git-pkgs/proxy

Context We run the proxy as the single entry point for all package installs in our company (PyPI, Cargo, npm, apt). Cooldown and artifact scanning are both enabled. This works well for admission. It does not cover a version that was clean when it was first fetched and becomes vulnerable later. Current behaviour Two mechanisms exist today, and neither can express "block this specificversion": Cooldown filters by publish age. CooldownConfig.Packages is keyed by package PURL, so a per-package override changes the delay for the whole package, not for one version. Artifact scanning can block a specific version, but only runs on a cache miss, the scan happens after the artifact is staged and before it is committed to the cache DB. Once an artifact is cached, later requests are served from storage and never re-scanned. The practical consequences are: A cached version that later gets a CVE keeps being served until it is manually removed from storage and the DB. Even after eviction, the bloc

Support the containerd ns query parameter for multi-registry mirroring The container handler currently routes /v2/ requests by path only: unprefixed names go to the default registry (upstream.oci_default), and named upstreams require the reserved upstream/{name}/ path prefix. containerd's hosts.toml mirror mechanism instead appends ?ns=<registry-host> to every request (see containerd hosts.md), which the handler ignores today. Multi-registry mirroring therefore needs one hosts.toml per registry with override_path = true pointing at the matching prefix; wildcard setups (certs.d/_default, k3s mirrors: "*") cannot work at all, because the mirror never learns which registry a request is for. Add ns support so a single host entry can mirror every configured registry. Requirements Treat ns as a closed-world lookup key, never a dial target: resolve Docker Hub aliases (docker.io, index.docker.io, registry-1.docker.io) and the host of the configured oci_default to the default route, and hosts

I recently got an error that need a manual restart from the container because he wasn't able to connect to Docker DNS just after a computer restart. Here is the log : time=2026-08-15T20:45:11.343Z level=ERROR msg="failed to get auth token" error="Get "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/redis:pull\": dial tcp: lookup auth.docker.io on 127.0.0.11:53: server misbehaving" Probably git-pkgs/proxy should retry a Docker Hub authentication/DNS request to make sure it doesn't stay stuck in a not authentificated loop and need a manual restart. I just restart manually the contain and it fixed it (like 4 hours after the PC reboot completely), but it still a manual step that couldn't always be made quick

It would be great, if the same information from ./proxy --version would also be available in the web UI. Maybe in the footer, right below the GitHub link. Use case This would it make easy to see, if I'm running on an recent version. Example Implementation note I'm a total go novice, so I couldn't get that over the finish line (yet). A hardcoded string from dashboard.go over templates.go into footer.html works. But I am unsure how to nicely pass it from main.go. Passing it as constructor of Server could work, but I don't know if this is go-like enough. Happy to get any pointers into the right direction here.

PR #199 makes cached image pulls work when the registry or token service is unavailable, but two narrower offline-cache gaps remain: /v2/{name}/tags/list is always proxied upstream. After warming the cache, disable the upstream registry and request the tag list. The request fails instead of serving a cached or stale response. Manifest cache keys include the raw Accept header. Warm a manifest with one Accept ordering, disable the upstream registry, then request the same reference with a compatible reordered or differently spaced value. The cache key differs, so the offline request can miss an otherwise usable cached manifest. Cached tag listings should support stale fallback. Compatible manifest media-type requests should share cached variants without serving a representation the client did not accept. Observed on PR #199 at 52a02c3, based on main at bbea63f. These are follow-ups and should not block PR #199.