Drevnix Drevnix
Get Started

Simple proxy. Powerful control.

Drevnix is a self-hosted container registry proxy that sits between your Docker clients and upstream registries — ghcr.io, Docker Hub, ECR. Every pull goes through it. No upstream credential ever reaches a developer's machine.

Three-Port Architecture: Proxy, Portal, and API

client
Docker CLI
docker pull
Drevnix Proxy :8000
1. Authenticate client
2. Check permissions
3. Proxy to upstream
4. Cache + audit log
:8001
Web Portal
:8002
REST API
upstream
Registries
ghcr.io
Docker Hub
ECR / GCR
:8000 Public-facing
Proxy

Docker Registry V2 endpoint. This is where docker pull goes. HTTP Basic Auth using client credentials.

:8001 Internal only
Web Portal

Browser-based admin UI. Manage upstreams, clients, permissions, audit logs, and cache.

:8002 Internal only
REST API

Programmatic management. Terraform, Ansible, scripts. HTTP Basic Auth with admin credentials.

How the docker registry proxy handles each pull request

1
Decode client_id:password

HTTP Basic Auth header extracted from the Docker pull request.

2
Verify password hash

bcrypt verification against stored hash. Wrong credentials → 401.

3
Check client expiration

Expired client → 401 Unauthorized. No manual cleanup needed.

4
Match permission pattern

Repository path checked against client's permission entries. No match → 403 Forbidden.

5
Decrypt upstream credentials

AES256-GCM decryption of stored upstream password. In memory only.

6
Proxy request to upstream

Drevnix makes the actual registry request using real credentials.

7
Cache blob (if enabled)

After successful pull, blob layers are cached to local disk per admission policy.

8
Log to audit trail

Pull event written: client, upstream, repo, tag, status, IP, UTC timestamp.

On auth failure
401 Missing / invalid credentials
401 Expired client
403 No matching permission
404 Unknown upstream ID

URL Format

Docker image URLs through Drevnix follow this pattern:

[drevnix-host] / [upstream-id] / [repository] : [tag]
docker pull drevnix.company.com/ghcr/myorg/webapp:v1.2.3 Pull from ghcr.io — upstream ID "ghcr"
docker pull drevnix.company.com/dockerhub/library/nginx:latest Pull nginx from Docker Hub — upstream ID "dockerhub"
docker pull drevnix.company.com/ecr-prod/api-service:stable Pull from AWS ECR — upstream ID "ecr-prod"

Docker Client Setup

Log in with a Drevnix scoped client credential, not your upstream registry password. No shared PATs, no raw upstream keys in CI.

docker pull examples bash 
# Log in using a Drevnix client identity (not your upstream credentials)
docker login drevnix.company.com -u my-app-id -p my-app-password

# Pull from ghcr.io via Drevnix (upstream ID: "ghcr")
docker pull drevnix.company.com/ghcr/myorg/webapp:v1.2.3

# Pull from Docker Hub via Drevnix (upstream ID: "dockerhub")
docker pull drevnix.company.com/dockerhub/library/nginx:latest

# Pull from ECR via Drevnix (upstream ID: "ecr-prod")
docker pull drevnix.company.com/ecr-prod/api-service:stable

In CI (GitHub Actions, GitLab CI, etc.): Store DREVNIX_USER and DREVNIX_PASSWORD as secrets. No upstream credentials (GitHub PAT, ECR keys) ever leave your Drevnix server.

Follow the Quick Start Tutorial