1skopeo-copy(1)() skopeo-copy(1)()
2
6 skopeo-copy - Copy an image (manifest, filesystem layers, signatures)
7 from one location to another.
8
11 skopeo copy [options] source-image destination-image
12
15 Copy an image (manifest, filesystem layers, signatures) from one loca‐
16 tion to another.
17 Uses the system's trust policy to validate images, rejects images not
20 trusted by the policy.
21 source-image use the "image name" format described above
24 destination-image use the "image name" format described above
27 source-image and destination-image are interpreted completely indepen‐
30 dently; e.g. the destination name does not automatically inherit any
31 parts of the source name.
32
35 See also skopeo(1) for options placed before the subcommand name.
36 --additional-tag=strings
39 Additional tags (supports docker-archive).
42 --all, -a
45 If source-image refers to a list of images, instead of copying just the
48 image which matches the current OS and architecture (subject to the use
49 of the global --override-os, --override-arch and --override-variant op‐
50 tions), attempt to copy all of the images in the list, and the list it‐
51 self.
52 --authfile path
55 Path of the authentication file. Default is ${XDG_RUNTIME_DIR}/contain‐
58 ers/auth.json, which is set using skopeo login. If the authorization
59 state is not found there, $HOME/.docker/config.json is checked, which
60 is set using docker login.
61 Note: You can also override the default path of the authentication file
64 by setting the REGISTRY_AUTH_FILE environment variable. export REG‐
65 ISTRY_AUTH_FILE=path
66 --src-authfile path
69 Path of the authentication file for the source registry. Uses path
72 given by --authfile, if not provided.
73 --dest-authfile path
76 Path of the authentication file for the destination registry. Uses path
79 given by --authfile, if not provided.
80 --dest-shared-blob-dir directory
83 Directory to use to share blobs across OCI repositories.
86 --digestfile path
89 After copying the image, write the digest of the resulting image to the
92 file.
93 --preserve-digests
96 Preserve the digests during copying. Fail if the digest cannot be pre‐
99 served.
100 This option does not change what will be copied; consider using --all
103 at the same time.
104 --encrypt-layer ints
107 Experimental the 0-indexed layer indices, with support for negative in‐
110 dexing (e.g. 0 is the first layer, -1 is the last layer)
111 --format, -f manifest-type
114 MANIFEST TYPE (oci, v2s1, or v2s2) to use in the destination (default
117 is manifest type of source, with fallbacks)
118 --help, -h
121 Print usage statement
124 --multi-arch option
127 Control what is copied if source-image refers to a multi-architecture
130 image. Default is system.
131 Options: - system: Copy only the image that matches the system archi‐
134 tecture - all: Copy the full multi-architecture image - index-only:
135 Copy only the index
136 The index-only option usually fails unless the referenced per-architec‐
139 ture images are already present in the destination, or the target reg‐
140 istry supports sparse indexes.
141 --quiet, -q
144 Suppress output information when copying images.
147 --remove-signatures
150 Do not copy signatures, if any, from source-image. Necessary when copy‐
153 ing a signed image to a destination which does not support signatures.
154 --sign-by key-id
157 Add a “simple signing” signature using that key ID for an image name
160 corresponding to destination-image
161 --sign-by-sigstore param-file
164 Add a sigstore signature based on the options in the specified contain‐
167 ers sigstore signing parameter file, param-file. See containers-sig‐
168 store-signing-params.yaml(5) for details about the file format.
169 --sign-by-sigstore-private-key path
172 Add a sigstore signature using a private key at path for an image name
175 corresponding to destination-image
176 --sign-passphrase-file path
179 The passphare to use when signing with --sign-by or --sign-by-sigstore-
182 private-key. Only the first line will be read. A passphrase stored in a
183 file is of questionable security if other users can read this file. Do
184 not use this option if at all avoidable.
185 --sign-identity reference
188 The identity to use when signing the image. The identity must be a
191 fully specified docker reference. If the identity is not specified, the
192 target docker reference will be used.
193 --src-shared-blob-dir directory
196 Directory to use to share blobs across OCI repositories.
199 --encryption-key protocol:keyfile
202 Specifies the encryption protocol, which can be JWE (RFC7516), PGP
205 (RFC4880), and PKCS7 (RFC2315) and the key material required for image
206 encryption. For instance, jwe:/path/to/key.pem or pgp:admin@example.com
207 or pkcs7:/path/to/x509-file.
208 --decryption-key key[:passphrase]
211 Key to be used for decryption of images. Key can point to keys and/or
214 certificates. Decryption will be tried with all keys. If the key is
215 protected by a passphrase, it is required to be passed in the argument
216 and omitted otherwise.
217 --src-creds username[:password]
220 Credentials for accessing the source registry.
223 --dest-compress
226 Compress tarball image layers when saving to directory using the 'dir'
229 transport. (default is same compression type as source).
230 --dest-decompress
233 Decompress tarball image layers when saving to directory using the
236 'dir' transport. (default is same compression type as source).
237 --dest-oci-accept-uncompressed-layers
240 Allow uncompressed image layers when saving to an OCI image using the
243 'oci' transport. (default is to compress things that aren't com‐
244 pressed).
