[][Skopeo] 镜像搬运工 Skopeo 使用指南 - 图1

1. 概述

Skopeo[1] 是一款用来操作、检查、签署和传输容器镜像及镜像存储库的工具，支持 Linux® 系统、Windows 和 MacOS。与 Podman 和 Buildah 一样，Skopeo 也是一个由开源社区推动的项目，也不需要运行容器守护进程。

Skopeo 是一个能操作不同格式（包括开放容器计划（OCI）和 Docker 镜像）容器镜像的轻量级模块化解决方案，您无需下载包含所有层的完整镜像，就可检查远程镜像仓库中的镜像。

2. Skopeo 是如何工作的？

Skopeo[2]（希腊语”远程查看”的意思）是红帽工程师与开源社区携手开发的第一款容器工具。Skopeo[3] 可与 Podman[4] 和 Buildah[5] 搭配来管理 OCI[6] 容器。简而言之，Podman 负责运行容器，Buildah 负责构建容器，而 Skopeo 则负责传输容器，同时也提供其他功能。我们可以把这些工具看成是用于容器环境的一把瑞士军刀。Skopeo 是其中最万能的那把刀，任由您支配。

Skopeo 使用 skopeo inspect 命令来检查镜像。在 Skopeo 面世之前，您必须拉取完整镜像才能检查这个镜像，即使您只是打算检查一些元数据而已。而 Skopeo 的 inspect 命令可显示镜像的各种属性，如层、镜像标记和标签等，因此您不必将镜像拉取到主机上。这样，您无需占用任何容量，就能收集关于存储库或标记的信息。

Skopeo 也允许您从存储库删除镜像，并将外部镜像存储库同步到内部镜像仓库，以实现更为安全的断网（也称为气隙系统）部署。当存储库需要时，Skopeo 可以传递相应的凭据和证书来进行身份验证。

Skopeo sync 允许进行镜像仓库到镜像仓库的直接复制，以便联网使用，也允许进行镜像仓库到文件和文件到镜像仓库的复制，以便为断网环境做准备。skopeo copy 会假定所请求的复制要求操作；而 skopeo sync 则不同，它已经过调优，能够更快地完成定期重新同步极少改动的大型存储库。除了直接使用命令行外，同步操作也可在 config 文件中配置，而这可以仅同步大型存储库中的一个标记子集。

如果检查结果表明需要在不同位置或不同存储类型之间复制容器镜像，您可以通过 Skopeo copy 命令来操作。此工具可以让您在不同的镜像仓库（例如 docker.io[7]、quay.io[8]）、您的内部容器镜像仓库或您的本地系统上的各种存储机制之间复制容器镜像。Skopeo 的镜像仓库间直接复制功能速度很快，可在目标镜像仓库允许时保留未修改的形式（以及镜像的清单摘要）。在镜像仓库间复制不需要使用本地磁盘，也不要求本地磁盘上有可用的空间。Skopeo 也可在不同容器引擎存储甚至不同目录之间移动镜像。它常常用于持续集成/持续交付（CI/CD）系统中，以便使容器镜像仓库保持最新，并且维护容器服务器上的存储。

3. 为什么要用 Skopeo？

3.1 灵活性

Skopeo[9] 是一套容器模块化工具的一部分，具有许多优势。将重要变更引入到单体式架构的工具中，而且不影响现有用户的使用，这绝非易事。Skopeo、Podman 和 Buildah 等尺寸更小巧、用途更专一的工具会以更快的速度更新换代。成套使用工具的话，可以使每个工具专注于单一用途，并且可以添加新的工具来增加功能，或者尝试与现有工具不兼容的想法和架构。工具的尺寸越小巧、模块化程度越高，保证安全也更加容易。 Podman 的部分功能源自于 libpod 库，允许与其他工具共享代码；Skopeo 与之相似，其功能也是在库中实施的。Skopeo 的容器/镜像库可由 Podman、Buildah 和 CRI-O[10] 等其他容器工具共享，并且与 Docker 命令行界面（CLI）兼容。

3.2 安全性和可访问性

将 Podman、Skopeo 和 Buildah 组合使用主要有以下优势：

  • 无根容器管理。用户无需使用具有管理员特权的进程，就能创建、运行和管理容器，不仅使容器环境变得更易访问，又可降低安全风险。
  • 无守护进程架构。守护进程需要管理员访问权限（同时无需进行管理员验证）来读取文件、安装程序、编辑应用和执行其他操作。如此一来，对于企图控制您的容器并渗透主机系统的黑客而言，守护进程是他们的理想攻击目标。
  • 原生 systemd 集成。通过使用 Podman 和相关的容器工具，您可以创建 systemd 单元文件并将容器作为系统服务来运行。

Understanding root inside and outside a container[11]

3.3 功能多样性

  • Skopeo 与 API V2 容器镜像仓库一起工作，例如docker.io和quay.io仓库、私有仓库、本地目录和本地 OCI 布局目录。Skopeo 可以执行的操作包括：
    • 从和向各种存储机制复制镜像。例如，您可以将镜像从一个仓库复制到另一个仓库，而无需特权。
    • 检查显示其属性（包括图层）的远程镜像，而无需将镜像拉到主机。
    • 从镜像存储库中删除镜像。
    • 将外部镜像存储库同步到内部仓库以进行气隙部署。
    • 当存储库需要时，skopeo 可以传递适当的凭据和证书进行身份验证。
  • Skopeo 对以下镜像和存储库类型进行操作：
    • containers-storage:docker-reference 位于本地 containers/storage镜像存储中的镜像。位置和镜像存储都在 /etc/containers/storage.conf 中指定。（这是Podman、CRI-O、Buildah和朋友的后端）
    • dir:path 一个现有的本地目录路径，将清单、层 tarball 和签名存储为单独的文件。这是一种非标准化格式，主要用于调试或非侵入式容器检查。
    • docker://docker-reference 实现“Docker Registry HTTP API V2”的仓库中的镜像。默认情况下，使用 中的授权状态$XDG_RUNTIME_DIR/containers/auth.json，这是使用 设置的skopeo login。
    • docker-archive:path[:docker-reference] 镜像存储在 - 格式的docker save文件中。docker-reference 仅在创建此类文件时使用，并且不得包含摘要。
    • docker-daemon:docker-reference 存储在 docker 守护程序内部存储中的镜像 docker-reference。docker-reference 必须包含标签或摘要。或者，在读取镜像时，格式也可以是 docker-daemon:algo:digest（镜像 ID）。
    • oci:path:tag 路径中符合“Open Container Image Layout Specification”的目录中的镜像标签。

