<p>Our customer uses internal network. We have k8s application, some yaml files need to download image from internet. I have a win10 computer and I could ssh internal server and access internet. How to download image and then upload to internal server?</p>

<p>Some image download site would be:</p>

<pre><code>chenliujin/defaultbackend  (nginx-default-backend.yaml)
quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.15.0
</code></pre>

user84592
<blockquote>
  <p>How to download image and then upload to internal server?</p>
</blockquote>

<p>The shortest path to success is</p>

<pre><code>ssh the-machine-with-internet -- 'bash -ec \
  "docker pull quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.15.0 ; \
   docker save quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.15.0"' \
   | ssh the-machine-without-internet -- 'docker load'
</code></pre>

<p>You'll actually need to repeat that <code>ssh machine-without-internet -- docker load</code> bit for every Node in the cluster, otherwise they'll attempt to pull the image when they don't find it already in <code>docker images</code>, which brings us to ...</p>

<p>You are also free to actually cache the intermediate file, if you wish, as in:</p>

<pre><code>ssh machine-with-internet -- 'bash -ec \
  "docker pull quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.15.0 ; \
   docker save -o /some/directory/nginx-ingress-0.15.0.tar quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.15.0"'
scp machine-with-internet /some/directory/nginx-ingress-0.15.0.tar /some/other/place
# and so forth, including only optionally running the first pull-and-save step
</code></pre>

<p>It is entirely possible to use an <code>initContainer:</code> in the PodSpec to implement any kind of pre-loading of docker images before the main Pod's containers attempt to start, but that's likely going to clutter your PodSpec unless it's pretty small and straightforward.</p>

<p>Having said all of that, as @KonstantinVustin already correctly said: having a local docker repository for mirroring the content will save you a ton of heartache</p>
