Reference: Copying images

Copy image from src to dst.

1. You MUST ensure that the content of the credentials [USERNAME]:[PASSWORD] DOES NOT contain any colons(:) other than the separator one. Otherwise, it is likely that the registry will not be accessed correctly. Of course, we can extend the cred parameters to registry, username and password to avoid this problem. But this increases the complexity of this action.
2. We tend to use Skopeo inside GFW to sync the outside image into the registry inside GFW. When you run this action on self-hosted runner, you MUST ensure that Skopeo installed. Here is an example to use an action-runner-dind with Skopeo.

# You can mirror actions-runner-dind:ubuntu-22.04 first by the following cmd:
# skopeo copy --dest-creds <creds> \ 
# docker://ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner-dind@sha256:cdbd5684259efe90b0d88e656ef2a154f34ce7b1104d892ca6061d96055bc94b \
# docker://registry.cn-hangzhou.aliyuncs.com/coscene/actions-runner-dind:ubuntu-22.04 
FROM registry.cn-hangzhou.aliyuncs.com/coscene/actions-runner-dind:ubuntu-22.04

RUN sudo apt-get update -y \
    && sudo apt-get install -y skopeo

Here is a typical example about maintaining images between the registry outside GFW and the one inside GFW.

We build docker image on GitHub-hosted runner and sync image from the registry outside the GFW to the registry inside GFW on self-hosted runner. If the synchronization fails on self-hosted runner, the job will be done on GitHub-hosted runner as a fallback. This has proven to be the most economically efficient (cost of self-built containers) and time-consuming overall. Practice has shown that it is more difficult and insurmountable to push and pull data from outside the GFW to inside the GFW than to push and pull data from inside the GFW through a reliable network proxy.