基于Cloudflare Workers的Docker镜像反向代理方案

基于Cloudflare Workers的Docker镜像反向代理方案详解#

‌加速拉取‌：利用Cloudflare全球CDN节点缓存镜像，降低延迟。
‌绕过限制‌：解决部分区域对Docker Hub的访问限制或限速问题。
‌零服务器成本‌：无需自建服务器，完全依赖Cloudflare免费额度。
‌灵活扩展‌：支持自定义缓存策略、请求过滤等高级功能。

适用场景‌：为Docker Hub等公共仓库提供加速镜像，绕过网络限制并提升拉取速度。

1. 域名与Cloudflare基础配置‌#

‌域名托管‌ 将用于镜像加速的域名（如 mirror.example.com）DNS解析托管至Cloudflare，确保代理状态为 ‌**Proxied（橙色云图标）**‌。

‌SSL/TLS设置‌

在Cloudflare控制台中：

1
plaintextCopy CodeSSL/TLS模式 → Full (Strict)
2
边缘证书 → 启用HSTS、最低TLS版本1.2

‌**防火墙规则（可选）**‌ 添加规则拦截高频请求IP或恶意爬虫（例：http.request.uri.path contains "/v2/" && cf.threat_score > 5）。

‌2. 编写并部署Cloudflare Worker#

首先部署一个helloword。注意：应用名称和你cloudflare用户名会影响访问的域名（cloudflare给你分配的）

将下面代码复制到worker.js

1
/**
2
 * Welcome to Cloudflare Workers! This is your first worker.
3
 *
4
 * - Run "npm run dev" in your terminal to start a development server
5
 * - Open a browser tab at http://localhost:8787/ to see your worker in action
6
 * - Run "npm run deploy" to publish your worker
7
 *
8
 * Learn more at https://developers.cloudflare.com/workers/
9
 */
10

11
// _worker.js
12

13
// Docker镜像仓库主机地址
14
let hub_host = 'registry-1.docker.io';
15
// Docker认证服务器地址
16
const auth_url = 'https://auth.docker.io';
17
// 自定义的工作服务器地址
18
let workers_url = 'https://xxx/';
19

20
let 屏蔽爬虫UA = ['netcraft'];
21

22
// 根据主机名选择对应的上游地址
23
function routeByHosts(host) {
24
  // 定义路由表
25
  const routes = {
26
    // 生产环境
27
    "quay": "quay.io",
28
    "gcr": "gcr.io",
29
    "k8s-gcr": "k8s.gcr.io",
30
    "k8s": "registry.k8s.io",
31
    "ghcr": "ghcr.io",
32
    "cloudsmith": "docker.cloudsmith.io",
33
    "nvcr": "nvcr.io",
34

35
    // 测试环境
36
    "test": "registry-1.docker.io",
37
  };
38

39
  if (host in routes) return [ routes[host], false ];
40
  else return [ hub_host, true ];
41
}
42

43
/** @type {RequestInit} */
44
const PREFLIGHT_INIT = {
45
  // 预检请求配置
46
  headers: new Headers({
47
    'access-control-allow-origin': '*', // 允许所有来源
48
    'access-control-allow-methods': 'GET,POST,PUT,PATCH,TRACE,DELETE,HEAD,OPTIONS', // 允许的HTTP方法
49
    'access-control-max-age': '1728000', // 预检请求的缓存时间
50
  }),
51
}
52

53
/**
54
 * 构造响应
55
 * @param {any} body 响应体
56
 * @param {number} status 响应状态码
57
 * @param {Object<string, string>} headers 响应头
58
 */
59
function makeRes(body, status = 200, headers = {}) {
60
  headers['access-control-allow-origin'] = '*' // 允许所有来源
61
  return new Response(body, { status, headers }) // 返回新构造的响应
62
}
63

64
/**
65
 * 构造新的URL对象
66
 * @param {string} urlStr URL字符串
67
 */
68
function newUrl(urlStr) {
69
  try {
70
    return new URL(urlStr) // 尝试构造新的URL对象
71
  } catch (err) {
72
    return null // 构造失败返回null
73
  }
74
}
75

76
function isUUID(uuid) {
77
  // 定义一个正则表达式来匹配 UUID 格式
78
  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[4][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
79

