blob: e486a2f86cf140e94ed0b3703eebc561242f0954 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
# Public read-only OCI mirror of the four upstream Google distroless images.
#
# Serving path: public :443 -> edge-nginx (host network, TLS + CrowdSec) ->
# 127.0.0.1:5000 -> this container. The port publish is loopback-only on
# purpose: nothing on any host interface can reach zot directly, so the edge
# vhost is the only entry point.
#
# There is no `auth` block and anonymous users only get `read`, so the registry
# has no push surface at all - not from the internet and not from the LAN.
# Content arrives exclusively through the built-in sync extension pulling from
# gcr.io, which is also why the mirror keeps working while the home Forgejo
# instance (and its runner) is down.
services:
zot:
image: ghcr.io/project-zot/zot:v2.1.23
container_name: zot-mirror
command: ["serve", "/etc/zot/config.json"]
restart: unless-stopped
ports:
- "127.0.0.1:5000:5000"
volumes:
- ./data:/var/lib/registry
- ./config.json:/etc/zot/config.json:ro
logging:
driver: json-file
options:
max-size: "10m"
max-file: "3"
|
