Repository navigation
Periodically re-sync mirrored container images #412
Description
Tags like alpine:3.20 move, but the proxy only rechecks a tag when someone pulls it after metadata_ttl. If nobody does, or the box is offline by then, the cache keeps serving the old digest. Right now the only fix is an external cron job hitting /api/mirror.
I'd like the proxy to handle this itself, something like:
mirror:
schedules:
- images: [pkg:docker/library/alpine@3.20, pkg:docker/library/nginx@stable]
interval: 6hEach run re-checks the tag with If-None-Match, which the manifest code already supports. If the tag hasn't moved, that's a single request. If it has, the run fetches the new manifests and blobs. A failed run leaves the cache untouched. Digest-pinned references can be skipped.
Not sure yet whether old digests should be kept or left to eviction. Some jitter would help avoid Docker Hub rate limits.
Activity
andrew commentedon Oct 10, 2026
Scheduled refresh makes sense once image mirroring is supported in #411. The
/api/mirrorcron workaround currently hits the same unsupported-ecosystem failure, so that needs to come first.A refresh should fetch the replacement manifests and blobs before updating the cached tag, so a failed run leaves the previous image usable. Conditional requests, jitter and skipping digest-pinned references fit that approach.
andrew commentedon Oct 14, 2026
#438 has landed: mirroring an image now checks the tag with a HEAD, walks the image, and only then stores the tag, so a failed run leaves the previous one usable. A scheduled refresh can reuse that mirror run as it is. What's left here is the
mirror.schedulesconfig and the interval loop with jitter.