Docker pull silently ignoring mirror settings

Question

I'm trying to set up a docker environment where a local, insecure mirror is used to speed up things. It's ok to have it insecure since it's just a local lab environment.

I'm using Sonatype Nexus Repository Manager OSS 3.35.0-02 as the local mirror.

I've set up the docker configuration as per documentation, with:

{
  "registry-mirrors": ["http://192.168.8.10:8181"], 
  "insecure-registries": ["192.168.8.10:8181"]
}

docker info seems to confirm that the settings have been loaded:

Registry: https://index.docker.io/v1/
 Labels:
Experimental: false
Insecure Registries:
 192.168.8.10:8181
 127.0.0.0/8
Registry Mirrors:
 http://192.168.8.10:8181/

Now, I can test that Nexus is working properly because this works:

docker rmi alpine:3.13.3 ; docker pull 192.168.8.10:8181/alpine:3.13.3

in the sense that the image is downloaded and I can see that it appears in the Nexus repo.

But running the plain command:

docker rmi alpine:3.13.4 ; docker pull alpine:3.13.4

seems to bypass the mirror since the image is downloaded, but it doesn't show up in the Nexus repository.

This happens both with macOS BigSur 11.5.1 + Docker Desktop 1.4.0 and a Vagrant VM running Ubuntu Server 20.04 with Docker version 20.10.7, build 20.10.7-0ubuntu1~20.04.2.

Thanks.

Answer 1

While I still haven't solved the problem in a clean way, I found a workaround. Prepending the image name with the mirror name makes the pull operation work fine with the mirror, but the problem is that the image tag keeps the mirror name, i.e.:

$ docker pull 192.168.8.10:8181/alpine:3.13.4
$ docker image ls
REPOSITORY                         TAG               IMAGE ID         CREATED         SIZE
192.168.8.10:8181/alpine           3.13.4            49f356fa4513   2 years ago     5.61MB

But I can fix that by adding a clean tag and removing the 'dirty' one after pulling the image:

$ docker image tag 192.168.8.10:8181/alpine:3.13.4 alpine:3.13.4
$ docker image rm 192.168.8.10:8181/alpine:3.13.4
$ docker image ls
REPOSITORY                       TAG               IMAGE ID       CREATED         SIZE
alpine                           3.13.4            49f356fa4513   2 years ago     5.61MB

Answer 2

Your image name is wrong. There's no equivalent for:

192.168.8.10:8181/alpine:3.13.3

on Docker Hub. When you pull alpine:3.13.4, it is actually pulling docker.io/library/alpine:3.13.4. So your mirror needs to have the following image:

192.168.8.10:8181/library/alpine:3.13.3

And the design of registry mirroring is to always go to the upstream source when the mirror fails. These are mirrors, not an access control system.