Policy

How this mirror works

Selection

We only carry generic-cloud and appliance builds published by the distribution maintainers themselves. No custom images, no personal forks, no "optimised" rebuilds.

Verification

Every artefact is fetched over TLS from the upstream URL listed in the download table, hashed with SHA-256 locally, and frozen until the next refresh cycle. If a hash does not match the value on this page, the track is taken offline and re-checked before it comes back.

Refresh cycle

• Rolling tracks (Ubuntu, Debian cloud, Rocky generic-cloud) — checked daily, republished when the upstream file changes.
• Point releases (Alpine cloud images) — checked weekly, kept alongside the previous build.
• Superseded builds are retained for 90 days, then pruned.

Limits

This is a single host with a fixed monthly egress budget, so the mirror is deliberately stingy:

• 2 connections per client IP, 8 in total across the whole host.
• 256 KB/s per connection after the first megabyte, so a full image takes minutes rather than seconds.
• Monthly egress budget — when the month's budget is used up, image downloads return 503 until the 1st of the next month. Pages, hashes and the manifest stay up.
• No hotlinking — requests carrying another site's Referer are refused; direct pulls and browser clicks are fine.

If you need a sustained high-volume pull for CI, use the contact form: we would rather move you to a dedicated host than let one client eat the whole month's budget.

What we do not do

No request logging beyond aggregate counters, no cookies, no analytics scripts, no advertising. The mirror serves static files and nothing else.