The bundled rpardini/docker-registry-proxy 0.6.5 nginx config does not
recognise the GCP Artifact Registry redirect URL shape
(``/artifacts-downloads/namespaces/<ns>/repositories/<repo>/downloads/<token>``)
and replies HTTP 500 to every blob fetch. Local matrix-deploy runs that
include images like ``gcr.io/cadvisor/cadvisor`` therefore fail at
``compose pull`` for the prometheus stack.
Add the three Google-owned blob hosts to ``NO_PROXY`` so the systemd
docker daemon goes direct to upstream for those redirects. The bypass
disables caching for those hosts only; every other registry still flows
through the local cache.
Long-term fix tracked in TODO.md: fork rpardini/docker-registry-proxy
and patch nginx's ``proxy_redirect`` / ``sub_filter`` rules to recognise
the new redirect shape, then drop this bypass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduces a `registry-cache` service (rpardini/docker-registry-proxy) in
the `ci` profile that MITM-caches every outbound docker registry pull
made by `infinito`'s inner dockerd, drastically cutting bandwidth on
re-deploys, parallel CI shards, and local fresh-purges.
Wiring (all bind-mounted via compose.yml, no Dockerfile or entry.sh
staging, so edits hot-reload on next container start):
- CA bundle at /opt/registry-cache-ca (read-only),
- systemd drop-in at /etc/systemd/system/docker.service.d/registry-cache-proxy.conf,
- registry-cache-ca.sh at /usr/local/bin/registry-cache-ca.sh.
The drop-in registers registry-cache-ca.sh as ExecStartPre. Compose
gates `infinito` on `registry-cache` `service_healthy` so the CA is on
disk before dockerd boots; the install script supports both Debian
(`update-ca-certificates`) and Arch/Fedora (`update-ca-trust extract`)
trust stores, detected by command availability.
Also reorganizes compose/ into per-service subdirectories
(compose/coredns/, compose/registry-cache/) with README.md per directory
following the documentation guidelines, adds scripts/docker/README.md,
and nests the registry-cache host paths under /tmp/infinito/core/
(mirror/ for blobs, ca/ for the MITM CA bundle).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 4.7