skopeo README

The project's README from github.com/podman-container-tools/skopeo. As one markdown file: README.md.

Skopeo

License GitHub release (latest SemVer) OpenSSF Best Practices

skopeo is a command line utility that performs various operations on container images and image repositories.

skopeo does not require the user to be running as root to do most of its operations.

skopeo does not require a daemon to be running to perform its operations.

skopeo can work with OCI images as well as the original Docker v2 images.

Skopeo works with API V2 container image registries such as docker.io and quay.io registries, private registries, local directories and local OCI-layout directories. Skopeo can perform operations which consist of:

Skopeo operates on the following image and repository types:

Obtaining skopeo

For a detailed description how to install or build skopeo, see install.md.

Skopeo is also available as a Container Image on quay.io. For more information, see the Skopeo Image page.

Inspecting a repository

skopeo is able to inspect a repository on a container registry and fetch images layers. The inspect command fetches the repository's manifest and it is able to show you a docker inspect-like json output about a whole repository or a tag. This tool, in contrast to docker inspect, helps you gather useful information about a repository or a tag before pulling it (using disk space). The inspect command can show you which tags are available for the given repository, the labels the image has, the creation date and operating system of the image and more.

Examples:

Show properties of fedora:latest

$ skopeo inspect docker://registry.fedoraproject.org/fedora:latest
{
    "Name": "registry.fedoraproject.org/fedora",
    "Digest": "sha256:0f65bee641e821f8118acafb44c2f8fe30c2fc6b9a2b3729c0660376391aa117",
    "RepoTags": [
        "34-aarch64",
        "34",
        "latest",
        ...
    ],
    "Created": "2022-11-24T13:54:18Z",
    "DockerVersion": "1.10.1",
    "Labels": {
        "license": "MIT",
        "name": "fedora",
        "vendor": "Fedora Project",
        "version": "37"
    },
    "Architecture": "amd64",
    "Os": "linux",
    "Layers": [
        "sha256:2a0fc6bf62e155737f0ace6142ee686f3c471c1aab4241dc3128904db46288f0"
    ],
    "LayersData": [
        {
            "MIMEType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
            "Digest": "sha256:2a0fc6bf62e155737f0ace6142ee686f3c471c1aab4241dc3128904db46288f0",
            "Size": 71355009,
            "Annotations": null
        }
    ],
    "Env": [
        "DISTTAG=f37container",
        "FGC=f37",
        "container=oci"
    ]
}

Show container configuration from fedora:latest

$ skopeo inspect --config docker://registry.fedoraproject.org/fedora:latest  | jq
{
  "created": "2020-04-29T06:48:16Z",
  "architecture": "amd64",
  "os": "linux",
  "config": {
    "Env": [
      "DISTTAG=f32container",
      "FGC=f32",
      "container=oci"
    ],
    "Cmd": [
      "/bin/bash"
    ],
    "Labels": {
      "license": "MIT",
      "name": "fedora",
      "vendor": "Fedora Project",
      "version": "32"
    }
  },
  "rootfs": {
    "type": "layers",
    "diff_ids": [
      "sha256:a4c0fa2b217d3fd63d51e55a6fd59432e543d499c0df2b1acd48fbe424f2ddd1"
    ]
  },
  "history": [
    {
      "created": "2020-04-29T06:48:16Z",
      "comment": "Created by Image Factory"
    }
  ]
}

Show unverified image's digest

$ skopeo inspect docker://registry.fedoraproject.org/fedora:latest | jq '.Digest'
"sha256:655721ff613ee766a4126cb5e0d5ae81598e1b0c3bcf7017c36c4d72cb092fe9"

Copying images

skopeo can copy container images between various storage mechanisms, including:

$ skopeo copy docker://quay.io/buildah/stable docker://registry.internal.company.com/buildah
$ skopeo copy oci:busybox_ocilayout:latest dir:existingemptydirectory

Deleting images

$ skopeo delete docker://localhost:5000/imagename:latest

Syncing registries

$ skopeo sync --src docker --dest dir registry.example.com/busybox /media/usb

Authenticating to a registry

Private registries with authentication

skopeo uses credentials from the --creds (for skopeo inspect|delete) or --src-creds|--dest-creds (for skopeo copy) flags, if set; otherwise it uses configuration set by skopeo login, podman login, buildah login, or docker login.

