Failing to get pull through on demand cache working

[NetAppBlueDevil]

I'm trying to get zot working as a pull through cache, but I don't see it requesting to the back end registry before returning 404 to client. I followed this article (https://devopsdaily.eu/articles/2024/using-zot-registry-as-a-pull-through-cache/) and the OCI mirroring article (https://zotregistry.dev/v2.1.7/articles/mirroring/) and haven't been able to get it working.

My config looks like

cat zot-config.yaml

distSpecVersion: "1.0.0-dev"
storage:
rootDirectory: /var/lib/zot
http:
address: "0.0.0.0:5000"
log:
level: debug
extensions:
sync:
enable: true
registries:
- urls:
- "https://registry-1.docker.io"
onDemand: true
tlsVerify: true

My local podman is hitting the zot service

podman pull ubuntu:latest

Resolving "ubuntu" using unqualified-search registries (/root/.config/containers/registries.conf)
Trying to pull localhost:5000/ubuntu:latest...
Error: initializing source docker://localhost:5000/ubuntu:latest: reading manifest latest in localhost:5000/ubuntu: repository name not known to registry

But the logs only show these entries back to back and no attempt to call the back end

{"level":"info","module":"http","component":"session","clientIP":"10.88.0.1:56014","method":"GET","path":"/v2/","statusCode":200,"latency":"0s","bodySize":0,"headers":{"Accept-Encoding":["gzip"],"Docker-Distribution-Api-Version":["registry/2.0"],"User-Agent":["containers/5.34.3 (github.com/containers/image)"]},"goroutine":151,"caller":"zotregistry.dev/zot/pkg/api/session.go:137","time":"2025-08-22T19:37:51.257659583Z","message":"HTTP API"}
{"level":"info","module":"http","component":"session","clientIP":"10.88.0.1:56014","method":"GET","path":"/v2/ubuntu/manifests/latest","statusCode":404,"latency":"0s","bodySize":211,"headers":{"Accept":["application/vnd.oci.image.manifest.v1+json","application/vnd.docker.distribution.manifest.v2+json","application/vnd.docker.distribution.manifest.v1+prettyjws","application/vnd.docker.distribution.manifest.v1+json","application/vnd.docker.distribution.manifest.list.v2+json","application/vnd.oci.image.index.v1+json"],"Accept-Encoding":["gzip"],"Docker-Distribution-Api-Version":["registry/2.0"],"User-Agent":["containers/5.34.3 (github.com/containers/image)"]},"goroutine":151,"caller":"zotregistry.dev/zot/pkg/api/session.go:137","time":"2025-08-22T19:37:51.25892182Z","message":"HTTP API"}

On other threads I found (like #2409) the logs provided by that user show entries for the attempt to obtain the image from the configured remote registry. My log doesn't show any log entries of this activity being tried.

What am I missing?

I'm using this latest docker image of zot
project-zot/zot latest 57b855dc23a9