使用 Squid 缓存不适用于 docker 图像 - 为什么？

Question

（我的第一个问题，请耐心等待）

• 我有一个正在运行的 Squid 代理，带有缓存和 ssl-bump、自签名根 CA 等。
• 我有几个配置为使用 Squid 代理的 Ubuntu 系统
• 我通过官方文档https://docs.docker.com/config/daemon/systemd/#httphttps-proxy将Ubuntu上的docker配置为也使用代理

一般来说 Squid 和缓存工作正常。在 Ubuntu 机器上，浏览器下载被缓存（第二次尝试从缓存中快速下载），apt install 包和 snap 应用程序也被缓存。

我的问题是码头工人。它正常工作并使用代理：

• 代理被禁用时，docker pull 无法连接，所以不会绕过代理
• 拉取图像时，squid 缓存正在填充/大小增加
• 但是当第二次拉取相同的图像时，它正在再次从 Internet 下载并且没有从缓存中获取

将 Squid 设置为调试模式并尝试分析缓存日志，但无法从中找出线索。

还有什么可以尝试/改变的想法吗？这是 Squid/config 问题还是根本不可能？

请注意，我知道 docker proxy 和其他项目试图做到这一点，缓存注册表，如果我在 Squid 上失败了，我可能会这样做，但首先我想用现有的鱿鱼或确保这是不可能的。

谢谢 克里斯

我的鱿鱼配置：

#
# Recommended minimum configuration:
#

# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210     # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280     # http-mgmt
acl Safe_ports port 488     # gss-http
acl Safe_ports port 591     # filemaker
acl Safe_ports port 777     # multiling http
acl CONNECT method CONNECT


#
# Recommended minimum Access Permission configuration:
#

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
#http_port 3128 #default without ssl
http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/cygdrive/d/squid/etc/squid/myca.pem

#security_file_certgen -c -s d:\squid\var\cache\squid\ssl_db -M 4MB
sslcrtd_program /cygdrive/d/squid/lib/squid/security_file_certgen -s /cygdrive/d/squid/var/cache/squid_ssldb -M 4MB
#sslcrtd_children 5
#ssl_bump server-first all
#sslproxy_cert_error deny all


#HTTPS Part
acl step1 at_step SslBump1
acl step2 at_step SslBump2
acl step3 at_step SslBump3

acl ssl_exclude_domains ssl::server_name "/cygdrive/d/squid/etc/squid/ssl_exclude_domains.conf"
acl ssl_exclude_ips     dst              "/cygdrive/d/squid/etc/squid/ssl_exclude_ips.conf"

ssl_bump splice localhost
ssl_bump peek step1 all
ssl_bump splice ssl_exclude_domains
ssl_bump splice ssl_exclude_ips
ssl_bump stare step2 all
ssl_bump bump all

sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER

#max file size
maximum_object_size 6 GB

# Uncomment the line below to enable disk caching - path format is /cygdrive/<full path to cache folder>, i.e.
#cache_dir ufs /cygdrive/d/Squid/var/cache/squid 3000 16 256
cache_dir ufs /cygdrive/d/Squid/squidcache 3000 16 256


# Leave coredumps in the first cache dir
coredump_dir /var/cache/squid

# Add any of your own refresh_pattern entries above these.
refresh_pattern ^ftp:       1440    20% 10080
refresh_pattern ^gopher:    1440    0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
refresh_pattern .       0   20% 4320

dns_nameservers 8.8.8.8 208.67.222.222

max_filedescriptors 3200

Answer 1

将以下内容添加到您的 squid.conf 中引用 /cgi-bin/ 的 refresh_pattern 行之前

refresh_pattern -i (/blobs/sha256)     1440 99% 10080  ignore-no-store ignore-private override-expire store-stale reload-into-ims
refresh_pattern -i (/images/sha256)    1440 99% 10080  ignore-no-store ignore-private override-expire store-stale reload-into-ims
refresh_pattern -i (/manifests/)       1440 99% 10080  ignore-no-store ignore-private override-expire store-stale reload-into-ims