OCI Registry, A Blob Pushed And Pulled

registry

The CNCF Distribution registry (the reference OCI registry, once docker/distribution) from the upstream release (sha256-verified), as a hardened system service on loopback with filesystem storage and deletion enabled. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no registry; CNCF Distribution ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the asset unless its SHA-256 is the one in the vendor's file, then installs the binaries as root's in /usr/local/bin, pinned by registry_version.

A service account, a hardened unit, a loopback listener. registry is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:5000 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

A blob, pushed and pulled. The live test walks the OCI distribution protocol: it starts an upload, puts a fourteen-byte blob by digest, reads its headers back and deletes it, the four calls every podman push makes in the same order. A storage driver health check runs every ten seconds.

Loopback, for a proxy that authenticates. The registry itself has no users; it trusts whoever reaches it. On loopback that is this host; for a network, put it behind a TLS proxy that authenticates (this catalogue's caddy-https or haproxy-tls), which is what the upstream documentation says too. The vendor publishes one .sha256 per asset holding only the hash, which get_url reads as is.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.