[itintheory]

Pull-through cache the images. Sure, they could decide you can't pull anymore, or impose problematic rate limits, but you shouldn't add a runtime dependency on their registry in any case.

[morellonet]

Yep, these are just normal OCI compliant images served from a normal OCI compliant registry. You can cache them however you'd like.