80
  // 使用正则表达式测试 UUID 字符串
81
  return uuidRegex.test(uuid);
82
}
83

84
async function nginx() {
85
  const text = `
86
  <!DOCTYPE html>
87
  <html>
88
  <head>
89
  <title>Welcome to nginx!</title>
90
  <style>
91
    body {
92
      width: 35em;
93
      margin: 0 auto;
94
      font-family: Tahoma, Verdana, Arial, sans-serif;
95
    }
96
  </style>
97
  </head>
98
  <body>
99
  <h1>Welcome to nginx!</h1>
100
  <p>If you see this page, the nginx web server is successfully installed and
101
  working. Further configuration is required.</p>
102

103
  <p>For online documentation and support please refer to
104
  <a href="http://nginx.org/">nginx.org</a>.<br/>
105
  Commercial support is available at
106
  <a href="http://nginx.com/">nginx.com</a>.</p>
107

108
  <p><em>Thank you for using nginx.</em></p>
109
  </body>
110
  </html>
111
  `
112
  return text;
113
}
114

115
async function searchInterface() {
116
  const text = `
117
  <!DOCTYPE html>
118
  <html>
119
  <head>
120
    <title>Docker Hub Search</title>
121
    <style>
122
    body {
123
      font-family: Arial, sans-serif;
124
      display: flex;
125
      flex-direction: column;
126
      align-items: center;
127
      justify-content: center;
128
      height: 100vh;
129
      margin: 0;
130
      background: linear-gradient(to right, rgb(28, 143, 237), rgb(29, 99, 237));
131
    }
132
    .logo {
133
      margin-bottom: 20px;
134
    }
135
    .search-container {
136
      display: flex;
137
      align-items: center;
138
    }
139
    #search-input {
140
      padding: 10px;
141
      font-size: 16px;
142
      border: 1px solid #ddd;
143
      border-radius: 4px;
144
      width: 300px;
145
      margin-right: 10px;
146
    }
147
    #search-button {
148
      padding: 10px;
149
      background-color: rgba(255, 255, 255, 0.2); /* 设置白色，透明度为10% */
150
      border: none;
151
      border-radius: 4px;
152
      cursor: pointer;
153
      width: 44px;
154
      height: 44px;
155
      display: flex;
156
      align-items: center;
157
      justify-content: center;
158
    }
159
    #search-button svg {
160
      width: 24px;
161
      height: 24px;
162
    }
163
    </style>
164
  </head>
165
  <body>
166
    <div class="logo">
167
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 18" fill="#ffffff" width="100" height="75">
168
      <path d="M23.763 6.886c-.065-.053-.673-.512-1.954-.512-.32 0-.659.03-1.01.087-.248-1.703-1.651-2.533-1.716-2.57l-.345-.2-.227.328a4.596 4.596 0 0 0-.611 1.433c-.23.972-.09 1.884.403 2.666-.596.331-1.546.418-1.744.42H.752a.753.753 0 0 0-.75.749c-.007 1.456.233 2.864.692 4.07.545 1.43 1.355 2.483 2.409 3.13 1.181.725 3.104 1.14 5.276 1.14 1.016 0 2.03-.092 2.93-.266 1.417-.273 2.705-.742 3.826-1.391a10.497 10.497 0 0 0 2.61-2.14c1.252-1.42 1.998-3.005 2.553-4.408.075.003.148.005.221.005 1.371 0 2.215-.55 2.68-1.01.505-.5.685-.998.704-1.053L24 7.076l-.237-.19Z"></path>
169
      <path d="M2.216 8.075h2.119a.186.186 0 0 0 .185-.186V6a.186.186 0 0 0-.185-.186H2.216A.186.186 0 0 0 2.031 6v1.89c0 .103.083.186.185.186Zm2.92 0h2.118a.185.185 0 0 0 .185-.186V6a.185.185 0 0 0-.185-.186H5.136A.185.185 0 0 0 4.95 6v1.89c0 .103.083.186.186.186Zm2.964 0h2.118a.186.186 0 0 0 .185-.186V6a.186.186 0 0 0-.185-.186H8.1A.185.185 0 0 0 7.914 6v1.89c0 .103.083.186.186.186Zm2.928 0h2.119a.185.185 0 0 0 .185-.186V6a.185.185 0 0 0-.185-.186h-2.119a.186.186 0 0 0-.185.186v1.89c0 .103.083.186.185.186Zm-5.892-2.72h2.118a.185.185 0 0 0 .185-.186V3.28a.186.186 0 0 0-.185-.186H5.136a.186.186 0 0 0-.186.186v1.89c0 .103.083.186.186.186Zm2.964 0h2.118a.186.186 0 0 0 .185-.186V3.28a.186.186 0 0 0-.185-.186H8.1a.186.186 0 0 0-.186.186v1.89c0 .103.083.186.186.186Zm2.928 0h2.119a.185.185 0 0 0 .185-.186V3.28a.186.186 0 0 0-.185-.186h-2.119a.186.186 0 0 0-.185.186v1.89c0 .103.083.186.185.186Zm0-2.72h2.119a.186.186 0 0 0 .185-.186V.56a.185.185 0 0 0-.185-.186h-2.119a.186.186 0 0 0-.185.186v1.89c0 .103.083.186.185.186Zm2.955 5.44h2.118a.185.185 0 0 0 .186-.186V6a.185.185 0 0 0-.186-.186h-2.118a.185.185 0 0 0-.185.186v1.89c0 .103.083.186.185.186Z"></path>
170
    </svg>
171
    </div>
172
    <div class="search-container">
173
    <input type="text" id="search-input" placeholder="Search Docker Hub">
174
    <button id="search-button">
175
      <svg focusable="false" aria-hidden="true" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
176
      <path d="M21 21L16.65 16.65M19 11C19 15.4183 15.4183 19 11 19C6.58172 19 3 15.4183 3 11C3 6.58172 6.58172 3 11 3C15.4183 3 19 6.58172 19 11Z" stroke="white" fill="none" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"></path>
177
      </svg>
178
    </button>
179
    </div>
180
    <script>
181
    function performSearch() {
182
      const query = document.getElementById('search-input').value;
183
      if (query) {
184
      window.location.href = '/search?q=' + encodeURIComponent(query);
185
      }
186
    }
187

