Push and pull container images

Select the exact namespace/repository once. rvs supplies temporary authentication for that Container repository.

Build and push with Docker

rvs art select platform/runtime-images
rvs docker build -t acme/api:1.0.0 .
rvs docker push acme/api:1.0.0

Docker may upload several missing layers concurrently. Ravenstash keeps each blob upload durable and resumable; a manifest becomes pullable only after every referenced blob is present and valid.

Push a multi-platform image

Buildx output tags still need the full image reference:

rvs art select platform/runtime-images
rvs docker buildx build \
  --platform linux/amd64,linux/arm64 \
  --tag oci.rvsta.sh/platform/runtime-images/acme/api:1.0.0 \
  --push .

Pull by tag

rvs art select platform/runtime-images
rvs docker pull acme/api:1.0.0

Pull keeps the full image name printed by rvs; it does not create a local acme/api:1.0.0 alias. Use the printed reference when running the image. For deployment pinning, copy the manifest digest from Docker or the Ravenstash content view and use rvs docker pull acme/api@sha256:....

Names and local tags

Push, pull, and tag accept nested image paths such as team/backend/api. An omitted tag means latest. Push automatically creates the full destination tag from your local image, preserving the original tag. To give an existing local image a different destination name:

rvs art select platform/runtime-images
rvs docker tag local-api:dev acme/api:next

If the full local destination tag already points to another image, rvs stops. To replace it intentionally, use plain docker tag <source> <full-destination>. This can be necessary after rebuilding latest. A full tag created by push remains locally even if uploading fails. push --all-tags requires a full image reference; pull --all-tags acme/api supports shorthand.

Explicit registry hosts are never redirected. Docker treats a first path component containing a dot or colon, localhost, or uppercase letters as a registry host. Use the full internal reference for paths such as team.v2/api. A missing private image never falls back to Docker Hub; use plain docker pull nginx:alpine for a public pull.

Build with private and public images

Dockerfile references keep their normal meaning. Private bases need a full reference; public bases use their own registries:

FROM oci.rvsta.sh/platform/runtime-images/acme/build-tools:1.0.0 AS build
WORKDIR /src
COPY . .
RUN ./build.sh

FROM docker.io/library/nginx:alpine
COPY --from=build /src/dist /usr/share/nginx/html

rvs art select platform/runtime-images
rvs docker build -t acme/site:1.0.0 .
rvs docker push acme/site:1.0.0

The build receives temporary access to the selected private repository and preserves your existing credentials for other registries. All Ravenstash base images must belong to that selected repository. Build output tags, Dockerfile references, and ORAS commands are not expanded by Docker shorthand.

Use ORAS

ORAS can copy OCI content and discover subject-linked attachments. Because ORAS can work with both Container and Helm repositories, select the kind explicitly:

rvs art select platform/runtime-images
rvs oras --rvs-kind container discover \
  oci.rvsta.sh/platform/runtime-images/acme/api:1.0.0

The same temporary credential behavior applies to rvs oras. Secrets are not placed in command arguments or written into your persistent Docker configuration.

Interrupted uploads

An interrupted layer upload does not publish a partial image. A compatible client can resume the upload while it remains valid or start a replacement upload.

Other compatible clients

The registry protocol is compatible with Docker, ORAS, Podman, nerdctl, Skopeo, and Crane. rvs docker and rvs oras provide credential injection today; other clients can use a short-lived exact-target credential obtained through Ravenstash tooling.