I usually do upstream image mirroring as part of CI. Registries are built into GitLab, AWS (ECR), GitHub, etc