aws / aws/containers-roadmap

[ECR] [request]: Pull-through cache support for Minimus Registry (reg.mini.dev)

Open
#2,841 0 comments 3 reactions 0 assignees View on GitHub
ECR
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

Support [Minimus Registry](https://docs.minimus.io/enterprise-edition/authentication) (`reg.mini.dev`) as an Amazon ECR pull-through cache upstream. More generally, allow OCI Distribution-compatible upstream registries to be configured by hostname instead of restricting pull-through cache rules to a fixed registry allowlist.

**Which service(s) is this request for?**

Amazon Elastic Container Registry (ECR)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

Kubernetes workloads can use hardened multi-architecture images from Minimus, but those images cannot be routed through account-local ECR pull-through caches. The current `CreatePullThroughCacheRule` API supports a fixed set of upstream registries and rejects `reg.mini.dev` with `UnsupportedUpstreamRegistryException`.

This prevents teams from applying the same ECR-based reliability, lifecycle, access-control, and network-locality model they use for other public registries. Limiting the cache to one or two Minimus repositories does not help because the upstream hostname itself is rejected.

**Are you currently working around this issue?**

The available workarounds are to pull directly from Minimus or maintain scheduled automation that copies selected multi-architecture images into ECR, tracks upstream tag or digest changes, and handles authentication, retries, and lifecycle management. This recreates much of the synchronization behavior that ECR pull-through cache already provides for supported registries.

**Additional context**

* ECR API documentation: https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_CreatePullThroughCacheRule.html
* ECR supported upstream registries: https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html
* Minimus supports synchronization to private registries, but that requires separate mirroring automation: https://docs.minimus.io/manage/self-hosted-registry
* Related requests show demand for standards-based/custom upstream support:
* Self-hosted GitLab: https://github.com/aws/containers-roadmap/issues/2457
* Harbor: https://github.com/aws/containers-roadmap/issues/2622
* JFrog: https://github.com/aws/containers-roadmap/issues/2259

**Attachments**

None.

Contributor guide

Open the contributing guide

Research direction

Start with the CreatePullThroughCacheRule API documentation and the ECR supported upstream registries documentation named in the issue. Define what is required for reg.mini.dev and hostname-configurable OCI-compatible upstreams, including avoiding UnsupportedUpstreamRegistryException; no repository files or tests are identified in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.