mirror of the Docker Registry

[rrgadeev]

Hello, I'm connecting to the docker

Deployed dragonfly 2.4.1 and client 1.2.10.
Docker version 29.2.1, works with containerd support.

I have set up a docker connection to dragonfly:

/etc/docker/certs.d/harbor.domain.local/hosts.toml

[host."http://127.0.0.1:4001"]
  capabilities = ["pull", "resolve"]
  skip_verify = false
[host."http://127.0.0.1:4001".header]
  X-Dragonfly-Registry = "https://harbor.domain.local"

And lo and behold, it works, it would be nice if you added it to the documentation. This would make it much easier for me to implement.

My question is how to set up a mirror via harbor.

Current mirror setup docker.io:
/etc/docker/certs.d/docker.io/hosts.toml

server = "https://registry-1.docker.io"
[host."https://harbor.domain.local/v2/docker.io"]
  capabilities = ["pull", "resolve"]
  override_path = true
  skip_verify = false

It surprisingly works.

I would like to wrap the mirror in some way. docker.io in dragonfly, so that the request goes to harbor.domen.local.
Is there a way to do this using dragonfly?

[rrgadeev]

I managed to do it, but it's unstable.
/etc/docker/certs.d/docker.io/hosts.toml

server = "https://registry-1.docker.io"
[host."http://127.0.0.1:4001/v2/docker.io"]
  capabilities = ["pull", "resolve"]
  skip_verify = false
  override_path = true
[host."http://127.0.0.1:4001".header]
  X-Dragonfly-Registry = "https://harbor.infotecs.int/v2/docker.io"

The first step

docker pull rikorose/gcc-cmake:gcc-11
gcc-11: Pulling from rikorose/gcc-cmake
failed to copy: httpReadSeeker: failed open: could not fetch content descriptor sha256:5108ffd04035e3b91c6be8d01bafbce77d85c54b8d9d25fb56e7ec3d44371e6a (application/vnd.docker.container.image.v1+json) from remote: not found

/var/log/dragonfly/dfdaemon/dfdaemon.log
2026-03-12T15:36:07.670436200+03:00 ERROR download_task: dragonfly-client/src/grpc/dfdaemon_download.rs:339: download started failed by error: backend error: 401 Unauthorized host_id="*****" task_id="5108ffd04035e3b91c6be8d01bafbce77d85c54b8d9d25fb56e7ec3d44371e6a" peer_id="*****"" url="https://harbor.domain.local/v2/docker.io/v2/rikorose/gcc-cmake/blobs/sha256:5108ffd04035e3b91c6be8d01bafbce77d85c54b8d9d25fb56e7ec3d44371e6a?ns=docker.io" remote_ip="127.0.0.1"
2026-03-12T15:36:07.670995631+03:00 ERROR handler:registry_mirror_http_handler:http_handler:proxy_via_dfdaemon: dragonfly-client/src/proxy/mod.rs:719: download task failed: Backend { message: "401 Unauthorized", header: {"x-request-id": "61167cd5-a353-4115-8513-28a8b3d54534", "date": "Thu, 12 Mar 2026 12:36:12 GMT", "server": "nginx", "content-length": "272", "connection": "keep-alive", "set-cookie": "sid=6d6d86b8a22dba8ecedb263ce97734b6; Path=/; HttpOnly", "content-type": "application/json; charset=utf-8"}, status_code: Some(401) } url="/v2/rikorose/gcc-cmake/blobs/sha256:5108ffd04035e3b91c6be8d01bafbce77d85c54b8d9d25fb56e7ec3d44371e6a?ns=docker.io" method="GET" remote_ip="127.0.0.1"

The second step

docker pull rikorose/gcc-cmake:gcc-11
gcc-11: Pulling from rikorose/gcc-cmake
059986997be8: Pulling fs layer
97953ded330d: Pulling fs layer
d28ba3bddf26: Pull complete
bf411e1e4e47: Pull complete
4910eb151521: Pulling fs layer
ecab85705b51: Pull complete
fb3d00b829e6: Pulling fs layer
d458df13ef56: Pull complete
795ac78071c7: Pulling fs layer
9dc71acfb689: Pulling fs layer
failed to copy: httpReadSeeker: failed open: could not fetch content descriptor sha256:97953ded330d5d6a4f7e7f82423165481164c9cdadf4205485d343b53c0cf98a (application/vnd.docker.image.rootfs.diff.tar.gzip) from remote: not found

