Skip to content
ObiquityObiquity
Log inStart free
Free · 500 pulls / month

Serve container images from your own domain

Obiquity puts your domain in front of the registry you already use. Point DNS at us, map paths to upstreams, and your users pull from example.com while the bytes still come straight from Docker Hub, Quay, or GHCR*.

Start freeSee pricing

No credit card. One domain and 500 pulls a month.

* Not affiliated with Docker, Red Hat, GitHub, Google, or Amazon.

Before

# your registry account is in the URL, forever
$ docker pull docker.io/originaluser/myimage:latest

After

# same image, same bytes, your brand
$ docker pull example.com/myimage:latest
latest: Pulling from example.com/myimage
Status: Downloaded newer image for example.com/myimage:latest
Obiquity answers with a 307 to your upstream — clients follow it automatically.

How it works

Three steps, and the only thing you change outside Obiquity is a DNS record.

  1. 1example.com

    Add your domain

    Tell Obiquity which hostname you want to serve images from — an apex like example.com or a subdomain like registry.example.com.

  2. 2A + TXT

    Point DNS at us

    Copy two records from the dashboard: an A record so pulls reach Obiquity, and a TXT record that proves you own the domain.

  3. 3307 → upstream

    Pull from your domain

    We issue TLS automatically and redirect each manifest and blob request straight to your upstream registry. No proxying, no extra hop for bytes.

One domain, many upstreams

Each domain has an ordered list of routes. A route matches part of the image name and rewrites it onto an upstream registry and namespace. The first match wins, so put your specific rules above the catch-all.

  • internal/* matches the prefix and everything beneath it.
  • * is a catch-all fallback for anything unmatched.
  • Strip the matched prefix or keep it — your call, per route.
  • Every save runs a live check against the upstream so typos surface immediately.
registry.example.com
1internal/*quay.io/myorgstrip prefix
2tools/*ghcr.io/myorgstrip prefix
3*docker.io/myuser
docker pull registry.example.com/internal/api:v2
→ quay.io/myorg/api:v2

Why teams point their domain at Obiquity

Any OCI-compliant upstream

Docker Hub, Quay, GHCR, Artifact Registry, ECR Public — or anything else that speaks the Distribution API.

Automatic TLS

Certificates are issued and renewed for your domain the first time it's pulled. There's nothing to install or rotate.

Path-based routing

Send internal/* to Quay and everything else to Docker Hub. Rules are evaluated first-match-wins and reorderable by drag.

Migrate registries silently

Change the upstream behind a route and every consumer keeps pulling the same URL. No doc updates, no broken manifests.

Rate limits follow the puller

Redirects hand the client off to the upstream directly, so anonymous pull limits apply per end user — not pooled through us.

Usage analytics

Pulls over time, top images and tags, client tooling breakdown, and a warning when requests stop matching a route.

Scope, plainly: Obiquity redirects pulls for public images. Pushes and private upstream registries aren't supported yet — they need a different mechanism than redirects and are on the roadmap.

Put your domain on your images

The free tier covers a domain and 500 pulls a month — enough to move a project over and see it work end to end.

Create a free accountCompare tiers