245 --dest-creds username[:password]
248 Credentials for accessing the destination registry.
251 --src-cert-dir path
254 Use certificates at path (*.crt, *.cert, *.key) to connect to the
257 source registry or daemon.
258 --src-no-creds
261 Access the registry anonymously.
264 --src-tls-verify=bool
267 Require HTTPS and verify certificates when talking to container source
270 registry or daemon. Default to source registry setting.
271 --dest-cert-dir path
274 Use certificates at path (*.crt, *.cert, *.key) to connect to the des‐
277 tination registry or daemon.
278 --dest-no-creds
281 Access the registry anonymously.
284 --dest-tls-verify=bool
287 Require HTTPS and verify certificates when talking to container desti‐
290 nation registry or daemon. Default to destination registry setting.
291 --src-daemon-host host
294 Copy from docker daemon at host. If host starts with tcp://, HTTPS is
297 enabled by default. To use plain HTTP, use the form http:// (default is
298 unix:///var/run/docker.sock).
299 --dest-daemon-host host
302 Copy to docker daemon at host. If host starts with tcp://, HTTPS is en‐
305 abled by default. To use plain HTTP, use the form http:// (default is
306 unix:///var/run/docker.sock).
307 Existing signatures, if any, are preserved as well.
310 --dest-compress-format format
313 Specifies the compression format to use. Supported values are: gzip,
316 zstd and zstd:chunked.
317 --dest-compress-level format
320 Specifies the compression level to use. The value is specific to the
323 compression algorithm used, e.g. for zstd the accepted values are in
324 the range 1-20 (inclusive), while for gzip it is 1-9 (inclusive).
325 --src-registry-token token
328 Bearer token for accessing the source registry.
331 --dest-registry-token token
334 Bearer token for accessing the destination registry.
337 --dest-precompute-digests
340 Precompute digests to ensure layers are not uploaded that already exist
343 on the destination registry. Layers with initially unknown digests (ex.
344 compressing "on the fly") will be temporarily streamed to disk.
345 --retry-times
348 The number of times to retry. Retry wait time will be exponentially in‐
351 creased based on the number of failed attempts.
352 --src-username
355 The username to access the source registry.
358 --src-password
361 The password to access the source registry.
364 --dest-username
367 The username to access the destination registry.
370 --dest-password
373 The password to access the destination registry.
376
379 To just copy an image from one registry to another:
380 $ skopeo copy docker://quay.io/skopeo/stable:latest docker://registry.example.com/skopeo:latest
382 To copy the layers of the docker.io busybox image to a local directory:
386 $ mkdir -p /var/lib/images/busybox
388 $ skopeo copy docker://busybox:latest dir:/var/lib/images/busybox
389 $ ls /var/lib/images/busybox/*
390 /tmp/busybox/2b8fd9751c4c0f5dd266fcae00707e67a2545ef34f9a29354585f93dac906749.tar
391 /tmp/busybox/manifest.json
392 /tmp/busybox/8ddc19f16526912237dd8af81971d5e4dd0587907234be2b83e249518d5b673f.tar
393 To create an archive consumable by docker load (but note that using a
397 registry is almost always more efficient):
398 $ skopeo copy docker://busybox:latest docker-archive:archive-file.tar:busybox:latest
400 To copy and sign an image:
404 $ skopeo copy --sign-by dev@example.com containers-storage:example/busybox:streaming docker://example/busybox:gold
406 To encrypt an image:
410 $ skopeo copy docker://docker.io/library/nginx:1.17.8 oci:local_nginx:1.17.8
412 $ openssl genrsa -out private.key 1024
414 $ openssl rsa -in private.key -pubout > public.key
415 $ skopeo copy --encryption-key jwe:./public.key oci:local_nginx:1.17.8 oci:try-encrypt:encrypted
417 To decrypt an image:
421 $ skopeo copy --decryption-key ./private.key oci:try-encrypt:encrypted oci:try-decrypt:decrypted
423 To copy encrypted image without decryption:
427 $ skopeo copy oci:try-encrypt:encrypted oci:try-encrypt-copy:encrypted
429 To decrypt an image that requires more than one key:
433 $ skopeo copy --decryption-key ./private1.key --decryption-key ./private2.key --decryption-key ./private3.key oci:try-encrypt:encrypted oci:try-decrypt:decrypted
435 Container images can also be partially encrypted by specifying the in‐
439 dex of the layer. Layers are 0-indexed indices, with support for nega‐
440 tive indexing. i.e. 0 is the first layer, -1 is the last layer.
441 Let's say out of 3 layers that the image docker.io/library/nginx:1.17.8
444 is made up of, we only want to encrypt the 2nd layer,
445 $ skopeo copy --encryption-key jwe:./public.key --encrypt-layer 1 oci:local_nginx:1.17.8 oci:try-encrypt:encrypted
447
451 skopeo(1), skopeo-login(1), docker-login(1), containers-auth.json(5),
452 containers-policy.json(5), containers-transports(5), containers-signa‐
453 ture(5)
454
457 Antonio Murdaca runcom@redhat.com ⟨mailto:runcom@redhat.com⟩, Miloslav
458 Trmac mitr@redhat.com ⟨mailto:mitr@redhat.com⟩, Jhon Honce jhonce@red‐
459 hat.com ⟨mailto:jhonce@redhat.com⟩
460 skopeo-copy(1)()