GitLab's Container Virtual Registry is a pull-through cache that consolidates multiple upstream container registries (Docker Hub, Docker Hardened Images at dhi.io, MCR, Quay) behind a single endpoint. Platform engineers configure upstreams once with centralized credentials, and all CI/CD pipelines pull through one URL. The post walks through setup using a Python client API: creating a virtual registry, adding upstreams with optional auth, and updating .gitlab-ci.yml to use the single endpoint. Benchmark results show cached pulls cut pull times roughly in half (e.g., Alpine from 10.3s to 4.2s). The feature is currently in beta and supports configurable cache validity periods, with UI-based configuration also available.
Table of contents
What problem are we actually solving?How it worksWhy this matters for Docker Hardened ImagesSetting it upWhat the numbers look likePractical considerationsConfiguration via UIWhat's nextShare your feedbackRelated resourcesSort: