registry in k3s
docker pull registry:2
docker run -d --name=registry --restart=always \
  -e REGISTRY_PROXY_REMOTEURL="https://registry-1.docker.io" \
  -e REGISTRY_PROXY_USERNAME=DOCKER_HUB_USERNAME \
  -e REGISTRY_PROXY_PASSWORD=DOCKER_HUB_ACCESS_TOKEN \
  -v /mnt/volume/registry:/var/lib/registry \
  -p 5000:5000 registry:2

# access token from https://hub.docker.com/settings/security

# to run it with containerd
sudo ctr run -d --env REGISTRY_PROXY_REMOTEURL="https://registry-1.docker.io" \

# visit http://192.168.8.45:5000/v2/_catalog
sudo skopeo copy --src-creds=username:password --dest-tls-verify=false \
	docker://docker.io/library/redis:6 \
	docker://192.168.8.45:5000/redis:6

Pushing to a registry configured as a pull-through cache is unsupported. Just add another private registry.