Registry proxy returns an s3 url instead of the cdn endpoint when accessing content blobs. This causes issues for users that haven't whitelisted the s3 direct download endpoint.

This happens because registry proxy is deployed in the same region as quay.io so quay.io will try to return the s3 url to optimize costs. There should be a way to check if the request is coming from registry proxy and avoid sending the s3 url.