How to use GitLab Container Virtual Registry with Docker Hardened Images

This article explains how to set up GitLab's Container Virtual Registry as a pull-through cache for managing multiple upstream container registries, with a focus on Docker Hardened Images.

• •Acts as a single endpoint in front of Docker Hub, dhi.io, MCR, and Quay.io, caching images on first pull and serving subsequent pulls from GitLab's storage
• •Centralizes upstream credential management so teams only authenticate to GitLab, eliminating per-team CI/CD credential changes
• •Demonstrates setup via a Python client: creating a virtual registry, adding upstreams with optional credentials and cache validity hours
• •Pull times improve after warm cache (e.g., Alpine: 10.3s → 4.2s, Python 3.13 DHI: 11.6s → ~4s)
• •Supports up to 20 virtual registries per group and 20 upstreams per registry; also configurable via GitLab UI