For the past three years, platform teams have been fighting a proxy war against upstream registries. Docker Hub rate limits. Broadcom freezing the free Bitnami catalog. GitHub Container Registry egress quotas. Each incident forces the same question: who actually controls the artifacts your production cluster depends on?
The Flux project just shipped an answer. Flux Mirror, announced on August 12, 2026, is a new CLI plugin that mirrors container images, Helm charts, and OCI artifacts between registries from a declarative configuration file. It is not a cache. It is a selective, policy-driven relocation pipeline with cosign keyless verification, drift detection, and SLSA provenance transfer. And it is Apache 2.0 licensed under the CNCF, which matters now more than ever.
This is the kind of tool platform teams have been improvising with shell scripts and skopeo for years. Flux Mirror replaces the duct tape with something reproducible, auditable, and safe.
Why Artifact Relocation Is a Production Concern
When you reference an image from a registry you do not operate, you inherit that registry’s uptime, rate limits, and retention policy as part of your production architecture. If Docker Hub goes down, your image pull fails. If Broadcom retires a catalog, your Helm charts stop resolving. If an upstream maintainer deletes a tag, your deployment breaks on the next node rotation.
Platform teams know this. They have built pull-through caches, chart-syncer pipelines, and manual mirroring jobs. But existing tools are fragmented. skopeo handles images but not Helm charts. helm pull and helm push handle charts but not OCI artifacts. charts-syncer was a common choice, but it is now under a Broadcom license that permits use only in connection with Broadcom products. That is not an option for teams running a CNCF stack on open infrastructure.
Flux Mirror covers the whole relocation problem in one declarative tool. It mirrors container images (manifests and blobs, byte-for-byte, including multi-arch manifest lists), Helm charts (from classic HTTP/S repositories into deterministic OCI artifacts), and OCI artifacts (the desired-state bundles produced by flux push artifact).
Selective Mirroring Without Data Bloat
One of the most practical features is the selector pipeline: regex → semver → sort → top-N. Instead of mirroring an entire upstream catalog — which wastes storage and bandwidth — you define exactly which versions you depend on. Mirror only the 6.x stream of podinfo, or the last three stable releases of nginx-ingress. The tool filters upstream history down to exactly what your cluster needs.
This prevents the common failure mode where a mirror job copies everything, fills your registry with unused tags, and eventually hits storage limits or retention conflicts. It also means your private registry contains a curated, minimal set of artifacts instead of a chaotic dump.
Verification By Default
Flux Mirror does not just copy blindly. It can enforce cosign keyless signature verification with OIDC identity matching before copying anything. Set a minimum signature age to avoid replay attacks where a recently-signed malicious artifact tries to slip through before revocation propagates.
SBOMs, signatures, and SLSA provenance travel with each artifact via OCI 1.1 referrers when includeReferrers is enabled. That is critical: if your security team requires provenance for every deployed image, you need it to survive the relocation, not get stripped off at the copy boundary.
Authentication supports cloud Workload Identity for ECR, ACR, and GAR, plus token auth, JWKs, and mTLS. The flux mirror login command works on your Docker config, so CI pipelines no longer need the Docker client installed just to authenticate with registries.
Drift Detection as a CI Gate
Flux Mirror uses UNIX-style exit codes that integrate cleanly with CI: 0 for a clean sync, 1 if any tag failed to copy, and 2 if a tag drifted upstream and overwrite is disabled. Drift is reported explicitly — a tag that changed upstream is labeled drifted rather than silently overwritten.
This design means drift detection fails your CI by default. If an upstream image you rely on changed without your knowledge, the mirror job stops and flags it. You can override with --drift-exit-code, but the default posture is conservative: trust nothing, verify everything.
The tool also outputs machine-readable JSON for parsing in CI systems, and the --dry-run mode lets you preview what would be copied before making any changes to your registry.
Getting Started Is Straightforward
Flux Mirror ships through the Flux CLI Plugin System introduced in Flux v2.9. Install it with:
flux plugin install mirror
For production environments, pin the plugin to an immutable digest:
flux plugin install mirror@sha256:<digest>
Configuration is a declarative YAML file defining source registries, destination registries, selectors, and verification policies. Environment variable substitution is supported for credentials that come from CI secrets. There is a --dry-run flag for safe experimentation, and the flux mirror sync command is idempotent: running it twice on unchanged upstreams reports skipped for tags already in place.
What to Watch Before Production Use
Flux Mirror is a powerful tool, but adoption requires a few operational decisions:
Your registry must support OCI 1.1 referrers: If you want signatures and SBOMs to travel with mirrored artifacts, the destination registry needs to implement the OCI 1.1 referrers API. The
zotregistry supports this, as do recent versions of Harbor and GitHub Container Registry. Test this before committing to a storage backend.Cosign verification requires a trust root: Keyless verification depends on your organization having a Sigstore trust policy and Rekor monitoring. If you are not already using cosign, you will need to bootstrap that infrastructure before enforcing verification at the mirror boundary.
The selector pipeline needs tuning: It is easy to accidentally mirror too little (missing a critical patch release) or too much (consuming unnecessary storage). Start conservative: mirror only the major version you are pinned to, with a small top-N buffer. Expand the selector as you gain confidence.
Drift detection can break CI unexpectedly: If an upstream maintainer force-pushes a tag or removes a version you depend on, the mirror job will exit non-zero. Have a plan for manual intervention or selective override in your pipeline.
Classic HelmRepository migration: Teams using Flux’s
HelmRepositorysources for HTTP-based charts will want to migrate toOCIRepositoryover time. Flux Mirror copies HTTP charts into OCI artifacts, which eases that transition but may require changes to your existingHelmReleaseresources.
The Broader Picture: Artifacts Need Ownership
Flux Mirror is part of a broader trend in 2026: platform teams are reclaiming control of their artifact supply chains. Packer v1.16.0 added SLSA provenance for machine images. Sigstore adoption in CI pipelines is accelerating. The CNCF’s software supply chain security survey showed that artifact provenance went from niche compliance requirement to mainstream operational concern in a single year.
The insight driving this trend is simple: you cannot secure what you do not control, and you cannot control what you do not own. Mirror your artifacts, verify them at ingestion, store the proof, and treat upstream as the untrusted boundary it always was.
Bottom Line
Flux Mirror is the artifact relocation tool platform teams have been improvising for years — but done right: declarative, selective, verified, and CNCF-governed. If your production cluster depends on upstream images and Helm charts you do not control, you need a deliberate mirroring strategy. Flux Mirror gives you one that integrates cleanly with the rest of the Flux GitOps toolchain and modern supply chain security practices.
Start with a --dry-run against a small subset of your dependencies, verify the selector output matches your expectations, and then wire the sync command into your CI pipeline with drift detection enabled. Your future incident response self will thank you.