废话少说，我们开始 Skopeo 之旅。

4. 安装

4.1 Fedora

sudo dnf -y install skopeo

Package Info[12] and Bugzilla[13]

4.2 RHEL / CentOS Stream ≥ 8

sudo dnf -y install skopeo

CentOS Stream 9: Package Info[14]

CentOS Stream 8: Package Info[15]

  • 更多 skopeo 安装方式看这里[16]

4.3 RHEL/CentOS ≤ 7.x

sudo yum -y install skopeo

CentOS 7: Package Repo[17]

4.4 Ubuntu

skopeo包在Ubuntu 20.10及更新版本的官方存储库中可用。

  1. # Ubuntu 20.10 and newer
  2. sudo apt-get -y update
  3. sudo apt-get -y install skopeo

Ubuntu： Package Info[18]

4.5 容器安装

  1. $ podman run docker://quay.io/skopeo/stable:latest copy --help

5. 命令参数

  1. skopeo --help
  2. Various operations with container images and container image registries
  4. Usage:
  5.   skopeo [command]
  7. Available Commands:
  8.   copy                                          Copy an IMAGE-NAME from one location to another
  9.   delete                                        Delete image IMAGE-NAME
  10.   help                                          Help about any command
  11.   inspect                                       Inspect image IMAGE-NAME
  12.   list-tags                                     List tags in the transport/repository specified by the REPOSITORY-NAME
  13.   login                                         Login to a container registry
  14.   logout                                        Logout of a container registry
  15.   manifest-digest                               Compute a manifest digest of a file
  16.   standalone-sign                               Create a signature using local files
  17.   standalone-verify                             Verify a signature using local files
  18.   sync                                          Synchronize one or more images from one location to another
  20. Flags:
  21.       --command-timeout duration   timeout for the command execution
  22.       --debug                      enable debug output
  23.   -h, --help                       help for skopeo
  24.       --insecure-policy            run the tool without any policy check
  25.       --override-arch ARCH         use ARCH instead of the architecture of the machine for choosing images
  26.       --override-os OS             use OS instead of the running OS for choosing images
  27.       --override-variant VARIANT   use VARIANT instead of the running architecture variant for choosing images
  28.       --policy string              Path to a trust policy file
  29.       --registries.d DIR           use registry configuration files in DIR (e.g. for container signature storage)
  30.       --tmpdir string              directory used to store temporary files
  31.   -v, --version                    Version for Skopeo
  33. Use "skopeo [command] --help" for more information about a command.
命令 描述
skopeo-copy(1)[19] 将镜像（清单、文件系统层、签名）从一个位置复制到另一个位置。
skopeo-delete(1)[20] 标记镜像名称以便稍后由仓库的垃圾收集器删除。
skopeo-inspect(1)[21] 返回有关仓库中镜像名称的低级信息。
skopeo-list-tags(1)[22] 返回特定于传输的镜像存储库的标签列表。
skopeo-login(1)[23] 登录容器仓库。
skopeo-logout(1)[24] 注销容器仓库。
skopeo-manifest-digest(1)[25] 计算清单文件的清单摘要并将其写入标准输出。
skopeo-standalone-sign(1)[26] 调试工具 - 一步发布和签署镜像。
skopeo-standalone-verify(1)[27] 验证镜像签名。
skopeo-sync(1)[28]

6. 查询（skopeo inspect）

skopeo inspect 能够检查容器 Registry 上的存储库并获取镜像层。检查命令获取存储库的清单，它能够向您显示有关整个存储库或标签的类似 docker inspect 的 json 输出。与 docker inspect 相比,此工具可帮助您在拉取存储库或标签之前收集有用的信息(使用磁盘空间), 检查命令可以向您显示给定存储库可用的标签、映像具有的标签、映像的创建日期和操作系统等。

支持传输的类型 : containers-storage, dir, docker, docker-archive, docker-daemon, oci, oci-archive, ostree, tarball。

