Docker and OCI

This command runs docker login with your token (relic package setup podman for Podman):

relic package setup docker docker --write

Push an image to a local repository:

docker push relic.example.com/docker-local/app:1.0

Pull through a virtual or remote repository:

docker pull relic.example.com/docker/nginx:1.27

Record the pushed image in a build, with every platform of a multi-platform image that the repository stores:

relic build add-image app 1 docker-local/app:1.0

For a private CA (TLS), put the CA certificate in /etc/docker/certs.d/<host:port>/ca.crt.

• A remote of https://registry-1.docker.io caches Docker Hub, including library/ images.
• docker search relic.example.com/<text> lists the images you may read whose <repository>/<image> name contains the text, stored ones only, without descriptions or stars.
• Multi-platform images are stored with their platform manifests.
• The registry passes the OCI distribution specification 1.1 conformance suite.
• GET /v2/<repo>/<image>/referrers/<digest> lists signatures, SBOMs and attestations (pushed by oras or cosign); ?artifactType= filters them.
• A tag's Docker tab shows layers, build instructions and labels; Security shows vulnerabilities.

Kubernetes

Create an image pull secret:

kubectl create secret docker-registry relic --docker-server=relic.example.com \
  --docker-username=<you> --docker-password=<token>

Reference it in the pod spec:

spec:
  imagePullSecrets: [{name: relic}]
  containers: [{name: app, image: "relic.example.com/docker/app:1.0"}]

With a certificate the nodes trust, containerd needs nothing else. For plain HTTP or a private CA, add /etc/containerd/certs.d/relic.example.com/hosts.toml on each node, or on k3s an entry in /etc/rancher/k3s/registries.yaml.