188
    document.getElementById('search-button').addEventListener('click', performSearch);
189
    document.getElementById('search-input').addEventListener('keypress', function(event) {
190
      if (event.key === 'Enter') {
191
      performSearch();
192
      }
193
    });
194
    </script>
195
  </body>
196
  </html>
197
  `;
198
  return text;
199
}
200

201
export default {
202
  async fetch(request, env, ctx) {
203
    const getReqHeader = (key) => request.headers.get(key); // 获取请求头
204

205
    let url = new URL(request.url); // 解析请求URL
206
    const userAgentHeader = request.headers.get('User-Agent');
207
    const userAgent = userAgentHeader ? userAgentHeader.toLowerCase() : "null";
208
    if (env.UA) 屏蔽爬虫UA = 屏蔽爬虫UA.concat(await ADD(env.UA));
209
    workers_url = `https://${url.hostname}`;
210
    const pathname = url.pathname;
211

212
    // 获取请求参数中的 ns
213
    const ns = url.searchParams.get('ns');
214
    const hostname = url.searchParams.get('hubhost') || url.hostname;
215
    const hostTop = hostname.split('.')[0]; // 获取主机名的第一部分
216

217
    let checkHost; // 在这里定义 checkHost 变量
218
    // 如果存在 ns 参数，优先使用它来确定 hub_host
219
    if (ns) {
220
      if (ns === 'docker.io') {
221
        hub_host = 'registry-1.docker.io'; // 设置上游地址为 registry-1.docker.io
222
      } else {
223
        hub_host = ns; // 直接使用 ns 作为 hub_host
224
      }
225
    } else {
226
      checkHost = routeByHosts(hostTop);
227
      hub_host = checkHost[0]; // 获取上游地址
228
    }
229

230
    const fakePage = checkHost ? checkHost[1] : false; // 确保 fakePage 不为 undefined
231
    console.log(`域名头部: ${hostTop}\n反代地址: ${hub_host}\n伪装首页: ${fakePage}`);
232
    const isUuid = isUUID(pathname.split('/')[1].split('/')[0]);
233

234
    if (屏蔽爬虫UA.some(fxxk => userAgent.includes(fxxk)) && 屏蔽爬虫UA.length > 0) {
235
      // 首页改成一个nginx伪装页
236
      return new Response(await nginx(), {
237
        headers: {
238
          'Content-Type': 'text/html; charset=UTF-8',
239
        },
240
      });
241
    }
242