6.1 查询镜像 fedora:latest 的属性

  1. $ podman images
  2. REPOSITORY  TAG         IMAGE ID    CREATED     SIZE
  4. $ skopeo inspect docker://docker.io/alpine:latest
  5. {
  6.     "Name": "docker.io/library/alpine",
  7.     "Digest": "sha256:b95359c2505145f16c6aa384f9cc74eeff78eb36d308ca4fd902eeeb0a0b161b",
  8.     "RepoTags": [
  9.         "2.6",
  10.         "2.7",
  11.         "20190228",
  12.         "20190408",
  13.         "20190508",
  14.         "20190707",
  15.         "20190809",
  16.         "20190925",
  17.         "20191114",
  18.         "20191219",
  19.         "20200122",
  20.         "20200319",
  21.         "20200428",
  22.         "20200626",
  23.         "20200917",
  24.         "20201218",
  25.         "20210212",
  26.         "20210730",
  27.         "20210804",
  28.         "20220316",
  29.         "20220328",
  30.         "20220715",
  31.         "20221110",
  32.         "3",
  33.         "3.1",
  34.         "3.10",
  35.         "3.10.0",
  36.         "3.10.1",
  37.         "3.10.2",
  38.         "3.10.3",
  39.         "3.10.4",
  40.         "3.10.5",
  41.         "3.10.6",
  42.         "3.10.7",
  43.         "3.10.8",
  44.         "3.10.9",
  45.         "3.11",
  46.         "3.11.0",
  47.         "3.11.10",
  48.         "3.11.11",
  49.         "3.11.12",
  50.         "3.11.13",
  51.         "3.11.2",
  52.         "3.11.3",
  53.         "3.11.5",
  54.         "3.11.6",
  55.         "3.11.7",
  56.         "3.11.8",
  57.         "3.11.9",
  58.         "3.12",
  59.         "3.12.0",
  60.         "3.12.1",
  61.         "3.12.10",
  62.         "3.12.11",
  63.         "3.12.12",
  64.         "3.12.2",
  65.         "3.12.3",
  66.         "3.12.4",
  67.         "3.12.5",
  68.         "3.12.6",
  69.         "3.12.7",
  70.         "3.12.8",
  71.         "3.12.9",
  72.         "3.13",
  73.         "3.13.0",
  74.         "3.13.1",
  75.         "3.13.10",
  76.         "3.13.11",
  77.         "3.13.12",
  78.         "3.13.2",
  79.         "3.13.3",
  80.         "3.13.4",
  81.         "3.13.5",
  82.         "3.13.6",
  83.         "3.13.7",
  84.         "3.13.8",
  85.         "3.13.9",
  86.         "3.14",
  87.         "3.14.0",
  88.         "3.14.1",
  89.         "3.14.2",
  90.         "3.14.3",
  91.         "3.14.4",
  92.         "3.14.5",
  93.         "3.14.6",
  94.         "3.14.7",
  95.         "3.14.8",
  96.         "3.15",
  97.         "3.15.0",
  98.         "3.15.0-rc.4",
  99.         "3.15.1",
  100.         "3.15.2",
  101.         "3.15.3",
  102.         "3.15.4",
  103.         "3.15.5",
  104.         "3.15.6",
  105.         "3.16",
  106.         "3.16.0",
  107.         "3.16.1",
  108.         "3.16.2",
  109.         "3.16.3",
  110.         "3.17",
  111.         "3.17.0_rc1",
  112.         "3.2",
  113.         "3.3",
  114.         "3.4",
  115.         "3.5",
  116.         "3.6",
  117.         "3.6.5",
  118.         "3.7",
  119.         "3.7.3",
  120.         "3.8",
  121.         "3.8.4",
  122.         "3.8.5",
  123.         "3.9",
  124.         "3.9.2",
  125.         "3.9.3",
  126.         "3.9.4",
  127.         "3.9.5",
  128.         "3.9.6",
  129.         "edge",
  130.         "latest"
  131.     ],
  132.     "Created": "2022-11-12T04:19:23.199716539Z",
  133.     "DockerVersion": "20.10.12",
  134.     "Labels": null,
  135.     "Architecture": "amd64",
  136.     "Os": "linux",
  137.     "Layers": [
  138.         "sha256:ca7dd9ec2225f2385955c43b2379305acd51543c28cf1d4e94522b3d94cce3ce"
  139.     ],
  140.     "Env": [
  141.         "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  142.     ]
  143. }

6.2 查询镜像配置

  1. $ skopeo inspect --config docker://docker.io/alpine:latest  | jq
  2. {
  3.   "created": "2022-11-12T04:19:23.199716539Z",
  4.   "architecture": "amd64",
  5.   "os": "linux",
  6.   "config": {
  7.     "Env": [
  8.       "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  9.     ],
  10.     "Cmd": [
  11.       "/bin/sh"
  12.     ]
  13.   },
  14.   "rootfs": {
  15.     "type": "layers",
  16.     "diff_ids": [
  17.       "sha256:e5e13b0c77cbb769548077189c3da2f0a764ceca06af49d8d558e759f5c232bd"
  18.     ]
  19.   },
  20.   "history": [
  21.     {
  22.       "created": "2022-11-12T04:19:23.05154209Z",
  23.       "created_by": "/bin/sh -c #(nop) ADD file:ceeb6e8632fafc657116cbf3afbd522185a16963230b57881073dad22eb0e1a3 in / "
  24.     },
  25.     {
  26.       "created": "2022-11-12T04:19:23.199716539Z",
  27.       "created_by": "/bin/sh -c #(nop)  CMD [\"/bin/sh\"]",
  28.       "empty_layer": true
  29.     }
  30.   ]
  31. }

6.3 查询镜像摘要

  1. $ skopeo inspect docker://docker.io/alpine:latest | jq '.Digest'
  2. "sha256:655721ff613ee766a4126cb5e0d5ae81598e1b0c3bcf7017c36c4d72cb092fe9"

或者

  1. $ skopeo inspect --format "Name: {{.Name}} Digest: {{.Digest}}" docker://docker.io/alpine:latest
  2. Name: docker.io/library/alpine Digest: sha256:b95359c2505145f16c6aa384f9cc74eeff78eb36d308ca4fd902eeeb0a0b161b
  • 关于 inspect 用法更多细节请看这里[29]

