Configure Docker OCI

BEFOREhttps://registry-1.docker.io

AFTERhttp://localhost:23333

Docker OCI uses the separate /v2/ route. It is a pull-through cache for images, not a general-purpose registry you can push to. The mirror URL is the Depsilo service root; Docker requests /v2/ itself, so do not append /docker/.

Server-side preparation

The first-run setup does not create a Docker registry

The v0.11.0 Setup Wizard does not generate Docker registry configuration. Add the registry to the server configuration shipped with v0.11.0 and restart before changing clients.

Configure the client

Merge the keys into your existing daemon JSON instead of overwriting it:

/etc/docker/daemon.json

{
  "registry-mirrors": ["http://localhost:23333"],
  "insecure-registries": ["localhost:23333"]
}

insecure-registries is only for HTTP, and Docker must be restarted after the change. containerd and Podman use the same service root; check their own documentation for the exact field.

Verify requests

1. Restart Docker and confirm the mirror

   docker info --format '{{json .RegistryConfig.Mirrors}}'

2. Pull an image

   docker pull alpine:3.20

3. Confirm the traffic in Admin

   Check the /v2/ requests and hit results in Access logs.

Release age uses first observation

Registries expose no portable publish time. Docker’s minimum release age uses the first time this instance saw the digest and must be acknowledged explicitly; unseen digests stay quarantined until the threshold passes. See Supply-chain security.