Docker repositories

Docker repositories are OCI registries for docker, BuildKit, containerd and other OCI tools (Helm, ORAS, crane, skopeo, cosign). An image's name is the Depotex address, the space, the repository and the image: depotex.example.com/my-space/images/my-app:1.0.

1. Sign in, push and pull

echo "$DEPOTEX_TOKEN" | docker login depotex.example.com -u me --password-stdin
docker tag my-app depotex.example.com/my-space/images/my-app:1.0
docker push depotex.example.com/my-space/images/my-app:1.0
docker pull depotex.example.com/my-space/dockerhub/nginx:latest

With a Docker group as the space's default, depotex.example.com/my-space/docker/<image> pulls from the group's members in order (your repositories, then a Docker Hub proxy) and takes pushes, which go to the repository the group's write rules choose by image name.

• push (Publish permission), pull by tag or digest, build --push with multi-platform images and attestations, manifest, buildx imagetools and search work as with any registry.
• Layers already in another repository you can read aren't uploaded again.
• Clients that can't read multi-platform images (Docker before 1.10 and other old tools) get the linux/amd64 image of a multi-platform tag; set DOCKER_DEFAULT_PLATFORM (for example linux/arm64) for another. Current clients, and pulls by digest, get the multi-platform image itself.
• Helm charts pushed to OCI registries (helm push oci://…), ORAS artifacts and other OCI artifacts are stored like images. For classic chart repositories (helm repo add, index.yaml), use a Helm repository.

2. Tags and policies

• Each tag is a version: it shows in the Versions tab, and cleanup policies, quotas, quarantine and the block list apply to tags. Pulling a blocked or quarantined tag's digest is refused too.
• Moving a tag needs Overwrite permission; with publishing set to Allow once, tags can't be moved (pushing the same image again is fine).
• Layers and manifests no tag uses any more are removed a day later (the docker-gc job).

3. Signatures and SBOMs

Signatures and SBOMs pushed with cosign, notation or ORAS are kept as referrers of the image (the OCI referrers API). Build attestations from docker buildx build --attest or --sbom stay in the image index. The browser lists both, with SBOM summaries (SPDX and CycloneDX) and provenance. An image without either gets an SBOM Depotex reads from the image itself (SBOMs, Pro).

4. Proxy repositories

A proxy repository of Docker Hub (preset Docker Hub), GHCR or another registry fetches and caches images. Docker Hub's official images are reached without library/ (…/dockerhub/nginx). Give the upstream a Docker Hub username and access token to avoid its anonymous pull limits.

5. In the artifact browser

Images show by path, then their tags. The Overview shows the digest, kind (image or index), source and, per platform, size, build date, user, entrypoint, command, ports, environment and labels; the Layers tab lists each platform's layers with sizes and digests. The quick facts show docker pull by tag and by digest.

6. Limits

• Docker references are lower case: spaces and repositories with upper-case names can't be addressed.
• Docker Content Trust (Notary) isn't provided; sign images with cosign or notation instead.
• Image manifest schema 1 (written by Docker 1.9 and older, signed or not) isn't accepted: push with Docker 1.10 or later, or any current OCI tool.
• The block list and quarantine refuse manifests (tags and digests); a layer pulled by its digest alone is still served.
• Layers a proxy fetched stay until the repository is deleted (cleanup acts on tags).
• A proxy's tag list is the upstream's first page (Docker Hub returns up to 100 by default).
• Uploads sent in several chunks cost a copy per chunk; docker and BuildKit send one.
• Depotex link upstreams aren't available for Docker yet.