6.4 免登陆查询

  • —creds=testuser:testpassword 绕过login登陆实现用户认证
  1. skopeo inspect   --creds=admin:Harbor12345 docker://harbor.fumai.com/library/alpine:latest
  2. {
  3.     "Name": "harbor.fumai.com/library/alpine",
  4.     "Digest": "sha256:39ec5d12ef5a81b29b26d756f6b9c11d8d454fc4158e3dac1e13240125558461",
  5.     "RepoTags": [
  6.         "latest"
  7.     ],
  8.     "Created": "2022-11-12T04:19:23.199716539Z",
  9.     "DockerVersion": "20.10.12",
  10.     "Labels": null,
  11.     "Architecture": "amd64",
  12.     "Os": "linux",
  13.     "Layers": [
  14.         "sha256:60f8044dac9f779802600470f375c7ca7a8f7ad50e05b0ceb9e3b336fa5e7ad3"
  15.     ],
  16.     "Env": [
  17.         "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  18.     ]
  19. }

7. 显示镜像标签（skopeo list-tags）

skopeo list-tags显示镜像存储库的标签列表，期待已久的功能了。

  1. $ skopeo list-tags docker://192.168.10.80:5000/alpine
  2. {
  3.     "Repository": "192.168.10.80:5000/alpine",
  4.     "Tags": [
  5.         "latest"
  6.     ]
  7. }
  9. $ skopeo list-tags docker://docker.io/alpine
  10. {
  11.     "Repository": "docker.io/library/alpine",
  12.     "Tags": [
  13.         "2.6",
  14.         "2.7",
  15.         "20190228",
  16.         "20190408",
  17.         "20190508",
  18.         "20190707",
  19.         "20190809",
  20.         "20190925",
  21.         "20191114",
  22.         "20191219",
  23.         "20200122",
  24.         "20200319",
  25.         "20200428",
  26.         "20200626",
  27.         "20200917",
  28.         "20201218",
  29.         "20210212",
  30.         "20210730",
  31.         "20210804",
  32.         "20220316",
  33.         "20220328",
  34.         "20220715",
  35.         "20221110",
  36.         "3",
  37.         "3.1",
  38.         "3.10",
  39.         "3.10.0",
  40.         "3.10.1",
  41.         "3.10.2",
  42.         "3.10.3",
  43.         "3.10.4",
  44.         "3.10.5",
  45.         "3.10.6",
  46.         "3.10.7",
  47.         "3.10.8",
  48.         "3.10.9",
  49.         "3.11",
  50.         "3.11.0",
  51.         "3.11.10",
  52.         "3.11.11",
  53.         "3.11.12",
  54.         "3.11.13",
  55.         "3.11.2",
  56.         "3.11.3",
  57.         "3.11.5",
  58.         "3.11.6",
  59.         "3.11.7",
  60.         "3.11.8",
  61.         "3.11.9",
  62.         "3.12",
  63.         "3.12.0",
  64.         "3.12.1",
  65.         "3.12.10",
  66.         "3.12.11",
  67.         "3.12.12",
  68.         "3.12.2",
  69.         "3.12.3",
  70.         "3.12.4",
  71.         "3.12.5",
  72.         "3.12.6",
  73.         "3.12.7",
  74.         "3.12.8",
  75.         "3.12.9",
  76.         "3.13",
  77.         "3.13.0",
  78.         "3.13.1",
  79.         "3.13.10",
  80.         "3.13.11",
  81.         "3.13.12",
  82.         "3.13.2",
  83.         "3.13.3",
  84.         "3.13.4",
  85.         "3.13.5",
  86.         "3.13.6",
  87.         "3.13.7",
  88.         "3.13.8",
  89.         "3.13.9",
  90.         "3.14",
  91.         "3.14.0",
  92.         "3.14.1",
  93.         "3.14.2",
  94.         "3.14.3",
  95.         "3.14.4",
  96.         "3.14.5",
  97.         "3.14.6",
  98.         "3.14.7",
  99.         "3.14.8",
  100.         "3.15",
  101.         "3.15.0",
  102.         "3.15.0-rc.4",
  103.         "3.15.1",
  104.         "3.15.2",
  105.         "3.15.3",
  106.         "3.15.4",
  107.         "3.15.5",
  108.         "3.15.6",
  109.         "3.16",
  110.         "3.16.0",
  111.         "3.16.1",
  112.         "3.16.2",
  113.         "3.16.3",
  114.         "3.17",
  115.         "3.17.0_rc1",
  116.         "3.2",
  117.         "3.3",
  118.         "3.4",
  119.         "3.5",
  120.         "3.6",
  121.         "3.6.5",
  122.         "3.7",
  123.         "3.7.3",
  124.         "3.8",
  125.         "3.8.4",
  126.         "3.8.5",
  127.         "3.9",
  128.         "3.9.2",
  129.         "3.9.3",
  130.         "3.9.4",
  131.         "3.9.5",
  132.         "3.9.6",
  133.         "edge",
  134.         "latest"
  135.     ]
  136. }

8. 登陆（skopeo login）

我这里有三个仓库地址

  • Docker 官方 hub 仓库： docker.io
  • Harbor 私有仓库：harbor.fumai.com
  • Registry 私有仓库：192.168.10.80:5000

在使用 skopeo 前，如果 src 或 dest 镜像是在 registry 仓库中的并且配置了非 public 的镜像需要相应的 auth 认证, 此时我们可以使用 docker login 或者 skopeo login 的方式登录到 registry 仓库，然后默认会在~/.docker目录下生成 registry 登录配置文件 config.json ,该文件里保存了登录需要的验证信息，skopeo 拿到该验证信息才有权限往 registry push 镜像。

skopeo 使用来自 —creds（对于 skopeo inspect|delete）或 —src-creds|—dest-creds（对于 skopeo copy）标志的凭据，如果已设置；否则它使用由 skopeo 登录、podman 登录、buildah 登录或 docker 登录设置的配置。

