docker-compose.yml

services:
  redis:
    cap_drop:
        - ALL
    command:
      - --maxmemory
      - 128mb
      - --maxmemory-policy
      - allkeys-lru
    container_name: mirror-redis
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
      - REDIS_DISABLE_COMMANDS=FLUSHDB,FLUSHALL
    image: cgr.dev/chainguard/redis:latest
    init: true
    pull_policy: always
    read_only: false
    restart: always
    sysctls:
        # mitigate TIME-WAIT Assassination hazards in TCP
      - net.ipv4.tcp_rfc1337=1
        # SACK is commonly exploited and rarely used
      - net.ipv4.tcp_sack=0
      - net.ipv4.tcp_dsack=0
      - net.ipv4.tcp_fack=0
        # SSR could impact TCP's performance on a fixed-speed network (e.g., wired)
      - net.ipv4.tcp_slow_start_after_idle=0
    volumes:
      - 'redis_data:/bitnami/redis/data'

  gcr-registry:
    cap_drop:
      - ALL
    container_name: mirror-gcr-registry
    depends_on:
      redis:
        condition: service_started
        restart: true
    environment:
      - REGISTRY_PROXY_REMOTEURL=https://gcr.io
    image: icecodexi/registry:latest
    init: true
    labels:
      - "com.centurylinklabs.watchtower.depends-on=mirror-redis"
    pull_policy: always
    read_only: false
    restart: always
    sysctls:
        # mitigate TIME-WAIT Assassination hazards in TCP
      - net.ipv4.tcp_rfc1337=1
        # SACK is commonly exploited and rarely used
      - net.ipv4.tcp_sack=0
      - net.ipv4.tcp_dsack=0
      - net.ipv4.tcp_fack=0
        # SSR could impact TCP's performance on a fixed-speed network (e.g., wired)
      - net.ipv4.tcp_slow_start_after_idle=0
    volumes:
      - ./config.yml:/etc/docker/registry/config.yml:ro
      - ./data:/var/lib/registry

  k8s-registry:
    cap_drop:
      - ALL
    container_name: mirror-gcr-registry
    depends_on:
      redis:
        condition: service_started
        restart: true
    environment:
      - REGISTRY_PROXY_REMOTEURL=https://registry.k8s.io
    image: icecodexi/registry:latest
    init: true
    labels:
      - "com.centurylinklabs.watchtower.depends-on=mirror-redis"
    pull_policy: always
    read_only: false
    restart: always
    sysctls:
        # mitigate TIME-WAIT Assassination hazards in TCP
      - net.ipv4.tcp_rfc1337=1
        # SACK is commonly exploited and rarely used
      - net.ipv4.tcp_sack=0
      - net.ipv4.tcp_dsack=0
      - net.ipv4.tcp_fack=0
        # SSR could impact TCP's performance on a fixed-speed network (e.g., wired)
      - net.ipv4.tcp_slow_start_after_idle=0
    volumes:
      - ./config.yml:/etc/docker/registry/config.yml:ro
      - ./data:/var/lib/registry

  docker-registry:
    cap_drop:
      - ALL
    container_name: mirror-hub-registry
    depends_on:
      redis:
        condition: service_started
        restart: true
    environment:
      - REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io
    image: icecodexi/registry:latest
    init: true
    labels:
      - "com.centurylinklabs.watchtower.depends-on=mirror-redis"
    ports:
      - "127.0.0.1:5000:5000"
    pull_policy: always
    read_only: false
    restart: always
    sysctls:
        # mitigate TIME-WAIT Assassination hazards in TCP
      - net.ipv4.tcp_rfc1337=1
        # SACK is commonly exploited and rarely used
      - net.ipv4.tcp_sack=0
      - net.ipv4.tcp_dsack=0
      - net.ipv4.tcp_fack=0
        # SSR could impact TCP's performance on a fixed-speed network (e.g., wired)
      - net.ipv4.tcp_slow_start_after_idle=0
    volumes:
      - ./config.yml:/etc/docker/registry/config.yml:ro
      - ./data:/var/lib/registry

  quay-registry:
    cap_drop:
      - ALL
    container_name: mirror-quay-registry
    depends_on:
      redis:
        condition: service_started
        restart: true
    environment:
      - REGISTRY_PROXY_REMOTEURL=https://quay.io
    image: icecodexi/registry:latest
    init: true
    labels:
      - "com.centurylinklabs.watchtower.depends-on=mirror-redis"
    pull_policy: always
    read_only: false
    restart: always
    sysctls:
        # mitigate TIME-WAIT Assassination hazards in TCP
      - net.ipv4.tcp_rfc1337=1
        # SACK is commonly exploited and rarely used
      - net.ipv4.tcp_sack=0
      - net.ipv4.tcp_dsack=0
      - net.ipv4.tcp_fack=0
        # SSR could impact TCP's performance on a fixed-speed network (e.g., wired)
      - net.ipv4.tcp_slow_start_after_idle=0
    volumes:
      - ./config.yml:/etc/docker/registry/config.yml:ro
      - ./data:/var/lib/registry

  caddy:
    cap_add:
      - NET_BIND_SERVICE
    cap_drop:
      - ALL
    container_name: mirror-caddy
    image: icecodexi/caddy:cfdns
    init: true
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
    pull_policy: always
    read_only: false
    restart: always
    sysctls:
        # mitigate TIME-WAIT Assassination hazards in TCP
      - net.ipv4.tcp_rfc1337=1
        # SACK is commonly exploited and rarely used
      - net.ipv4.tcp_sack=0
      - net.ipv4.tcp_dsack=0
      - net.ipv4.tcp_fack=0
        # SSR could impact TCP's performance on a fixed-speed network (e.g., wired)
      - net.ipv4.tcp_slow_start_after_idle=0
    ulimits:
      nproc: 16384
      nofile:
        soft: 16384
        hard: 16384
      memlock:
        soft: 8192
        hard: 16384
    volumes:
      - /usr/local/etc/caddy/:/usr/local/etc/caddy/
      - type: bind
        source: ./caddy/
        target: /etc/caddy/
        read_only: true

volumes:
  redis_data:
    driver: local