Skip to main content
github.com, ghcr.io and Docker Hub can be slow or unreachable from mainland China. This page lists the settings that let you install and run Levelrail through other hosts without giving up checksum and signature checks.
Speed from mainland China has not been tested by the project yet. Nothing here is a measured result. The mirror variables below are available from v0.9.4. Earlier releases do not read them.

​
What Levelrail downloads

​
1. Pin the version

Look up the release tag on a machine that can reach GitHub, then pin it. A pinned install does not call the GitHub API to find the latest release.

​
2. Download release files from another host

LEVELRAIL_RELEASE_BASE_URL replaces https://github.com/glincker/levelrail/releases/download. The installer reads <base>/<tag>/<asset>, so your host must keep the same layout. Only https is accepted. Copy levelrail_* binaries, checksums.txt and checksums.txt.sigstore.json byte for byte. The installer still checks the SHA-256 checksum and, when cosign is installed, the signature, whatever host served the files. A copy that was changed fails the check.

​
3. Install Docker through a mirror

When Docker Engine is missing the installer runs the official get.docker.com script. Set LEVELRAIL_DOCKER_MIRROR to Aliyun or AzureChinaCloud to pass that script’s --mirror option.

​
4. Set Docker registry mirrors

Docker pulls images through the daemon, so set registry-mirrors in /etc/docker/daemon.json and restart Docker.
registry-mirrors only applies to Docker Hub. It does not cover ghcr.io, so the control plane and agent images need step 5 or a pinned digest (step 6).
DaoCloud runs a public mirror (m.daocloud.io, docker.m.daocloud.io, ghcr.m.daocloud.io). It is unofficial and community run, not operated or endorsed by Levelrail. It is best effort, can be slow or disappear, and sees which images you pull. Use any mirror you trust, and rely on the digest and signature checks in step 6, not on the mirror.

​
5. Set a registry mirror prefix

LEVELRAIL_REGISTRY_MIRROR is read once by the installer and seeds the runtime setting registry.mirror_prefix. After that you change it live under Settings, in the CLI or through the API, with no restart. The server environment equivalent, used only as the initial value, is APP_REGISTRY_MIRROR_PREFIX. The prefix is put in front of image references the control plane pulls for itself: the node agent image on new nodes and the BuildKit image.
Leave it empty to pull from the original registries.

​
6. Verify what you pulled

A mirror can serve the wrong bytes. Resolve the digest of the image from a trusted place, pull by digest, and verify the signature against the digest. The digest is the same on every host that copies the image faithfully.
Signature lookup needs to reach the registry that holds the signature. If ghcr.io is blocked, point the same command at a mirror that also copied the signature tags, or verify on a machine that can reach ghcr.io and copy the verified digest over. More commands are in Verify a release.

​
Check from the dashboard

The doctor check “Release and image host reachability” tries github.com, ghcr.io and Docker Hub from the control plane with a short timeout. It warns and links here when one of them cannot be reached.
Last modified on November 8, 2026