8.1 配置私有仓库证书

由于我是使用 podman 容器工具，它的默认仓库认证证书存放位置是/etc/containers/certs.d。

    1. 配置 registry 证书 registry 仓库部署在我的本机容器中，证书挂载于本机/opt/registry/certs/目录。
  1. install -d  /etc/containers/certs.d/192.168.10.80\:5000/
  2. install /opt/registry/certs/* /etc/containers/certs.d/192.168.10.80\:5000/

install 是一个既能创建目录又能复制的命令。

  1. 配置 harbor 证书 harbor 仓库在另一台机器
  1. $ cat <<EOF >> vim /etc/hosts
  2. 192.168.10.81 harbor.fumai.com
  3. EOF
  1. install -d /etc/containers/certs.d/harbor.fumai.com
  2. rsync root@192.168.10.81:/etc/docker/certs.d/harbor.fumai.com/* /etc/containers/certs.d/harbor.fumai.com/

8.2 podman 登陆各个仓库

登陆 docker.io 仓库

  1. $ podman login -u ghostwritten docker.io
  2. Password:
  3. Login Succeeded!

登陆 registry 仓库

  1. $ podman login -u registryuser -p registryuserpassword 192.168.10.80:5000
  2. Login Succeeded!

登陆 harbor 仓库

  1. $ podman login harbor.fumai.com -u admin -p Harbor12345
  2. Login Succeeded!

Podman 登陆仓库生成的auth文件在这里

  1. $ cat /run/user/0/containers/auth.json
  2. {
  3.         "auths": {
  4.                 "192.168.10.80:5000": {
  5.                         "auth": "cmVnaXN0cnl1c2VyOnJlZ2lzdHJ5dXNlcnBhc3N3b3Jk"
  6.                 },
  7.                 "docker.io": {
  8.                         "auth": "Z2hvc3R3cml0dGVuOjEyMzQ1bXRyLg=="
  9.                 },
  10.                 "harbor.fumai.com": {
  11.                         "auth": "YWRtaW46SGFyYm9yMTIzNDU="
  12.                 }
  13.         }
  14. }

skopeo 登陆 registry 仓库

8.3 skopeo 多种方式登陆仓库

  1. skopeo login -u ghostwritten docker.io
  2. Password:
  3. Login Succeeded!
  5. $ skopeo login  -u registryuser -p registryuserpassword 192.168.10.80:5000
  6. Login Succeeded!
  8. $ skopeo login --cert-dir /etc/containers/certs.d/192.168.10.80\:5000 -u registryuser -p registryuserpassword 192.1
  9. 68.10.80:5000
  10. Login Succeeded!
  12. $ skopeo login --authfile /run/user/0/containers/auth.json harbor.fumai.com
  14. $ echo 'Harbor12345' | skopeo login -u admin --password-stdin harbor.fumai.com
  15. Login Succeeded!

9. 复制镜像（skopeo copy）

skopeo copy 可以在各种存储机制之间复制容器镜像，包括：

  • Container registries
    • The Quay, Docker Hub, OpenShift, GCR, Artifactory …
  • Container Storage backends
    • github.com/containers/storage (Backend for Podman, CRI-O, Buildah and friends)
    • Docker daemon storage
  • Local directories
  • Local OCI-layout directories

9.1 本地镜像推送仓库

将本地镜像拷贝至192.168.10.80:5000仓库

  1. $ docker images localhost/busybox:latest
  2. REPOSITORY   TAG       IMAGE ID       CREATED      SIZE
  3. busybox      latest    9d5226e6ce3f   4 days ago   1.24MB
  5. 如果你得容器以podman为引擎。
  6. $ skopeo copy containers-storage:localhost/busybox:latest docker://192.168.10.80:5000/busybox:latest
  7. INFO[0000] Not using native diff for overlay, this may cause degraded performance for building images: kernel has CONFIG_OVERLAY_FS_REDIRECT_DIR enabled
  8. Getting image source signatures
  9. Copying blob 40cf597a9181 [--------------------------------------] 0.0b / 0.0b
  10. Copying config 9d5226e6ce [======================================] 1.4KiB / 1.4KiB
  11. Writing manifest to image destination
  12. Storing signatures
  14. #如果你得容器以docker为引擎。
  15. $ skopeo copy docker-daemon:localhost/busybox:latest docker://192.168.10.80:5000/busybox:latest
  17. # 没有tls安全的registry的情况下这样操作。
  18. $ skopeo copy --insecure-policy --dest-tls-verify=false --dest-authfile /root/.docker/config.json docker-daemon:localhost/busybox:latest docker://192.168.10.80:5000/busybox:latest

9.2 两仓库进行复制

192.168.10.80:5000仓库的 alpine 镜像同步至 harbor.fumai.com仓库

  1. #两个仓库进行查询当前镜像内容
  2. $ curl  -k -u "registryuser:registryuserpassword" https://192.168.10.80:5000/v2/_catalog
  3. {"repositories":["alpine"]}
  4. $ curl  -k -u "admin:Harbor12345" https://harbor.fumai.com/v2/_catalog
  5. {"repositories":[]}
  7. #镜像开始复制
  8. $ skopeo copy docker://192.168.10.80:5000/alpine:latest docker://harbor.fumai.com/library/alpine:latest
  9. Getting image source signatures
  10. Copying blob 60f8044dac9f done
  11. Copying config bfe296a525 done
  12. Writing manifest to image destination
  13. Storing signatures
  16. #查询复制结果
  17. $ curl  -k -u "admin:Harbor12345" https://harbor.fumai.com/v2/_catalog
  18. {"repositories":["library/alpine"]}
  20. #查询镜像信息
  21. $ skopeo inspect docker://harbor.fumai.com/library/alpine:latest
  22. {
  23.     "Name": "harbor.fumai.com/library/alpine",
  24.     "Digest": "sha256:39ec5d12ef5a81b29b26d756f6b9c11d8d454fc4158e3dac1e13240125558461",
  25.     "RepoTags": [
  26.         "latest"
  27.     ],
  28.     "Created": "2022-11-12T04:19:23.199716539Z",
  29.     "DockerVersion": "20.10.12",
  30.     "Labels": null,
  31.     "Architecture": "amd64",
  32.     "Os": "linux",
  33.     "Layers": [
  34.         "sha256:60f8044dac9f779802600470f375c7ca7a8f7ad50e05b0ceb9e3b336fa5e7ad3"
  35.     ],
  36.     "Env": [
  37.         "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  38.     ]
  39. }

