Docker (OCI)

CloudRepo supports the Docker Registry HTTP API V2 specification for hosting private Docker images and OCI-compatible artifacts.

Hosted at CloudRepo — see private Docker registry hosting for plans and pricing.

Overview

CloudRepo provides private Docker registry hosting with native support for the Docker CLI, Podman, nerdctl, Buildah, Kaniko, Skopeo, and any other client that speaks the Docker Registry V2 API. CloudRepo’s registry implementation includes the full V2 token-authentication flow, manifest list (multi-arch) support, and content-addressable blob storage.

Supported Tools

  • Docker — The reference Docker CLI from Docker, Inc.

  • Podman — Daemonless container engine from Red Hat

  • nerdctl — Docker-compatible CLI for containerd

  • Buildah — Image-building utility

  • Kaniko — In-cluster image-building tool for Kubernetes

  • Skopeo — Image-inspection and transfer utility

Repository Types

Local Repositories

Host your private Docker images:

[org-id].mycloudrepo.io/repositories/[repo-name]/<image>:<tag>

The repositories/ segment is literal — type it exactly as shown.

It makes a Docker reference read like the Maven, npm, and PyPI repository URLs, which are also addressed under /repositories/. The resemblance is deliberate but it is not a routing equivalence: for the package formats that segment is an HTTP path, while for Docker it is part of the OCI image name, which the client always requests under a root-anchored /v2/. Pasting https://[org-id].mycloudrepo.io/repositories/[repo-name]/ into a browser or a package client will not reach your Docker repository — only a Docker-compatible client can address it.

Features:

  • Docker Registry V2 protocol: push, pull, tag listing, and the token-auth flow

  • Multi-arch manifest list (e.g., linux/amd64 + linux/arm64)

  • Standard Bearer-token authentication via docker login

  • HTTPS-only (TLS 1.2+ enforced)

  • Server-side blob deduplication

Quick Configuration Example

# 1. Create a Generic repository token in the admin portal (Repository Tokens -> Create token)

# 2. Log in -- to the HOST ONLY. No repository path here.
docker login [org-id].mycloudrepo.io

# 3. Tag + push -- the image reference DOES carry /repositories/<repo>/
docker tag my-app:1.0.0 [org-id].mycloudrepo.io/repositories/[repo-name]/my-app:1.0.0
docker push [org-id].mycloudrepo.io/repositories/[repo-name]/my-app:1.0.0

# 4. Pull from anywhere with credentials
docker pull [org-id].mycloudrepo.io/repositories/[repo-name]/my-app:1.0.0

Important

docker login takes the host alone; the image reference adds /repositories/<repo-name>/. The two deliberately look different.

Do not add the repository path to docker login. It will not raise an error — Docker stores one credential per host and silently discards any path, so you will see Login Succeeded and be no wiser. Log in to the host, and let the image reference carry the repository.

Authentication Method

CloudRepo Docker repositories use the Docker Registry V2 token-authentication flow:

  1. Mint a Generic CloudRepo repository token in the admin portal (one-time, repo-scoped)

  2. docker login stores email:token (HTTP Basic) in ~/.docker/config.json

  3. The Docker CLI exchanges the Basic credential for a short-lived Bearer scope-token at /v2/token automatically per V2 spec

  4. The Bearer scope-token authenticates subsequent push/pull operations (~5 minute lifetime; held in CLI memory only)

This guide uses one credential type throughout: the long-lived repository token. The short-lived Bearer is an invisible protocol detail. To rotate, revoke, or scope-down access, rotate the repository token in the admin portal — the change cascades to Bearer mints automatically.

Best Practices

  • An org-owner’s email and portal password are not accepted at the Docker registry — create a repository token and bind it to the identity that will use it

  • Use --password-stdin in CI environments (keeps the token out of process listings and shell history)

  • Store the repository token as a CI secret (never commit to a repository)

  • Rotate the repository token on a regular cadence — revocation cascades to active Bearer mints within ~5 minutes

  • Use multi-arch manifest lists when publishing for multiple platforms

Next Steps