paperg/deregistry repository overview

⁠deregistry

Distribute Docker images as files, without a registry

Docker has docker save, which exports one or more images as a tar archive. It also has docker load, which performs the inverse operation. Together, this enables the distribution of Docker images as regular files. This is cool because for decades people have been building software as files and distributing them, so there are a lot of good solutions for that. Docker registries are relatively immature, with only primordial solutions for security, and relatively few hosted providers.

deregistry helps with this workflow. It reads saved docker images from a URL and imports them into Docker. As a convenience it can also fetch plain tarballs and extract them into the filesystem.

You might be thinking you could do this with curl ... | docker load. You can, but deregistry adds a few bells and whistles:

• It can handle s3:// URLs, and will use standard credential finding logic⁠ to get access to a private bucket. Attach an IAM instance profile⁠ to your EC2 instances for a security win. Now you don't need to deal with distributing the password to a private Docker registry to all your servers, or having a mechanism in place to rotate that password.

Actually that's just one bell. But here are the whistles that just aren't done yet:

• It can save the ETag from the response, and not bother re-downloading and re-unpacking the response if it hasn't changed.
• It can verify a GPG signature on the tarballs before unpacking them, making it a lot harder for an attacker to compromise your images and inject evil codes. (Though if Docker content trust⁠ ever gets adopted, this might be unnecessary)