243
    const conditions = [
244
      isUuid,
245
      pathname.includes('/_'),
246
      pathname.includes('/r/'),
247
      pathname.includes('/v2/user'),
248
      pathname.includes('/v2/orgs'),
249
      pathname.includes('/v2/_catalog'),
250
      pathname.includes('/v2/categories'),
251
      pathname.includes('/v2/feature-flags'),
252
      pathname.includes('search'),
253
      pathname.includes('source'),
254
      pathname === '/',
255
      pathname === '/favicon.ico',
256
      pathname === '/auth/profile',
257
    ];
258

259
    if (conditions.some(condition => condition) && (fakePage === true || hostTop == 'docker')) {
260
      if (env.URL302) {
261
        return Response.redirect(env.URL302, 302);
262
      } else if (env.URL) {
263
        if (env.URL.toLowerCase() == 'nginx') {
264
          //首页改成一个nginx伪装页
265
          return new Response(await nginx(), {
266
            headers: {
267
              'Content-Type': 'text/html; charset=UTF-8',
268
            },
269
          });
270
        } else return fetch(new Request(env.URL, request));
271
      } else if (url.pathname == '/'){
272
        return new Response(await searchInterface(), {
273
          headers: {
274
            'Content-Type': 'text/html; charset=UTF-8',
275
          },
276
        });
277
      }
278

279
      const newUrl = new URL("https://registry.hub.docker.com" + pathname + url.search);
280

281
      // 复制原始请求的标头
282
      const headers = new Headers(request.headers);
283

284
      // 确保 Host 头部被替换为 hub.docker.com
285
      headers.set('Host', 'registry.hub.docker.com');
286

287
      const newRequest = new Request(newUrl, {
288
          method: request.method,
289
          headers: headers,
290
          body: request.method !== 'GET' && request.method !== 'HEAD' ? await request.blob() : null,
291
          redirect: 'follow'
292
      });
293

294
      return fetch(newRequest);
295
    }
296

297
    // 修改包含 %2F 和 %3A 的请求
298
    if (!/%2F/.test(url.search) && /%3A/.test(url.toString())) {
299
      let modifiedUrl = url.toString().replace(/%3A(?=.*?&)/, '%3Alibrary%2F');
300
      url = new URL(modifiedUrl);
301
      console.log(`handle_url: ${url}`);
302
    }
303

304
    // 处理token请求
305
    if (url.pathname.includes('/token')) {
306
      let token_parameter = {
307
        headers: {
308
          'Host': 'auth.docker.io',
309
          'User-Agent': getReqHeader("User-Agent"),
310
          'Accept': getReqHeader("Accept"),
311
          'Accept-Language': getReqHeader("Accept-Language"),
312
          'Accept-Encoding': getReqHeader("Accept-Encoding"),
313
          'Connection': 'keep-alive',
314
          'Cache-Control': 'max-age=0'
315
        }
316
      };
317
      let token_url = auth_url + url.pathname + url.search;
318
      return fetch(new Request(token_url, request), token_parameter);
319
    }
320

321
    // 修改 /v2/ 请求路径
322
    if ( hub_host == 'registry-1.docker.io' && /^\/v2\/[^/]+\/[^/]+\/[^/]+$/.test(url.pathname) && !/^\/v2\/library/.test(url.pathname)) {
323
      //url.pathname = url.pathname.replace(/\/v2\//, '/v2/library/');
324
      url.pathname = '/v2/library/' + url.pathname.split('/v2/')[1];
325
      console.log(`modified_url: ${url.pathname}`);
326
    }
327

328
    // 更改请求的主机名
329
    url.hostname = hub_host;
330

331
    // 构造请求参数
332
    let parameter = {
333
      headers: {
334
        'Host': hub_host,
335
        'User-Agent': getReqHeader("User-Agent"),
336
        'Accept': getReqHeader("Accept"),
337
        'Accept-Language': getReqHeader("Accept-Language"),
338
        'Accept-Encoding': getReqHeader("Accept-Encoding"),
339
        'Connection': 'keep-alive',
340
        'Cache-Control': 'max-age=0'
341
      },
342
      cacheTtl: 3600 // 缓存时间
343
    };
344

345
    // 添加Authorization头
346
    if (request.headers.has("Authorization")) {
347
      parameter.headers.Authorization = getReqHeader("Authorization");
348
    }
349

