Dependably Packages · Docker
A private OCI registry for docker and podman
One registry host for docker and podman, speaking the OCI Distribution Spec. Public images come through a pull-through cache that verifies every digest; your own images push with a token; the policy gate decides what reaches a build.
docker · podman · OCI
Point Docker at your registry
docker login stores the token in its own credential store; pipe it from stdin to keep it out of your shell history. podman login works the same way.
The placeholders are your base URL and a token from the web UI.
echo "<your token>" | docker login repo.example.com -u user --password-stdin
docker pull repo.example.com/library/nginx:1.27What happens to every fetch
The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
- The checksum is verified against the digest the upstream publishes before the artefact is stored.
- OSV publishes no advisory feed for container images, so the licence policy and manual blocks are what refuse an image.
- Each upstream is routed by its repository prefix, so a public image cannot shadow a private one.
- Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.
Verify, publish, revert
The Docker guide continues with a verification step, publishing your own packages, and reverting the configuration.