其它仓库同步方法：

  1. #  docker://quay.io的buildah 同步到docker://registry.internal.company.com
  2. $ skopeo copy docker://quay.io/buildah/stable docker://harbor.fumai.com/library/buildah
  4. #如果 registry 是一个没有tls验证的仓库并且以 docker 为容器引擎。
  5. $ skopeo copy --insecure-policy --dest-tls-verify=false --dest-authfile /root/.docker/config.json docker://192.168.10.80:5000/alpine:latest docker://harbor.fumai.com/library/alpine:latest
  7. #如果 registry 是一个没有tls验证的仓库并且以 podman 为容器引擎。
  8.  $ skopeo copy --insecure-policy --dest-tls-verify=false --dest-authfile /run/user/0/containers/auth.json docker://192.168.10.80:5000/alpine:latest docker://harbor.fumai.com/library/alpine:latest

9.3 仓库镜像拷贝到本地目录

创建images目录，从harbor.fumai.com仓库复制至images目录

  1. $ install -d images
  2. $ skopeo copy docker://harbor.fumai.com/library/alpine:latest dir:images
  3. Getting image source signatures
  4. Copying blob 60f8044dac9f done
  5. Copying config bfe296a525 done
  6. Writing manifest to image destination
  7. Storing signatures
  9. $ ll images
  10. total 2864
  11. -rw-r--r-- 1 root root 2918987 Nov 21 23:08 60f8044dac9f779802600470f375c7ca7a8f7ad50e05b0ceb9e3b336fa5e7ad3
  12. -rw-r--r-- 1 root root    1471 Nov 21 23:08 bfe296a525011f7eb76075d688c681ca4feaad5afe3b142b36e30f1a171dc99a
  13. -rw-r--r-- 1 root root     428 Nov 21 23:08 manifest.json
  14. -rw-r--r-- 1 root root      33 Nov 21 23:08 version

保存OCI格式

  1. $ install -d images_OCI
  2. skopeo copy docker://harbor.fumai.com/library/alpine:latest oci:images_OCI
  3. $ tree images_OCI/
  4. images_OCI/
  5. ├── blobs
  6. │   └── sha256
  7. │       ├── 096fca2180271e60f199e3bc1c3544dc0175e7e6abd9dbdd0e2058b17d96e8b7
  8. │       ├── 60f8044dac9f779802600470f375c7ca7a8f7ad50e05b0ceb9e3b336fa5e7ad3
  9. │       └── e9daf8b695a6e3c0c566a2e25b328ba25afbdd52a80d28198b9fbf5058130f09
  10. ├── index.json
  11. └── oci-layout
  13. 2 directories, 5 files

或者如果没有登陆条件可以这样执行：

  1. $ skopeo copy --src-creds=admin:harbor12345 docker://harbor.fumai.com/library/alpine:latest oci:local_oci_image

10. 同步镜像（Skopeo sync）

Skopeo sync可以在容器仓库和本地目录之间同步镜像，其功能类似于阿里云的 image-syncer[30] 工具, 实际上其比 image-syncer 更强大、灵活性更强一些

  1. $ skopeo sync --src docker --dest dir registry.example.com/busybox /media/usb

10.1 仓库镜像同步至本地

将仓库中所有 busybox 镜像版本同步到本地目录

查询当前harbor.fumai.com仓库 busybox版本

  1. skopeo list-tags docker://harbor.fumai.com/library/busybox
  2. {
  3.     "Repository": "harbor.fumai.com/library/busybox",
  4.     "Tags": [
  5.         "latest",
  6.         "stable"
  7.     ]
  8. }

将busybox镜像所有版本同步至本地

  1. $ skopeo sync  --src docker --dest dir harbor.fumai.com/library/busybox images_busybox
  2. INFO[0000] Tag presence check                            imagename=harbor.fumai.com/library/busybox tagged=false
  3. INFO[0000] Getting tags                                  image=harbor.fumai.com/library/busybox
  4. INFO[0000] Copying image ref 1/2                         from="docker://harbor.fumai.com/library/busybox:latest" to="dir:/images_busybox/busybox:latest"
  5. Getting image source signatures
  6. Copying blob 405fecb6a2fa done
  7. Copying config 9d5226e6ce done
  8. Writing manifest to image destination
  9. Storing signatures
  10. INFO[0000] Copying image ref 2/2                         from="docker://harbor.fumai.com/library/busybox:stable" to="dir:/images_busybox/busybox:stable"
  11. Getting image source signatures
  12. Copying blob 405fecb6a2fa done
  13. Copying config 9d5226e6ce done
  14. Writing manifest to image destination
  15. Storing signatures
  16. INFO[0001] Synced 2 images from 1 sources
  18. $ tree images_busybox
  19. /images_busybox
  20. ├── busybox:latest
  21. │   ├── 405fecb6a2fa4f29683f977e7e3b852bf6f8975a2aba647d234d2371894943da
  22. │   ├── 9d5226e6ce3fb6aee2822206a5ef85f38c303d2b37bfc894b419fca2c0501269
  23. │   ├── manifest.json
  24. │   └── version
  25. └── busybox:stable
  26.     ├── 405fecb6a2fa4f29683f977e7e3b852bf6f8975a2aba647d234d2371894943da
  27.     ├── 9d5226e6ce3fb6aee2822206a5ef85f38c303d2b37bfc894b419fca2c0501269
  28.     ├── manifest.json
  29.     └── version
  31. 2 directories, 8 files

