Docker (OCI) repositories store container images and OCI artifacts, such as Helm charts. A hosted repository serves as a private registry, a proxy repository caches an external registry. The docker-hosted and docker-hub-proxy (Docker Hub cache) repositories are part of the starter set.

Docker (OCI) is the only format addressed without the /repository/ prefix:

<GALLEON_HOST>/<REPOSITORY>/<IMAGE>:<TAG>

Signing in to the registry

Sign in with your username and password or a user token:

docker login <GALLEON_HOST>

Compatible tools sign in the same way: crane auth login, skopeo login, helm registry login, oras login.

Pulling

Through a proxy repository, external registry images are pulled with the common pattern — the image path follows the repository name (official Docker Hub images need the library/ prefix):

docker pull <GALLEON_HOST>/docker-hub-proxy/library/alpine:3.20

Pulling from a hosted repository:

docker pull <GALLEON_HOST>/docker-hosted/alpine:1.0
helm pull oci://<GALLEON_HOST>/docker-hosted/charts/mychart --version 0.1.0

Publishing

To publish an image, tag it with the repository address and push:

docker tag alpine:3.20 <GALLEON_HOST>/docker-hosted/alpine:1.0
docker push <GALLEON_HOST>/docker-hosted/alpine:1.0

Helm charts are published as OCI artifacts — the chart version becomes the tag:

helm push mychart-0.1.0.tgz oci://<GALLEON_HOST>/docker-hosted/charts

Publishing requires both privileges on the repository — read and add: when pushing an image the client asks the registry for read and write access at once, so the add privilege alone is not enough.

Deleting

Images are deleted in the “Browse” section of the web interface (the delete privilege is required):

  • deleting a tag removes only that tag — the image itself stays available by digest;
  • deleting a manifest by digest is refused while a tag or a multi-platform index still points at it: remove the referencing tags or the index first;
  • layers and configs (the blobs/ branch) cannot be deleted individually: the content is shared across all the images of the repository;
  • with the DENY write policy, deletion is refused even with the delete privilege — the policy is changed by an administrator.

The disk space is returned by the garbage collection, so it is not freed right after the deletion (Storage and garbage collection).

Specifics

Format specifics:

  • Re-pushing an existing tag overwrites it — tags are mutable; the immutable reference to an image is its digest. Overwriting obeys the repository write policy: with ALLOW_ONCE, moving an existing tag to another image is refused, and with DENY any publishing is refused.
  • Multi-platform images and OCI artifacts are supported: Helm charts, oras artifacts.
  • Images pulled through a proxy repository are cached in full — the manifest and all layers; the general cache behavior is described in Proxying and caching.
  • The list of allowed OCI artifact media types is fixed: publishing an artifact with another media type is rejected.
  • Publishing through the web interface is not available — use the clients listed above.
←
User guide / Credentials
Formats / Maven
→