/var/log/dragonfly/dfdaemon/dfdaemon.log

2026-03-12T15:39:43.494322690+03:00 ERROR download_task: dragonfly-client/src/grpc/dfdaemon_download.rs:339: download started failed by error: backend error: 401 Unauthorized host_id="*****" task_id="97953ded330d5d6a4f7e7f82423165481164c9cdadf4205485d343b53c0cf98a" peer_id="*****" url="https://harbor.domain.local/v2/docker.io/v2/rikorose/gcc-cmake/blobs/sha256:97953ded330d5d6a4f7e7f82423165481164c9cdadf4205485d343b53c0cf98a?ns=docker.io" remote_ip="127.0.0.1"
2026-03-12T15:39:43.494614720+03:00 ERROR handler:registry_mirror_http_handler:http_handler:proxy_via_dfdaemon: dragonfly-client/src/proxy/mod.rs:719: download task failed: Backend { message: "401 Unauthorized", header: {"set-cookie": "sid=a107ad01caf5d2af7358b13ec0291f90; Path=/; HttpOnly", "connection": "keep-alive", "server": "nginx", "content-type": "application/json; charset=utf-8", "date": "Thu, 12 Mar 2026 12:39:47 GMT", "x-request-id": "7d185930-4df1-4e5e-81ff-ce24c7d9383b", "content-length": "272"}, status_code: Some(401) } url="/v2/rikorose/gcc-cmake/blobs/sha256:97953ded330d5d6a4f7e7f82423165481164c9cdadf4205485d343b53c0cf98a?ns=docker.io" method="GET" remote_ip="127.0.0.1"
2026-03-12T15:39:43.498484722+03:00 ERROR dragonfly-client/src/proxy/mod.rs:221: failed to serve connection from 127.0.0.1:46502: connection closed before message completed
2026-03-12T15:39:43.498572212+03:00 ERROR dragonfly-client/src/proxy/mod.rs:221: failed to serve connection from 127.0.0.1:47560: connection closed before message completed
2026-03-12T15:39:43.498739032+03:00 ERROR dragonfly-client/src/proxy/mod.rs:221: failed to serve connection from 127.0.0.1:47598: connection closed before message completed
2026-03-12T15:39:43.498824022+03:00 ERROR dragonfly-client/src/proxy/mod.rs:221: failed to serve connection from 127.0.0.1:46474: connection closed before message completed
2026-03-12T15:39:43.498915722+03:00 ERROR dragonfly-client/src/proxy/mod.rs:221: failed to serve connection from 127.0.0.1:46486: connection closed before message completed

The third step

docker pull rikorose/gcc-cmake:gcc-11
gcc-11: Pulling from rikorose/gcc-cmake
059986997be8: Pull complete
4910eb151521: Pull complete
ecab85705b51: Pull complete
d458df13ef56: Pull complete
d28ba3bddf26: Pull complete
fb3d00b829e6: Pull complete
97953ded330d: Pull complete
9dc71acfb689: Pull complete
795ac78071c7: Pull complete
bf411e1e4e47: Pull complete
Digest: sha256:a6f5dd4d85f842361a6111c556c8e69bae576d2257ed1cb300ea356730e24888
Status: Downloaded newer image for rikorose/gcc-cmake:gcc-11
docker.io/rikorose/gcc-cmake:gcc-11

/var/log/dragonfly/dfdaemon/dfdaemon.log
2026-03-12T15:42:28.358019539+03:00  INFO download_task: dragonfly-client/src/grpc/dfdaemon_download.rs:498: download task succeeded host_id="*****" task_id="97953ded330d5d6a4f7e7f82423165481164c9cdadf4205485d343b53c0cf98a" peer_id="*****" url="https://harbor.domain.local/v2/docker.io/rikorose/gcc-cmake/blobs/sha256:97953ded330d5d6a4f7e7f82423165481164c9cdadf4205485d343b53c0cf98a?ns=docker.io" remote_ip="127.0.0.1" content_length=196419961
2026-03-12T15:42:28.433462219+03:00  INFO handler:registry_mirror_http_handler:http_handler:proxy_via_dfdaemon: dragonfly-client/src/proxy/mod.rs:917: message is none url="/v2/docker.io/rikorose/gcc-cmake/blobs/sha256:97953ded330d5d6a4f7e7f82423165481164c9cdadf4205485d343b53c0cf98a?ns=docker.io" method="GET" remote_ip="127.0.0.1" host_id="*****"  task_id="97953ded330d5d6a4f7e7f82423165481164c9cdadf4205485d343b53c0cf98a" peer_id="*****"

Apparently, at some point in harbor, the docker image appears in the cache and the client starts pumping it out.
I'll probably give up on this mirroring for now, but it might be useful to you.

[yyzai384]

Based on my analysis of the Dragonfly docs and dfdaemon source behavior, here is a configuration worth trying:

/etc/docker/certs.d/docker.io/hosts.toml

server = "https://registry-1.docker.io"

[host."http://127.0.0.1:4001/v2/docker.io"]
capabilities = ["pull", "resolve"]
override_path = true
skip_verify = false

[host."http://127.0.0.1:4001/v2/docker.io".header]
X-Dragonfly-Registry = "https://harbor.domain.local"

dfdaemon constructs the upstream URL by replacing the host while keeping the original request path intact. For example, a request to:

http://127.0.0.1:4001/v2/devops/rockylinux/manifests/...

becomes the upstream:

https://index.docker.io/v2/devops/rockylinux/manifests/...

This means if we set X-Dragonfly-Registry = "https://harbor.domain.local/v2/docker.io", the upstream URL would incorrectly double the /v2 prefix:

https://harbor.domain.local/v2/docker.io/v2/library/alpine/manifests/...

Instead, by using override_path = true with the endpoint http://127.0.0.1:4001/v2/docker.io, containerd should send the request to dfdaemon already prefixed with the Harbor proxy-cache project path:

/v2/docker.io/library/alpine/manifests/...

Dfdaemon then swaps the host using X-Dragonfly-Registry = "https://harbor.domain.local" and produces:

https://harbor.domain.local/v2/docker.io/library/alpine/manifests/...

This matches Harbor's expected API path while keeping Dragonfly in the middle for P2P acceleration.