Does registry-mirrors in daemon.json work for other registries?

No. Docker's documentation says the registry-mirrors setting works for the central Docker Hub only, and that it is currently not possible to mirror another private registry that way. Images from other registries still go straight to their source unless you reference a cache or internal registry by its own host name.

What the setting does

You run the registry image as a pull-through cache by adding a proxy section to its configuration with the remote URL set to Docker Hub's registry. Then you point Docker daemons at that cache by adding a registry-mirrors key to /etc/docker/daemon.json, or by passing a mirror flag to dockerd, and reload Docker.

A minimal daemon file looks like this, with your own host in place of the placeholder:

{
  "registry-mirrors": ["https://mirror.example.internal"]
}

The mirror then handles pulls of Docker Hub images. Pulls of images from other hosts are unaffected.

What this means for a team

If a build pulls from several public registries, only the Docker Hub part benefits from this setting. A reference such as ghcr.io/org/tool or quay.io/org/tool names its own host, so the daemon contacts that host.

To bring those through a cache, reference the cache by name. Many registry tools support a proxy or remote repository that maps a path on your host to an upstream registry. Your image references then say your host, a path, and the repository. That makes the cache explicit in your files, which is also easier to audit.

Limits the docs note

• Mirrors fall under Docker's fair use rules.
• Cache cleanup requires delete to be enabled in the registry configuration.
• The filesystem storage driver is recommended for performance and correctness.
• Removed content is fetched from upstream again on the next request.
• Multiple caches on one backend do not prevent duplicate pulls in a cluster.

Security points that are easy to miss

The proxy section can take a username and password so the mirror can reach private Docker Hub images. The docs warn that anyone using the mirror can then reach those private resources, so the mirror itself needs authentication.

Also, a mirror speeds and steadies pulls. It does not decide whether an image is safe. A cache will happily serve a bad image to every developer. Keep scanning at the point you adopt an image, and pin digests.

If Registry Access Management blocks docker.io, the docs say mirrored images cannot be pulled through the normal path, and the workaround is to pull from the mirror and retag locally.

A short plan

1. List the registry hosts your builds use today.
2. Decide which ones go through a cache, and give each a path on your own host.
3. Rewrite image references to use that path.
4. Authenticate the cache, and keep upstream credentials scoped.
5. Scan on the way in, and block unknown hosts in CI.

Quick check

Safeguard scans container images and records an SBOM per image, regardless of which cache they came through. Try a free scan at gold.safeguard.sh/scan.

Sources

• Docker Docs: Registry as a pull-through cache
• Docker Docs: Registry Access Management

Last reviewed: 19 October 2026.