[ECR] [request]: Pull-through cache support for Minimus Registry (reg.mini.dev)
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Support [Minimus Registry](https://docs.minimus.io/enterprise-edition/authentication) (`reg.mini.dev`) as an Amazon ECR pull-through cache upstream. More generally, allow OCI Distribution-compatible upstream registries to be configured by hostname instead of restricting pull-through cache rules to a fixed registry allowlist.
**Which service(s) is this request for?**
Amazon Elastic Container Registry (ECR)
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Kubernetes workloads can use hardened multi-architecture images from Minimus, but those images cannot be routed through account-local ECR pull-through caches. The current `CreatePullThroughCacheRule` API supports a fixed set of upstream registries and rejects `reg.mini.dev` with `UnsupportedUpstreamRegistryException`.
This prevents teams from applying the same ECR-based reliability, lifecycle, access-control, and network-locality model they use for other public registries. Limiting the cache to one or two Minimus repositories does not help because the upstream hostname itself is rejected.
**Are you currently working around this issue?**
The available workarounds are to pull directly from Minimus or maintain scheduled automation that copies selected multi-architecture images into ECR, tracks upstream tag or digest changes, and handles authentication, retries, and lifecycle management. This recreates much of the synchronization behavior that ECR pull-through cache already provides for supported registries.
**Additional context**
* ECR API documentation: https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_CreatePullThroughCacheRule.html
* ECR supported upstream registries: https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html
* Minimus supports synchronization to private registries, but that requires separate mirroring automation: https://docs.minimus.io/manage/self-hosted-registry
* Related requests show demand for standards-based/custom upstream support:
* Self-hosted GitLab: https://github.com/aws/containers-roadmap/issues/2457
* Harbor: https://github.com/aws/containers-roadmap/issues/2622
* JFrog: https://github.com/aws/containers-roadmap/issues/2259
**Attachments**
None.
Contributor guide
Research direction
Start with the CreatePullThroughCacheRule API documentation and the ECR supported upstream registries documentation named in the issue. Define what is required for reg.mini.dev and hostname-configurable OCI-compatible upstreams, including avoiding UnsupportedUpstreamRegistryException; no repository files or tests are identified in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100