Documentation

The registry speaks the OCI distribution spec, so your existing tools work unchanged. These pages cover the parts that are ours.

Authentication

Robot accounts for machines, OIDC for humans. Public pulls need no credentials at all.

bash

# machine
docker login es-mirror-01.tabserv.link -u robot$ci -p $CH_TOKEN

# human, via your identity provider
ch auth login

Pushing

Standard. The only thing worth knowing is that scanning runs before the tag becomes resolvable, which adds a few seconds to a first push and nothing to subsequent ones.

Pull-through cache

bash

ch cache create --upstream docker.io --ttl 168h \
  --credentials-from-secret dockerhub

ch cache create --upstream ghcr.io --ttl 168h

# rewrite in the cluster with a mutating webhook, or just change the image reference

If your nodes pull the same base image on every rollout, the cache turns hundreds of internet round trips into one. On a 900-node cluster this is usually the single largest reduction in external bandwidth you can make in an afternoon.

Retention

Rules evaluate in order; the first match wins. Always dry run — the output lists every digest that would be removed and what still references it.

Scanning

Vulnerability data from three feeds, plus secret detection and a licence inventory. Results are stored as OCI referrers, so copying an image to another registry carries them along.

bash

ch scan result es-mirror-01.tabserv.link/acme/api:2026.8.1 --format sarif
ch sbom get es-mirror-01.tabserv.link/acme/api:2026.8.1 --format spdx-json

Signing

bash

cosign sign --key ch://acme-release \
  es-mirror-01.tabserv.link/acme/api@sha256:c0a24f2a…

cosign verify --key ch://acme-release \
  es-mirror-01.tabserv.link/acme/api:2026.8.1

Admission policy

A policy document evaluated by our admission controller in your cluster. It can require signatures, block on scan severity and enforce that images come from a repository you control.

Turning on block_on: critical without a grace period will stop deployments the first time a base image gets a new CVE. Start in warn mode and read the report for a week.