$ skopeo login --username USER myregistrydomain.com:5000
Password:
$ skopeo inspect docker://myregistrydomain.com:5000/busybox
{"Tag":"latest","Digest":"sha256:473bb2189d7b913ed7187a33d11e743fdc2f88931122a44d91a301b64419f092","RepoTags":["latest"],"Comment":"","Created":"2016-01-15T18:06:41.282540103Z","ContainerConfig":{"Hostname":"aded96b43f48","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["/bin/sh","-c","#(nop) CMD [\"sh\"]"],"Image":"9e77fef7a1c9f989988c06620dabc4020c607885b959a2cbd7c2283c91da3e33","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"DockerVersion":"1.8.3","Author":"","Config":{"Hostname":"aded96b43f48","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["sh"],"Image":"9e77fef7a1c9f989988c06620dabc4020c607885b959a2cbd7c2283c91da3e33","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"Architecture":"amd64","Os":"linux"}
$ skopeo logout myregistrydomain.com:5000

Using --creds directly

$ skopeo inspect --creds=testuser:testpassword docker://myregistrydomain.com:5000/busybox
{"Tag":"latest","Digest":"sha256:473bb2189d7b913ed7187a33d11e743fdc2f88931122a44d91a301b64419f092","RepoTags":["latest"],"Comment":"","Created":"2016-01-15T18:06:41.282540103Z","ContainerConfig":{"Hostname":"aded96b43f48","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["/bin/sh","-c","#(nop) CMD [\"sh\"]"],"Image":"9e77fef7a1c9f989988c06620dabc4020c607885b959a2cbd7c2283c91da3e33","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"DockerVersion":"1.8.3","Author":"","Config":{"Hostname":"aded96b43f48","Domainname":"","User":"","AttachStdin":false,"AttachStdout":false,"AttachStderr":false,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["sh"],"Image":"9e77fef7a1c9f989988c06620dabc4020c607885b959a2cbd7c2283c91da3e33","Volumes":null,"WorkingDir":"","Entrypoint":null,"OnBuild":null,"Labels":null},"Architecture":"amd64","Os":"linux"}

$ skopeo copy --src-creds=testuser:testpassword docker://myregistrydomain.com:5000/private oci:local_oci_image

Contributing

Please read the contribution guide if you want to collaborate in the project.

Commands

Command Description
skopeo-copy(1) Copy an image (manifest, filesystem layers, signatures) from one location to another.
skopeo-delete(1) Mark the image-name for later deletion by the registry's garbage collector.
skopeo-generate-sigstore-key(1) Generate a sigstore public/private key pair.
skopeo-inspect(1) Return low-level information about image-name in a registry.
skopeo-list-tags(1) Return a list of tags for the transport-specific image repository.
skopeo-login(1) Login to a container registry.
skopeo-logout(1) Logout of a container registry.
skopeo-manifest-digest(1) Compute a manifest digest for a manifest-file and write it to standard output.
skopeo-standalone-sign(1) Debugging tool - Sign an image locally without uploading.
skopeo-standalone-verify(1) Debugging tool - Verify an image signature from local files.
skopeo-sync(1) Synchronize images between registry repositories and local directories.

License

skopeo is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.

skopeo (podman-container-tools/skopeo)

Searching Database…

11.3K ·GitHub
Skopeo
Что это такое?Skopeo — инструмент командной строки для работы с удалёнными реестрами контейнерных образов: проверка, копирование, удаление и синхронизация образов без необходимости загружать их на хост.
Это инструмент на основе демона, как Docker, или что-то более легковесное?Это самостоятельная CLI-утилита, которой не нужен фоновый демон и для большинства операций не требуются права root.
Как его запустить?Установите через менеджер пакетов или соберите из исходного кода, как описано в install.md, а затем выполняйте команды вроде 'skopeo inspect' или 'skopeo copy' для реестра.
Нужно ли сначала установить Docker или Podman?Нет, он работает независимо от Docker и Podman, но при наличии читает учётные данные, сохранённые через skopeo login, podman login, buildah login или docker login.
Работает ли он с любым реестром или хранилищем?Он поддерживает реестры с API V2, например docker.io и quay.io, локальные каталоги, каталоги в формате OCI-layout, внутреннее хранилище демона Docker и бэкенд containers/storage, который используют Podman, CRI-O и Buildah.
Кто этим пользуется и для каких задач?DevOps-инженеры и сопровождающие контейнеров используют его для зеркалирования между реестрами, синхронизации в изолированных (air-gapped) средах, проверки образов перед загрузкой и подписи содержимого.
Для чего нужна команда inspect?Она получает манифест репозитория или тега и выводит JSON, похожий на вывод docker inspect: доступные теги, метки, дату создания и ОС — ещё до того, как вы потратите место на загрузку образа.
Может ли skopeo напрямую копировать образы между разными реестрами?Да, он может копировать образ из одного реестра в другой (а также в локальные каталоги и из них, либо в демон Docker и обратно) без необходимости в привилегированном доступе.
Как skopeo работает с подписью образов?В него входят команды standalone-sign и standalone-verify, а также generate-sigstore-key для создания пары ключей sigstore. Это позволяет подписывать и проверять образы локально, не загружая их никуда.
Привязан ли skopeo к одному формату образов?Нет, он работает как с образами OCI, так и с исходным форматом образов Docker v2.
What are similar projects?containerd, podman, nerdctl, bocker, minikube, slim, k9s, distribution
Which topics is it in?containerization, registry, containers, sysadmin, command-line, devops, networking, go, command-line-tool, security, api, apache-2.0
Creator
podman-container-tools
Size
69.3 MB
Stars
11.3K
Updated
CommitOct 09Releasev1.24.1Sep 16
Age
10y
Commits · 90 Days