title: Caching with Squid not working for docker images - why?
body: <p>(my first question, so please be patient)</p>
  <ul>
  <li>I have a running Squid proxy with caching and ssl-bump, self signed root-CA etc.</li>
  <li>I have several Ubuntu systems which are configured to use the Squid proxy</li>
  <li>I configured the docker on Ubuntu to also use the proxy via the official documentation <a href="https://docs.docker.com/config/daemon/systemd/#httphttps-proxy" rel="nofollow noreferrer">https://docs.docker.com/config/daemon/systemd/#httphttps-proxy</a></li>
  </ul>
  <p>In general Squid and cache are working fine. On Ubuntu machines Browser downloads are cached (2nd try to download is fast and from cache), apt install packages and also snap applications are cached.</p>
  <p>My problem is the docker. It is working in general and using the proxy:</p>
  <ul>
  <li>When proxy is disabled, docker pull cannot connect, so no bypassing of the proxy</li>
  <li>When pulling an image, squid cache is filling/size increasing</li>
  <li>But when pulled the 2nd time the same image, it is downloading again from Internet and is not taking from the cache</li>
  </ul>
  <p>Set Squid to debug mode and tried to analyze the cache logs, but cannot make a clue out of it.</p>
  <p>Any ideas what else to try/change? Is this a Squid/config problem or not possible at all?</p>
  <p>And please, I am aware of docker proxy and and other projects which try to do exactly this, caching registries and if I will fail with Squid I will probably go that way, but in first place I want to make it with existing squid or be sure it is not possible.</p>
  <p>Thanks
  Chris</p>
  <p>my squid conf:</p>
  <pre><code>#
  # Recommended minimum configuration:
  #
  
  # Example rule allowing access from your local networks.
  # Adapt to list your (internal) IP networks from where browsing
  # should be allowed
  
  acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
  acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
  acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
  acl localnet src fc00::/7       # RFC 4193 local private network range
  acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
  
  acl SSL_ports port 443
  acl Safe_ports port 80      # http
  acl Safe_ports port 21      # ftp
  acl Safe_ports port 443     # https
  acl Safe_ports port 70      # gopher
  acl Safe_ports port 210     # wais
  acl Safe_ports port 1025-65535  # unregistered ports
  acl Safe_ports port 280     # http-mgmt
  acl Safe_ports port 488     # gss-http
  acl Safe_ports port 591     # filemaker
  acl Safe_ports port 777     # multiling http
  acl CONNECT method CONNECT
  
  
  #
  # Recommended minimum Access Permission configuration:
  #
  
  # Only allow cachemgr access from localhost
  http_access allow localhost manager
  http_access deny manager
  
  # Deny requests to certain unsafe ports
  http_access deny !Safe_ports
  
  # Deny CONNECT to other than secure SSL ports
  http_access deny CONNECT !SSL_ports
  
  # We strongly recommend the following be uncommented to protect innocent
  # web applications running on the proxy server who think the only
  # one who can access services on &quot;localhost&quot; is a local user
  #http_access deny to_localhost
  
  #
  # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
  #
  
  # Example rule allowing access from your local networks.
  # Adapt localnet in the ACL section to list your (internal) IP networks
  # from where browsing should be allowed
  http_access allow localnet
  http_access allow localhost
  
  # And finally deny all other access to this proxy
  http_access deny all
  
  # Squid normally listens to port 3128
  #http_port 3128 #default without ssl
  http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/cygdrive/d/squid/etc/squid/myca.pem
  
  #security_file_certgen -c -s d:\squid\var\cache\squid\ssl_db -M 4MB
  sslcrtd_program /cygdrive/d/squid/lib/squid/security_file_certgen -s /cygdrive/d/squid/var/cache/squid_ssldb -M 4MB
  #sslcrtd_children 5
  #ssl_bump server-first all
  #sslproxy_cert_error deny all
  
  
  #HTTPS Part
  acl step1 at_step SslBump1
  acl step2 at_step SslBump2
  acl step3 at_step SslBump3
  
  acl ssl_exclude_domains ssl::server_name &quot;/cygdrive/d/squid/etc/squid/ssl_exclude_domains.conf&quot;
  acl ssl_exclude_ips     dst              &quot;/cygdrive/d/squid/etc/squid/ssl_exclude_ips.conf&quot;
  
  ssl_bump splice localhost
  ssl_bump peek step1 all
  ssl_bump splice ssl_exclude_domains
  ssl_bump splice ssl_exclude_ips
  ssl_bump stare step2 all
  ssl_bump bump all
  
  sslproxy_cert_error allow all
  sslproxy_flags DONT_VERIFY_PEER
  
  #max file size
  maximum_object_size 6 GB
  
  # Uncomment the line below to enable disk caching - path format is /cygdrive/&lt;full path to cache folder&gt;, i.e.
  #cache_dir ufs /cygdrive/d/Squid/var/cache/squid 3000 16 256
  cache_dir ufs /cygdrive/d/Squid/squidcache 3000 16 256
  
  
  # Leave coredumps in the first cache dir
  coredump_dir /var/cache/squid
  
  # Add any of your own refresh_pattern entries above these.
  refresh_pattern ^ftp:       1440    20% 10080
  refresh_pattern ^gopher:    1440    0%  1440
  refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
  refresh_pattern .       0   20% 4320
  
  dns_nameservers 8.8.8.8 208.67.222.222
  
  max_filedescriptors 3200
  </code></pre>