Container images

A **container image** packs an app with everything it needs to run. Zaryn is a container registry: `docker push` and `docker pull` (and podman, buildah, nerdctl, Kubernetes) work with it directly. The registry's name is shown on [Packages](/packages) under **Docker**; on zaryn.xyz it is `zaryn.xyz`. Images are named `zaryn.xyz/<owner>/<image>:<tag>`, where `<owner>` is your username or an organization you own or administer. ## Log in (once per computer) Create a token on [Packages](/packages) (**Create a publish token**), then: ```bash echo YOUR_TOKEN | docker login zaryn.xyz -u your-username --password-stdin ``` ## Push ```bash docker build -t zaryn.xyz/your-username/app:1.0 . docker push zaryn.xyz/your-username/app:1.0 ``` - `-t` names the image: registry, owner, image name, then a *tag* after the colon (a version, or `latest`). - Layers Zaryn already has aren't uploaded again. ## Pull ```bash docker pull zaryn.xyz/your-username/app:1.0 ``` Public images need no login to pull. ## Kubernetes For a private image, give the cluster a read-only key instead of your token: create a project API key in Zaryn, then ```bash kubectl create secret docker-registry zaryn \ --docker-server=zaryn.xyz --docker-username=zaryn \ --docker-password=YOUR_PROJECT_KEY ``` and add `imagePullSecrets: [{ name: zaryn }]` to your pod spec. The key can only pull, and you can revoke it any time. ## Helm charts and other files Anything in the OCI format can be stored next to images: ```bash helm push chart-0.1.0.tgz oci://zaryn.xyz/your-username/charts oras push zaryn.xyz/your-username/model:v1 model.gguf ``` Signatures and SBOMs (from cosign and similar tools) are attached to the image they describe and shown on its page. ## Private images (Premium) On Premium, new images start private; switch any image on its page. On Free, images are public. | | Free | Premium | |---|---|---| | Largest layer | 500 MB | 10 GB | | Space (packages and images together) | 500 MB | 100 GB | ## When something goes wrong | docker says | What it means | Fix | |---|---|---| | `unauthorized` | not logged in, or the token expired | `docker login zaryn.xyz` again | | `denied` | that owner isn't you or your organization | push under your username | | a layer upload is refused for its size | the layer is over your plan's limit | make the image smaller (multi-stage builds), or upgrade |