A mirror saves the download, not the dependency

A pull-through mirror turns repeated image downloads into cache hits, but a cache that re-checks tags and falls back to the origin has not removed the upstream from your availability story. What it must do, and does not by default, is serve the exact manifest it was given, because an image digest is the hash of that manifest.

• security
• supply-chain
• registry
• zot
• containers
• talos
• homelab