Can Zot work as a pull through cache registry?

[ossfellow]

Hello,
Zot's streamlined design and single binary implementation makes it a great registry choice; so thank you for creating it.

I'd like to use it; however I can't tell from the documentation if Zot can be used as a pull through cache registry if the onDemand attribute of the Sync extension is set to true, or not; or even some other configuration could turn it into such a registry.

I appreciate your insight and clarification.

[rchincha]

@masoudbahar I suppose you are referring to https://zotregistry.io/latest/articles/mirroring/

[ossfellow]

@rchincha, indeed not, as I’ve seen the mirroring feature, which is quite useful.
A pull through cache registry only pulls down an image that is being requested, so, the subsequent pulls will use the local cache, speeding up the operations; it doesn’t pull all the images down, as is the case with a mirror.

Have I misunderstood the Zot’s mirroring capability?

[rchincha]

@masoudbahar, when the sync extension is enabled, zot registry does keep a local copy in its cache and serves future requests from this cache. The trigger to pull from a remote/upstream OCI registry is either poll-driven or ondemand which should only happen once per image.

[ossfellow]

Awesome; so, to configure this all I need to do is to enable Sync extension, and set the onDemand attribute to true, and it’ll only pull down the images requested, not every image stored in the upstream registry; right? 🙂

[rchincha]

Correct. Pls do try and let us know.

[eusebiu-constantin-petu-dbk]

That's correct.

[ossfellow]

Awesome; thank you for explaining how it works.

[ralgozino]

Hi! sorry for writing on an already answered topic, but my question is related to this use case.

I have a zot instance running and configured as you described to act as a pull-through cache, I can see in the logs that the images are being pulled by zot and it is all transparent for the client pulling the image from zot.

The pulled images don't show up neither in the UI nor with the zli image list command. Is this expected? I would like them to show up in there, they are available images just like the others, aren't they? This would be useful to know which images are being used from the remote registries also :)

Thanks!

[ralgozino]

Hi @rchincha , thanks for the tips, it seems that containerd is not working as I thought and it may even not support using a subpath in the mirror address (i.e. ///). I'll need to dig this deeper.

Zot mirroring is working fine 🎉

Thank you for your quick feedback and sorry for wasting your time.

Have a great week!

[DaruZero]

Sorry for replying on an old thread, but I have found a way to configure containerd to work with Zot and subpaths, and I though I'd share it.

You need to include /v2 in the endpoint subpath, like this:

        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          endpoint = ['https://<my zot instance>:8080/v2/docker']

[ralgozino]

Adding v2 seems to do the trick indeed! contianerd is pulling from zot after adding it. Thank you @DaruZero !

[rchincha]

@DaruZero, @ralgozino thanks for the community self-help :)

If there are containerd recipes that you can share, will add them to the documentation at:
https://zotregistry.dev

[ralgozino]

Hi @rchincha

The recipe is essentially what @DaruZero shared, once you've configured the mirror in Zot, you add those two lines to containerd's configuration, where the "docker.io" part in the first line is the registry you wan't to mirror and the endpoint in the second line is a list of mirrors, where you can add your Zot instance. The secret to make it work is to add the v2 path.

Notice that this is valid for containerd 1.x, in 2.x they are changing the configruation format and where to put it. I haven't checked, but I think this could be a good starting point: https://github.com/containerd/containerd/blob/main/docs/cri/registry.md