#Tag
Posts tagged "registry"
A mirror saves the download, not the dependency
A pull-through mirror turns repeated image downloads into cache hits, but a cache that re-checks tags and falls back to the origin has not removed the upstream from your availability story. What it must do, and does not by default, is serve the exact manifest it was given, because an image digest is the hash of that manifest.
Stage every lock before you turn one
Turning off anonymous pulls on the registry a fleet boots from is a change that only fails at the next boot, and a node that can't pull at boot may not come back to tell you. So the flip is split in time: the credential staged inert in every node's config, each node rebooted and proven with a real pull, and the door closed only when the last key has turned.