其他方式：

  1. skopeo sync --src-creds=admin:Harbor12345  --src docker --dest dir harbor.fumai.com/library/busybox /images_busybox
  3. skopeo sync --src-authfile=/run/user/0/containers/auth.json  --src docker --dest dir harbor.fumai.com/library/busybox /images_busybox

10.2 本地同步至仓库镜像

这次颠倒过来，从本地目录/images_busybox同步至registry:192.168.10.80:5000仓库

skopeo 登陆

  1. skopeo login  -u registryuser -p registryuserpassword 192.168.10.80:5000

开始同步

  1. $ skopeo sync  --src dir --dest docker  /images_busybox 192.168.10.80:5000
  2. INFO[0000] Copying image ref 1/2                         from="dir:/images_busybox/busybox:latest" to="docker://192.168.10.80:5000/busybox:latest"
  3. Getting image source signatures
  4. Copying blob 405fecb6a2fa done
  5. Copying config 9d5226e6ce done
  6. Writing manifest to image destination
  7. Storing signatures
  8. INFO[0001] Copying image ref 2/2                         from="dir:/images_busybox/busybox:stable" to="docker://192.168.10.80:5000/busybox:stable"
  9. Getting image source signatures
  10. Copying blob 405fecb6a2fa [--------------------------------------] 0.0b / 0.0b
  11. Copying config 9d5226e6ce [======================================] 1.4KiB / 1.4KiB
  12. Writing manifest to image destination
  13. Storing signatures
  14. INFO[0001] Synced 2 images from 1 sources

查询结果

  1. $ skopeo list-tags docker://192.168.10.80:5000/busybox
  2. {
  3.     "Repository": "192.168.10.80:5000/busybox",
  4.     "Tags": [
  5.         "latest",
  6.         "stable"
  7.     ]
  8. }

成功。 其他同步方式：

  1. skopeo sync --dest-creds=registryuser:registryuserpassword  --src dir --dest docker /images_busybox 192.168.10.80:5000 
  3. skopeo sync --src-authfile=/run/user/0/containers/auth.json  --src dir --dest docker /images_busybox 192.168.10.80:5000 
  5. #如果 registry 是一个没有tls验证的仓库
  6. skopeo sync --insecure-policy --dest-tls-verify=false --src dir --dest docker /images_busybox 192.168.10.80:5000

10.3 两仓库同步

将harbor（ harbor.fumai.com）仓库的busybox所有版本同步至registry（192.168.10.80:5000）仓库

  1. skopeo sync   --src docker --dest docker harbor.fumai.com/library/busybox 192.168.10.80:5000

其他方式：

  1. skopeo sync --src-creds=admin:Harbor12345 --dest-creds=registryuser:registryuserpassword  --src docker --dest docker harbor.fumai.com/library/busybox 192.168.10.80:5000 
  3. skopeo sync --dest-authfile=/run/user/0/containers/auth.json --src-authfile=/run/user/0/containers/auth.json --src docker --dest docker harbor.fumai.com/library/busybox 192.168.10.80:5000

10.4 以配置文件方式进行同步

准备一个需要同步的资源清单

  1. $ cat skopeo-sync.yml
  2. 192.168.10.80:5000:
  3.  images:
  4.    busybox: [stable]
  5.    redis:
  6.      - "latest"
  7.      - "7.0.5"
  8.  credentials:
  9.      username: registryuser
  10.      password: registryuserpassword
  11.  tls-verify: true
  12.  cert-dir: /etc/containers/certs.d/192.168.10.80:5000
  14. docker.io:
  15.  tls-verify: false
  16.  images:
  17.    httpd:
  18.      - "latest"
  20. quay.io:
  21.  tls-verify: false
  22.  images:
  23.    coreos/etcd:
  24.      - latest

