FAQ

You point a hostname you own at Obiquity and map image paths to an upstream registry. When someone runs docker pull your.domain/myimage:latest, we answer with an HTTP 307 redirect to the real registry. The client follows it and downloads layers directly from Docker Hub, Quay, GHCR, or wherever you routed them. We never proxy image bytes.

Yes — or you must otherwise be legally allowed to distribute them through your domain. When you add a hostname you certify that. Impersonating another project or passing off upstream images as your brand is prohibited. Details are in the Terms of Service.

Three things: add the domain in the dashboard, publish the A (and TXT) records we show you, and add at least one route (for example * → docker.io). We verify you own the domain, issue TLS automatically on the first pull, and start redirecting.

Anything that follows HTTP redirects on registry requests: Docker, containerd/nerdctl, Podman, crane, skopeo, and kubelet image pulls. The OCI spec only formally sanctions redirects on blob fetches; in practice those clients follow 307s on manifests too. We don't claim compatibility with every niche client.

Yes. A multi-arch pull fetches an index, then a platform-specific manifest by digest, then layer blobs. We redirect each of those the same way. We don't inspect the body — we only rewrite the URL.

Yes. The free tier's 500 pulls / month is Obiquity's quota. It does not replace the upstream registry's own limits. Because we redirect rather than proxy, the pull happens from the end user's IP against Docker Hub, Quay, GHCR, and so on. Anonymous Docker Hub rate limits, authenticated quotas, and any other upstream policy still apply to whoever is running docker pull. Putting your domain in front of an image does not give you a pooled or higher upstream allowance.

One tagged manifest GET or HEAD — what clients send at the start of docker pull. Layer downloads and multi-arch child manifests fetched by digest are not counted separately, so a single pull doesn't burn dozens of quota units.

One custom domain, 500 Obiquity-metered pulls per month, automatic TLS, routing to public OCI registries, usage analytics, and API keys. Pro ($19/mo, coming soon) raises that to 5,000 pulls and 5 domains. None of those numbers change upstream rate limits — see above.

No. Push needs a real upload session against one registry; a redirect can't stand in for that. Push is planned for the Max tier.

Not on Free (or any current redirect-only route). The client authenticates directly with the upstream after the redirect, so credentials for Obiquity can't be turned into credentials for a private repo. Private upstreams need proxy mode, which is planned for Enterprise and would get its own legal review (Obiquity would then make authenticated requests to upstreams on your behalf).

Malware, phishing, and typosquatting: report abuse or email abuse@obiquity.io. Copyright takedowns: follow the DMCA process. We can suspend the account or delete the domain the same day for a clear report.

Yes. We log image name, status, user-agent, and a salted hash of the client IP — including people and CI systems that never signed up with Obiquity. A hashed IP is still generally personal data, not anonymous. Details are in the Privacy Policy. Raw events are kept about 90 days.