fixing README

Author: ricardop

README.md

@@ -7,34 +7,17 @@ A caching proxy for Docker; allows centralized management of registries and thei
 ### What?
 
 Created as an evolution and simplification of [docker-caching-proxy-multiple-private](https://github.com/rpardini/docker-caching-proxy-multiple-private) 
-using the `HTTPS_PROXY` mechanism and injected CA root certificates instead of `/etc/hosts` hacks and _`--insecure-registry` 
+using the `HTTPS_PROXY` mechanism and injected CA root certificates instead of `/etc/hosts` hacks and `--insecure-registry` 
 
-As a bonus it allows for centralized management of Docker registry credentials. 
+Main feature is Docker layer/image caching, even from S3, Google Storage, etc. As a bonus it allows for centralized management of Docker registry credentials. 
 
 You configure the Docker clients (_err... Kubernetes Nodes?_) once, and then all configuration is done on the proxy -- 
 for this to work it requires inserting a root CA certificate into system trusted root certs.
 
-#### Why not use Docker's own registry, which has a mirror feature?
-
-Yes, Docker offers [Registry as a pull through cache](https://docs.docker.com/registry/recipes/mirror/), *unfortunately* 
-it only covers the DockerHub case. It won't cache images from `quay.io`, `k8s.gcr.io`, `gcr.io`, or any such, including any private registries.
-
-That means that your shiny new Kubernetes cluster is now a bandwidth hog, since every image will be pulled from the 
-Internet on every Node it runs on, with no reuse.
-
-This is due to the way the Docker "client" implements `--registry-mirror`, it only ever contacts mirrors for images 
-with no repository reference (eg, from DockerHub).
-When a repository is specified `dockerd` goes directly there, via HTTPS (and also via HTTP if included in a 
-`--insecure-registry` list), thus completely ignoring the configured mirror.
-
-#### Docker itself should provide this.
-
-Yeah. Docker Inc should do it. So should NPM, Inc. Wonder why they don't. 😼
-
 ### Usage
 
-- Run the proxy on a dedicated machine.
-- Expose port 3128
+- Run the proxy on a host close to the Docker clients
+- Expose port 3128 to the network
 - Map volume `/docker_mirror_cache` for up to 32gb of cached images from all registries
 - Map volume `/ca`, the proxy will store the CA certificate here across restarts
 - Env `REGISTRIES`: space separated list of registries to cache; no need to include Docker Hub, its already there
@@ -71,8 +54,8 @@ Environment="HTTPS_PROXY=http://192.168.66.72:3128/"
 EOD
 
 # Get the CA certificate from the proxy and make it a trusted root.
-curl http://192.168.66.123:3128/ca.crt > /usr/share/ca-certificates/docker_caching_proxy.crt
-echo docker_caching_proxy.crt >> /etc/ca-certificates.conf
+curl http://192.168.66.72:3128/ca.crt > /usr/share/ca-certificates/docker_caching_proxy.crt
+echo "docker_caching_proxy.crt" >> /etc/ca-certificates.conf
 update-ca-certificates --fresh
 
 # Reload systemd
@@ -98,3 +81,21 @@ Test your own registry caching and authentication the same way; you don't need `
 
 - If you authenticate to a private registry and pull through the proxy, those images will be served to any client that can reach the proxy, even without authentication. *beware*
 - Repeat, this will make your private images very public if you're not careful.
+
+#### Why not use Docker's own registry, which has a mirror feature?
+
+Yes, Docker offers [Registry as a pull through cache](https://docs.docker.com/registry/recipes/mirror/), *unfortunately* 
+it only covers the DockerHub case. It won't cache images from `quay.io`, `k8s.gcr.io`, `gcr.io`, or any such, including any private registries.
+
+That means that your shiny new Kubernetes cluster is now a bandwidth hog, since every image will be pulled from the 
+Internet on every Node it runs on, with no reuse.
+
+This is due to the way the Docker "client" implements `--registry-mirror`, it only ever contacts mirrors for images 
+with no repository reference (eg, from DockerHub).
+When a repository is specified `dockerd` goes directly there, via HTTPS (and also via HTTP if included in a 
+`--insecure-registry` list), thus completely ignoring the configured mirror.
+
+#### Docker itself should provide this.
+
+Yeah. Docker Inc should do it. So should NPM, Inc. Wonder why they don't. 😼
+