{"id":34848275,"url":"https://github.com/metorial/cargo-bay","last_synced_at":"2026-04-27T14:01:38.163Z","repository":{"id":328239019,"uuid":"1114741679","full_name":"metorial/cargo-bay","owner":"metorial","description":"A read-only Docker registry proxy with JWT authentication and local blob caching. ","archived":false,"fork":false,"pushed_at":"2025-12-12T20:22:22.000Z","size":44,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-12-13T02:02:58.388Z","etag":null,"topics":["cache","docker","docker-registry","proxy","security"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/metorial.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-11T20:22:00.000Z","updated_at":"2025-12-12T20:22:26.000Z","dependencies_parsed_at":"2025-12-13T04:00:56.313Z","dependency_job_id":null,"html_url":"https://github.com/metorial/cargo-bay","commit_stats":null,"previous_names":["metorial/cargo-bay"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/metorial/cargo-bay","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metorial%2Fcargo-bay","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metorial%2Fcargo-bay/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metorial%2Fcargo-bay/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metorial%2Fcargo-bay/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/metorial","download_url":"https://codeload.github.com/metorial/cargo-bay/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/metorial%2Fcargo-bay/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32339290,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T23:26:28.701Z","status":"online","status_checked_at":"2026-04-27T02:00:06.769Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cache","docker","docker-registry","proxy","security"],"created_at":"2025-12-25T18:57:14.596Z","updated_at":"2026-04-27T14:01:38.152Z","avatar_url":"https://github.com/metorial.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cargo Bay\n\nA read-only Docker registry proxy with JWT authentication and local blob caching. Great for providing controlled access to upstream Docker registries for on-premise environments.\n\nPublished to GitHub Container Registry as `ghcr.io/metorial/cargo-bay`.\n\n## Features\n\n- JWT-based authentication with per-repository access control\n- Local repository name mapping to upstream registries\n- Automatic blob caching with size and age limits\n- Support for authenticated upstream registries\n- Read-only operations (only pull allowed; push is always denied)\n\n## Configuration\n\nThe service is configured using a TOML file. Copy `config.example.toml` to `config.toml` and adjust:\n\n### Server Settings\n\n```toml\n[server]\nbind_address = \"0.0.0.0\"\nport = 5000\n```\n\n### Authentication\n\n```toml\n[auth]\njwt_secret = \"your-secret-key-change-this-in-production\"\n```\n\n### Cache Configuration\n\n```toml\n[cache]\ndirectory = \"/var/cache/docker-registry-proxy\"\nmax_size_bytes = 10737418240  # 10 GB\nmax_age_seconds = 604800       # 7 days\n```\n\nThe cache automatically cleans up entries that exceed the age limit or when the total size exceeds the configured maximum.\n\n### Registry Configuration\n\nDefine upstream registries that the proxy will connect to:\n\n```toml\n[[registries]]\nid = \"dockerhub\"\nurl = \"https://registry-1.docker.io\"\n\n[[registries]]\nid = \"private-registry\"\nurl = \"https://private-registry.example.com\"\n\n[registries.auth]\nusername = \"registry-user\"\npassword = \"registry-password\"\n```\n\n### Repository Mapping\n\nMap local repository names to upstream registries:\n\n```toml\n[[repositories]]\nname = \"alpine\"\nregistry_id = \"dockerhub\"\nupstream_name = \"library/alpine\"\n\n[[repositories]]\nname = \"myapp\"\nregistry_id = \"private-registry\"\nupstream_name = \"team/application\"\n```\n\nWith this configuration, clients can pull `alpine` from Docker Hub using:\n```bash\ndocker pull localhost:5000/alpine:latest\n```\n\n### Environment Variables\n\n- `CONFIG_PATH`: Path to the configuration file (default: `config.toml`)\n- `RUST_LOG`: Log level (default: `docker_registry_proxy=info`)\n\n## Running the Service\n\n### Using Docker\n\n```bash\ndocker pull ghcr.io/metorial/cargo-bay:latest\n\ndocker run -d \\\n  -p 5000:5000 \\\n  -v $(pwd)/config.toml:/app/config.toml:ro \\\n  -v /var/cache/docker-registry-proxy:/var/cache/docker-registry-proxy \\\n  ghcr.io/metorial/cargo-bay:latest\n```\n\n## Authentication\n\nGenerate JWT tokens for Docker client authentication:\n\n```bash\ncargo run --example generate_jwt -- \u003csecret\u003e \u003cusername\u003e\n\ncargo run --example generate_jwt -- \u003csecret\u003e \u003cusername\u003e alpine,nginx\n```\n\nUse the generated token with Docker:\n\n```bash\ndocker login localhost:5000\n# Username: \u003cusername\u003e\n# Password: \u003cgenerated-jwt-token\u003e\n\ndocker pull localhost:5000/alpine:latest\n```\n\n## API Endpoints\n\nThe proxy implements the Docker Registry HTTP API V2:\n\n- `GET /v2/` - Version check and authentication\n- `GET /v2/{repository}/manifests/{reference}` - Fetch image manifest\n- `GET /v2/{repository}/blobs/{digest}` - Fetch blob (with caching)\n- `HEAD /v2/{repository}/blobs/{digest}` - Check blob existence\n- `GET /v2/{repository}/tags/list` - List available tags\n\nWrite operations (PUT, DELETE) return a 403 Forbidden response.\n\n## License\n\nLicensed under the Apache License, Version 2.0. See the [LICENSE](LICENSE) file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmetorial%2Fcargo-bay","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmetorial%2Fcargo-bay","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmetorial%2Fcargo-bay/lists"}