A Registry Copy Through a Proxy with Skopeo

A machine that can reach an external registry through a proxy can copy an image into an internal registry with Skopeo. Configure the process that performs the copy:

export HTTP_PROXY=http://proxy.example.net:8080
export HTTPS_PROXY=http://proxy.example.net:8080
export NO_PROXY=registry.internal.example

skopeo copy --all \
  docker://registry.public.example/team/image:stable \
  docker://registry.internal.example/team/image:stable

The registry names and image reference are examples. The source goes through the proxy; the internal registry is matched by the bypass entry. For a permitted public-source copy with no proxy credentials configured, the HTTP proxy list can supply candidate HTTP endpoints while that internal bypass remains in place. Adjust that entry to the destination hostname actually used by the command.

docker:// is the image-transport name for registry references. It does not mean the copy is being delegated to a local Docker daemon. Skopeo's registry HTTP transport uses environment proxy discovery unless an embedding application explicitly supplies a different proxy URL.

--all matters when the source reference selects a multi-platform image index or manifest list: it asks to copy all referenced images. Without that choice, a copy can select an image for the current platform rather than reproduce the complete multi-platform reference.

After the copy, downstream machines can use the internal registry's image reference. Their ability to pull it depends on their route to that registry; they do not inherit the environment of the process that performed the copy.