From cloud registries
Hosted registries integrate with their platform's identity and billing. They charge for storage and egress, use expiring tokens, and may enforce pull-rate limits. peryx can host images or cache a cloud registry so each base layer crosses the upstream boundary once.
- Amazon ECR offers a
pull-through cache for a fixed set
of upstreams, but the cache is per-repository and its images still bill against
ECR storage and data-transfer pricing; auth is a 12-hour token from
aws ecr get-login-password, so every runner re-logs in. - GitHub Container Registry (GHCR) hosts images but has no pull-through cache of Docker Hub, so a build that pulls a public base image still hits Docker Hub and its rate limits on every cold runner.
- Google Artifact Registry has remote (pull-through) and virtual (aggregation) Docker repositories (the closest cloud analog to peryx's model, split across resource types), with metered storage and egress.
- Azure Container Registry caches upstream images with artifact cache, gated behind the Standard/Premium tiers and metered per GiB.
Cost and protocol differences
A self-hosted peryx instance has no per-GiB service charge and uses one configuration file. Its content-addressed blob store spans indexes, so one fetched base layer can serve multiple images. If platform IAM or compliance requires the cloud registry to remain the push target, use peryx as a cached index in front of it.
Configuration mapping
Point a peryx cached OCI index at the registry's /v2/ endpoint; its repository path becomes the index route prefix.
| Registry | /v2/ host | Cached-index credentials |
|---|---|---|
| ECR | {acct}.dkr.ecr.{region}.amazonaws.com | username = "AWS" and the 12-hour get-login-password token as password |
| GHCR | ghcr.io | username and a personal access token with read:packages as password |
| Google Artifact Registry | {loc}-docker.pkg.dev | username = "_json_key_base64" and the encoded service-account key as password |
| Azure ACR | {registry}.azurecr.io | username and a token or service-principal secret as password |
Constraints
- ECR's short-lived tokens make it the one upstream peryx cannot front unattended today; a refresh-command hook is on the roadmap.
- Cloud IAM does not translate: peryx reads are open to its network, pushes are token-gated per index.
- Egress from the registry to peryx is still billed by the provider; the cache means you pay it once per layer.