}