#Docker Configuration

docker:
  enabled: true
  repository:
    - name: docker
      registry: https://registry-1.docker.io
      auth-token-url: https://auth.docker.io/token
      scan-container: true
      codescoring-pull-through-proxy: false
      work-mode: strict_wait

Docker uses standard Registry API v2 endpoints. The repository name from the configuration is not added to the client path.

auth-token-url is the full token endpoint URL. OSA Proxy does not append /token. The field is optional; omit it for registries that do not require a separate token service. OSA Proxy logs a warning when the setting is incorrect.

#Image manifest scanning

The scan-container parameter controls container image manifest checks in CodeScoring before returning them to the client. It is enabled by default (true). When set to false, manifest and layer requests are proxied directly (passthrough) without evaluation.

#Using OSA Proxy as a Docker registry in CodeScoring

To make CodeScoring download image layers through the same OSA Proxy instance:

1. Add OSA Proxy as a container image registry in CodeScoring, using the external proxy address.
2. Enable codescoring-pull-through-proxy: true for the required Docker repository:

docker:
  enabled: true
  repository:
    - name: codescoring-docker
      registry: https://registry-1.docker.io
      auth-token-url: https://auth.docker.io/token
      scan-container: true
      codescoring-pull-through-proxy: true

In this mode, OSA Proxy includes its public address and a temporary bypass token (capability) in the scan request. When CodeScoring performs a reverse pull to inspect image layers, the proxy recognizes the token bound to that specific image and repository and serves the download without triggering recursive scanning.

Operational details:

• codescoring.token is required.
• The bypass token is valid for 2 minutes.
• When Redis is configured, bypass tokens are stored in Redis and shared across all OSA Proxy replicas. Without Redis, local in-memory storage is used, which requires sticky routing or Redis for multi-replica setups.

docker pull osa-proxy.example.com/library/alpine:latest

For Docker Hub, OSA Proxy can be configured as a registry mirror in /etc/docker/daemon.json:

{
  "registry-mirrors": ["https://osa-proxy.example.com"]
}

Restart the Docker daemon after changing the file.

If several Docker repositories are enabled, use subdomains where the subdomain matches repository[*].name:

docker pull docker.osa-proxy.example.com/library/alpine:latest

This is required by Docker Registry API v2 semantics: the client always uses fixed paths such as /v2/... and /token, so the OSA Proxy repository name cannot be added as the first path segment as it is for npm, Maven, or PyPI. With a single Docker repository, OSA Proxy can serve it through the main host. With several Docker repositories, the service selects the repository configuration by the request host.

For example, for this configuration:

docker:
  enabled: true
  repository:
    - name: dockerhub
      registry: https://registry-1.docker.io
      auth-token-url: https://auth.docker.io/token
    - name: company
      registry: https://registry.company.example
      auth-token-url: https://registry.company.example/service/token

clients must use different hostnames:

docker pull dockerhub.osa-proxy.example.com/library/alpine:latest
docker pull company.osa-proxy.example.com/team/image:latest

For this setup, configure wildcard DNS or separate DNS records for the subdomains, a TLS certificate that covers these names, and a reverse proxy/load balancer that forwards requests to OSA Proxy while preserving the original Host.

OSA Proxy builds the authentication URL using the address through which the client accessed it. Docker attestation manifests are returned without scanning.