Azure artifact cache ACR for dhi.io (docker hardened images)

Hello @Adami

Configure Artifact cache

To create and configure the cache rule that pulls artifacts from the repository into your cache, follow these steps.

"Follow the steps to create Generic a cache rule"(Not the dhi,io as its not supported).

Navigate to your Azure Container Registry instance.

In the service menu, under Services, select Cache.

Select Create rule.

In the New cache rule pane, enter a Rule name.

For Source, select a login server.

For Repository Path, enter the full repository path to the artifacts you want to cache.

Depending on your source, Authentication might be required. If the Authentication box isn't already checked, and you don't want to use authentication, you can skip this section. Otherwise, ensure the box is checked and add your credentials:

• Select Create new credentials to create a new set of credentials to store the username and password for your source registry. For more information, see create new credentials.
  • To use existing credentials, choose Select credentials from the drop-down menu.
  For Destination, enter the name of the New ACR repository namespace to store cached artifacts. Select Create to create your cache rule.

Create new credentials

Before configuring the credentials, make sure you're able to create and store secrets in the Azure Key Vault and retrieve secrets from the Key Vault.

In your container registry's Cache pane, select Credentials, then select Create credentials.

Enter a Name for the new credentials for your source registry.

Select a Source Authentication. Artifact cache currently supports Select from Key Vault and Enter secret URIs.

For the Select from Key Vault option, create your credentials using Key Vault.

Select Create.

Alternately, you can use Azure RBAC to assign the Key Vault Secrets User role (or a custom role that includes the Microsoft.KeyVault/vaults/secrets/getSecret/action permission) to the system identity.

Azure Container Registry Artifact Cache enforces a fixed allow‑list of supported upstream registries as documented on Microsoft Learn. Since dhi.io is not included in the supported upstream registry list, it is treated as an unsupported login server and rejected during validation. Even though Docker owns dhi.io, it is a separate registry endpoint and is not equivalent to docker.io. Direct caching from dhi.io is therefore not supported today.

“Optimize image pulls with artifact cache in Azure Container Registry” https://learn.microsoft.com/en-us/azure/container-registry/artifact-cache-overview

Under the “Upstream support” section, Microsoft explicitly states:

Artifact cache currently supports the following upstream registries:

docker.io

mcr.microsoft.com

quay.io

public.ecr.aws

ghcr.io

nvcr.io

registry.k8s.io

gcr.io

ecr.*

pkg.dev

This is the exact allow‑list enforced by ACR Artifact Cache validation

Currently only a limited set of upstream registries are supported… There is no option to configure arbitrary registries as upstream. https://github.com/Azure/acr/issues/849

Links :
https://learn.microsoft.com/en-us/azure/container-registry/artifact-cache-portal
Assign Azure roles using the Azure portal
Grant permission to applications to access an Azure Key Vault using Azure RBAC.

Thanks,
Manish Deshpande.