Container Mirror

Go up to Terms and Definitions

A Container Mirror is a controlled local or internal copy of selected container images and associated metadata obtained from one or more source registries.

The mirror may preserve image names, tags, immutable digests, manifests, platform variants, signatures, attestations, and Provenance.

A Container Mirror allows systems in a restricted, disconnected, or air-gapped environment to retrieve approved container images without direct access to an external container registry.

Within Crucible, container images may be captured, included in a Transfer Bundle, and imported into a Container Mirror inside the target enclave.

controlled local or internal copy of selected container images and associated metadata obtained from one or more source registries

Generalized from container-image distribution, repository mirroring, disconnected operations, software supply-chain management, and platform engineering and specialized for the Crucible architecture and operational model.

A Container Mirror may contain only an approved subset of the images available from its source registries.

The mirror should preserve immutable image digests and associated integrity information so that users can verify that the mirrored image matches the approved source image.

A connected environment captures approved Kubernetes and application container images, records their immutable digests, exports them in a Transfer Bundle, and imports them into a Container Mirror inside an air-gapped enclave.