The ₹300 build‑cache server that cut our Docker CI by 70% (and the day it went stale)

How I put a cheap ₹300 VPS in front of Docker builds to share BuildKit cache between CI and laptops — what sped up, what broke, and the tradeoffs worth knowing.

Written by: Arjun Malhotra

A developer's laptop on a desk with a terminal window open and small server hardware beside it
Photo by Christopher Gower on Unsplash

Friday, 11:42 PM. CI was green for every branch except mine. The pipeline hung pulling layer after layer from Docker Hub, timing out on our office connection. I sat with four teammates on a Slack thread, all running the same failing job. Each of us had a 30–60 second layer download; multiplied across dozens of builds a day it meant hours wasted.

We already had self‑hosted runners and cached node_modules, but Docker layers were a different problem: cold pulls from Docker Hub, flaky ISP routing, and rate limits. The obvious fix was “cache the build layers somewhere closer.” The unglamorous answer I shipped: a ₹300 VPS acting as a private BuildKit cache server and lightweight registry mirror. It cut our CI build time by roughly 70% and saved a lot of painful retries. It also taught me exactly when this cheap fix breaks.

Why a cheap VPS works better than Docker Hub for us

What I actually built (short version)

Key commands I used (conceptual; copy with care)

How it changed daily life

The failure I should have anticipated Three weeks in, I forgot about one simple thing: cache staleness. We had a base image that pulled in OS security updates weekly. One Friday a security patch changed a base layer digest; our cache server still had the old layers. CI happily used the cached layers and produced images that skipped a crucial CVE fix. It went unnoticed until a staging scan flagged the vulnerability.

What happened technically: buildx cache is useful because it reuses layers even when the Dockerfile changes, but it only helps when layer digests match. If base images update upstream, relying solely on the cached snapshot breaks the expectation that “latest base = latest security fixes.” The cheap VPS became a single source of truth that could be stale.

How I fixed it (and what I learned)

Tradeoffs that matter

Practical numbers (because you asked)

If you try this, start tiny

What I walked away with A ₹300 server won’t replace good dependency hygiene or the need for secure images, but it turned an unreliable external system (public registry + flaky office net) into a predictable internal one. The rule I now follow: build cache solves iteration speed, but it must be actively refreshed and have a fallback. Cheap infrastructure buys speed, not absolution.