Skip to content

Container Registry (Docker / OCI)

Push and pull container images with the standard Docker CLI — no plugin, no custom client. Every image goes through the same antivirus and CVE pipeline as your other package formats before it's servable.

Prerequisites

  • The Repod repository server is running and accessible from the client machine
  • Your account has the uploader, maintainer, or admin role to push; any authenticated (or, for an open repository, unauthenticated) account can pull
  • For anything beyond local testing: TLS configured (docker-compose.tls.yml) — the Docker CLI refuses to talk to a plain-HTTP registry by default

Step 1 — Log in

docker login YOUR_HOST:5443 -u YOUR_USERNAME -p YOUR_PASSWORD_OR_API_TOKEN

Use your normal Repod account password, or an API token (repod_...) for CI/CD — the same credentials as every other authenticated endpoint. Repod issues a short-lived signed bearer token behind the scenes, using the standard OCI Distribution Bearer Token protocol (the same one Docker Hub and GHCR use) — the Docker CLI handles this negotiation automatically, nothing to configure.

SaaS accounts — prefix your username with your organization

On Repod SaaS, the container registry is a single shared address for every organization (there's no per-organization subdomain for docker login the way there is for the rest of the app) — so the organization has to travel in the username instead: 

docker login YOUR_HOST:5443 -u YOUR_ORG_SLUG+YOUR_USERNAME -p YOUR_PASSWORD_OR_API_TOKEN
Use +, not : — HTTP Basic Auth itself uses : to separate the username from the password, so a : inside the username would be swallowed into the password instead of reaching Repod. Your images then live under your organization's own namespace — see the push step below. This only applies to SaaS; on-premise/CE deployments use a plain username as shown above.

Local / dev testing without TLS

If you haven't set up TLS yet, add your host to Docker's insecure-registries list rather than fighting the client's HTTPS requirement:

/etc/docker/daemon.json
{ "insecure-registries": ["YOUR_HOST:PORT"] }
Restart the Docker daemon after editing this file. Use a real TLS certificate before pushing anything you care about — see Reverse proxy.

Step 2 — Push an image

docker tag my-app:1.0.0 YOUR_HOST:5443/my-app:1.0.0
docker push YOUR_HOST:5443/my-app:1.0.0

The repository (my-app above) is created automatically on the first successful push — no pre-registration needed, the same dynamic-repository model used by Maven, PyPI, and npm.

SaaS accounts — prefix the image name with your organization

docker tag my-app:1.0.0 YOUR_HOST:5443/YOUR_ORG_SLUG/my-app:1.0.0
docker push YOUR_HOST:5443/YOUR_ORG_SLUG/my-app:1.0.0
The registry itself is shared by every organization on the platform — your organization slug in the image name is what keeps your images in your own namespace. A push to a name outside your organization's namespace is rejected. This mirrors how Docker Hub organizations or GHCR namespaces work (docker push ghcr.io/your-org/my-app).

Behind the push, Repod scans every layer with the same antivirus + CVE pipeline used for .deb/.rpm/.apk packages. Depending on your CVE policy, an image either publishes immediately or lands in the same review queue your security team already uses for OS packages — see Security Pipeline.

Step 3 — Pull an image

docker pull YOUR_HOST:5443/my-app:1.0.0

If the repository is open (the default), no login is required to pull. If it's been restricted (see below), pulling requires the same credentials as pushing.

Importing a public image

You don't have to build locally to get an image into Repod. From the web UI (Container Registry → Importer) or the API, point Repod at a public Docker Hub image and a tag — it downloads the image, runs it through the same antivirus + CVE pipeline, and publishes it (or queues it for review) without ever touching your local Docker daemon.

Access control

By default, any repository name is open to push for uploader/maintainer/admin accounts, and open to pull for anyone. To restrict a specific repository to certain roles or groups, use the repository access endpoint (admin only) — the same model used across every format in Repod: no rows means open, admin always bypasses, and a denial on read returns 404 rather than 403 so a restricted repository's existence isn't leaked to someone without access.