350
    // 发起请求并处理响应
351
    let original_response = await fetch(new Request(url, request), parameter);
352
    let original_response_clone = original_response.clone();
353
    let original_text = original_response_clone.body;
354
    let response_headers = original_response.headers;
355
    let new_response_headers = new Headers(response_headers);
356
    let status = original_response.status;
357

358
    // 修改 Www-Authenticate 头
359
    if (new_response_headers.get("Www-Authenticate")) {
360
      let auth = new_response_headers.get("Www-Authenticate");
361
      let re = new RegExp(auth_url, 'g');
362
      new_response_headers.set("Www-Authenticate", response_headers.get("Www-Authenticate").replace(re, workers_url));
363
    }
364

365
    // 处理重定向
366
    if (new_response_headers.get("Location")) {
367
      return httpHandler(request, new_response_headers.get("Location"));
368
    }
369

370
    // 返回修改后的响应
371
    let response = new Response(original_text, {
372
      status,
373
      headers: new_response_headers
374
    });
375
    return response;
376
  }
377
};
378

379
/**
380
 * 处理HTTP请求
381
 * @param {Request} req 请求对象
382
 * @param {string} pathname 请求路径
383
 */
384
function httpHandler(req, pathname) {
385
  const reqHdrRaw = req.headers;
386

387
  // 处理预检请求
388
  if (req.method === 'OPTIONS' &&
389
    reqHdrRaw.has('access-control-request-headers')
390
  ) {
391
    return new Response(null, PREFLIGHT_INIT);
392
  }
393

394
  let rawLen = '';
395

396
  const reqHdrNew = new Headers(reqHdrRaw);
397

398
  const refer = reqHdrNew.get('referer');
399

400
  let urlStr = pathname;
401

402
  const urlObj = newUrl(urlStr);
403

404
  /** @type {RequestInit} */
405
  const reqInit = {
406
    method: req.method,
407
    headers: reqHdrNew,
408
    redirect: 'follow',
409
    body: req.body
410
  };
411
  return proxy(urlObj, reqInit, rawLen);
412
}
413

414
/**
415
 * 代理请求
416
 * @param {URL} urlObj URL对象
417
 * @param {RequestInit} reqInit 请求初始化对象
418
 * @param {string} rawLen 原始长度
419
 */
420
async function proxy(urlObj, reqInit, rawLen) {
421
  const res = await fetch(urlObj.href, reqInit);
422
  const resHdrOld = res.headers;
423
  const resHdrNew = new Headers(resHdrOld);
424

425
  // 验证长度
426
  if (rawLen) {
427
    const newLen = resHdrOld.get('content-length') || '';
428
    const badLen = (rawLen !== newLen);
429

430
    if (badLen) {
431
      return makeRes(res.body, 400, {
432
        '--error': `bad len: ${newLen}, except: ${rawLen}`,
433
        'access-control-expose-headers': '--error',
434
      });
435
    }
436
  }
437
  const status = res.status;
438
  resHdrNew.set('access-control-expose-headers', '*');
439
  resHdrNew.set('access-control-allow-origin', '*');
440
  resHdrNew.set('Cache-Control', 'max-age=1500');
441

442
  // 删除不必要的头
443
  resHdrNew.delete('content-security-policy');
444
  resHdrNew.delete('content-security-policy-report-only');
445
  resHdrNew.delete('clear-site-data');
446

447
  return new Response(res.body, {
448
    status,
449
    headers: resHdrNew
450
  });
451
}
452

453
async function ADD(envadd) {
454
  var addtext = envadd.replace(/[   |"'\r\n]+/g, ',').replace(/,+/g, ',');  // 将空格、双引号、单引号和换行符替换为逗号
455
  if (addtext.charAt(0) == ',') addtext = addtext.slice(1);
456
  if (addtext.charAt(addtext.length - 1) == ',') addtext = addtext.slice(0, addtext.length - 1);
457
  const add = addtext.split(',');
458
  return add;
459
}

有条件的可以绑定自己的域名，将cloudflare托管域名指向Workers

音乐

音乐

基于Cloudflare Workers的Docker镜像反向代理方案详解#

1. 域名与Cloudflare基础配置‌#

‌2. 编写并部署Cloudflare Worker#

支持与分享

评论区