diff --git a/data/templates/container/registries.conf.j2 b/data/templates/container/registries.conf.j2
index eb7ff87758..48b3c7c4a9 100644
--- a/data/templates/container/registries.conf.j2
+++ b/data/templates/container/registries.conf.j2
@@ -28,4 +28,10 @@
 {%         set _ = registry_list.append(r) %}
 {%     endfor %}
 unqualified-search-registries = {{ registry_list }}
+{%     for r, r_options in registry.items() if r_options.disable is not vyos_defined %}
+[[registry]]
+location = "{{ r_options.mirror if r_options.mirror is vyos_defined else r }}"
+insecure = {{ 'true' if r_options.insecure is vyos_defined else 'false' }}
+prefix = "{{ r }}"
+{%     endfor %}
 {% endif %}
diff --git a/interface-definitions/container.xml.in b/interface-definitions/container.xml.in
index 04318a7c9d..c8d4bbdd19 100644
--- a/interface-definitions/container.xml.in
+++ b/interface-definitions/container.xml.in
@@ -538,6 +538,20 @@
         <children>
           #include <include/interface/authentication.xml.i>
           #include <include/generic-disable-node.xml.i>
+          <leafNode name="insecure">
+            <properties>
+              <help>Allow registry access over unencrypted HTTP or TLS connections with untrusted certificates</help>
+              <valueless/>
+            </properties>
+          </leafNode>
+          <leafNode name="mirror">
+            <properties>
+              <help>Registry mirror, use host[:port][/path]</help>
+              <constraint>
+                <regex>^(?:[[:alnum:]-]+(?:\.[[:alnum:]-]+)*|(?:[[:digit:]]{1,3}\.){3}[[:digit:]]{1,3}|\[[[:xdigit:]:]+])(?::[[:digit:]]{1,5})?(?:\/[^[:space:]?#]*)?$</regex>
+              </constraint>
+            </properties>
+          </leafNode>
         </children>
       </tagNode>
     </children>