Registry Whitelist

[RafaB15]

Hello! My team is currently evaluating migrating our image builds in a Kubernetes cluster to BuildKit in rootless mode. We currently use Kaniko, but it has been archived.

One behavior we would like to maintain is pulling images only from our own private registry. This could be achieved in Kaniko by specifying a registry mirror and using --skip-default-registry-fallback, so it would not try to go to Docker Hub if the image could not be found in the repository.

I know we can establish mirrors in the buildkitd.toml file, but these don't suffice, since it will still attempt to reach other registries or fall back to them.

Is there any way within BuildKit to tell buildkitd to only use a specific set of registries in order and fail if the image cannot be found there? Sort of like a registry whitelist.

Thanks in advance for any information!