开始同步

  1. $ skopeo sync --src yaml --dest docker skopeo-sync.yml harbor.fumai.com/library
  2. INFO[0000] Processing repo                               registry=docker.io repo=httpd
  3. INFO[0000] Processing repo                               registry=quay.io repo=coreos/etcd
  4. INFO[0000] Processing repo                               registry="192.168.10.80:5000" repo=busybox
  5. INFO[0000] Processing repo                               registry="192.168.10.80:5000" repo=redis
  6. INFO[0000] Copying image ref 1/1                         from="docker://httpd:latest" to="docker://harbor.fumai.com/library/httpd:latest"
  7. Getting image source signatures
  8. Copying blob ff7b0b8c417a done
  9. Copying blob 4691bd33efec done
  10. Copying blob a603fa5e3b41 done
  11. Copying blob b1c114085b25 done
  12. Copying blob 9df1012343c7 done
  13. Copying config 8653efc8c7 done
  14. Writing manifest to image destination
  15. Storing signatures
  16. INFO[0015] Copying image ref 1/1                         from="docker://quay.io/coreos/etcd:latest" to="docker://harbor.fumai.com/library/etcd:latest"
  17. Getting image source signatures
  18. Copying blob a3ed95caeb02 done
  19. Copying blob 96b0e24539ea done
  20. Copying blob d1eca4d01894 done
  21. Copying blob ff3a5c916c92 done
  22. Copying blob 8bc526247b5c done
  23. Copying blob ad732d7a61c2 done
  24. Copying blob a3ed95caeb02 skipped: already exists
  25. Copying blob a3ed95caeb02 skipped: already exists
  26. Copying blob 5f56944bb51c done
  27. Writing manifest to image destination
  28. Storing signatures
  29. INFO[0022] Synced 2 images from 2 sources
  30. INFO[0007] Copying image ref 1/1                         from="docker://192.168.10.80:5000/busybox:stable" to="docker://harbor.fumai.com/library/busybox:stable"
  31. Getting image source signatures
  32. Skipping: image already present at destination
  33. INFO[0007] Copying image ref 1/2                         from="docker://192.168.10.80:5000/redis:latest" to="docker://harbor.fumai.com/library/redis:latest"
  34. Getting image source signatures
  35. Copying blob a0056c8a01e3 done
  36. Copying blob 87b7cd6612f6 done
  37. Copying blob 656160ba04b8 done
  38. Copying blob a08cc0270959 done
  39. Copying blob d14ed0f181ce done
  40. Copying blob 39e3d9efeaec skipped: already exists
  41. Copying config 3358aea34e done
  42. Writing manifest to image destination
  43. Storing signatures
  44. INFO[0009] Copying image ref 2/2                         from="docker://192.168.10.80:5000/redis:7.0.5" to="docker://harbor.fumai.com/library/redis:7.0.5"
  45. Getting image source signatures
  46. Copying blob a08cc0270959 skipped: already exists
  47. Copying blob d14ed0f181ce skipped: already exists
  48. Copying blob a0056c8a01e3 skipped: already exists
  49. Copying blob 87b7cd6612f6 skipped: already exists
  50. Copying blob 656160ba04b8 skipped: already exists
  51. Copying blob 39e3d9efeaec [--------------------------------------] 0.0b / 0.0b
  52. Copying config 3358aea34e [======================================] 7.5KiB / 7.5KiB
  53. Writing manifest to image destination
  54. Storing signatures

11. 删除镜像（skopeo delete）

11.1 skopeo 删除镜像

使用skopeo delete命令我们可以删除镜像 Tag,注意此处仅仅只是通过 registry API 来删除镜像的 tag（即删除了 tag 对 manifests 文件的引用）并非真正将镜像删除掉，如果想要删除镜像的 layer 还是需要通过 registry GC 的方式。

  1. $ curl  -k -u "admin:Harbor12345" https://harbor.fumai.com/v2/_catalog
  2. {"repositories":["library/alpine"]}
  4. #开始删除
  5. $ skopeo delete docker://harbor.fumai.com/library/alpine:latest
  7. $ curl  -k -u "admin:Harbor12345" https://harbor.fumai.com/v2/_catalog
  8. {"repositories":[]}

—debug 模式：

  1. skopeo delete docker://harbor.fumai.com/library/busybox:latest --debug
  2. DEBU[0000] Loading registries configuration "/etc/containers/registries.conf"
  3. DEBU[0000] Loading registries configuration "/etc/containers/registries.conf.d/000-shortnames.conf"
  4. DEBU[0000] Loading registries configuration "/etc/containers/registries.conf.d/001-rhel-shortnames.conf"
  5. DEBU[0000] Loading registries configuration "/etc/containers/registries.conf.d/002-rhel-shortnames-overrides.conf"
  6. DEBU[0000] Found credentials for harbor.fumai.com in credential helper containers-auth.json
  7. DEBU[0000] Using registries.d directory /etc/containers/registries.d for sigstore configuration
  8. DEBU[0000]  Using "default-docker" configuration
  9. DEBU[0000]   Using file:///var/lib/containers/sigstore
  10. DEBU[0000] Looking for TLS certificates and private keys in /etc/containers/certs.d/harbor.fumai.com
  11. DEBU[0000]  crt: /etc/containers/certs.d/harbor.fumai.com/ca.crt
  12. DEBU[0000]  cert: /etc/containers/certs.d/harbor.fumai.com/harbor.fumai.com.cert
  13. DEBU[0000]  key: /etc/containers/certs.d/harbor.fumai.com/harbor.fumai.com.key
  14. DEBU[0000] GET https://harbor.fumai.com/v2/
  15. DEBU[0000] Ping https://harbor.fumai.com/v2/ status 401
  16. DEBU[0000] GET https://harbor.fumai.com/service/token?account=admin&scope=repository%3Alibrary%2Fbusybox%3A%2A&service=harbor-registry
  17. DEBU[0000] GET https://harbor.fumai.com/v2/library/busybox/manifests/latest
  18. DEBU[0000] DELETE https://harbor.fumai.com/v2/library/busybox/manifests/sha256:f75f3d1a317fc82c793d567de94fc8df2bece37acd5f2bd364a0d91a0d1f3dab
  19. DEBU[0000] Deleting /var/lib/containers/sigstore/library/busybox@sha256=f75f3d1a317fc82c793d567de94fc8df2bece37acd5f2bd364a0d91a0d1f3dab/signature-1

11.2 curl 方式删除

  1. $ curl -k -u "registryuser:registryuserpassword" --header "Accept: application/vnd.docker.distribution.manifest.v2+json" -I
  2.  -X GET https://192.168.10.80:5000/v2/busybox/manifests/latest
  3. HTTP/2 200
  4. content-type: application/vnd.docker.distribution.manifest.v2+json
  5. docker-content-digest: sha256:f75f3d1a317fc82c793d567de94fc8df2bece37acd5f2bd364a0d91a0d1f3dab
  6. docker-distribution-api-version: registry/2.0
  7. etag: "sha256:f75f3d1a317fc82c793d567de94fc8df2bece37acd5f2bd364a0d91a0d1f3dab"
  8. x-content-type-options: nosniff
  9. content-length: 527
  10. date: Tue, 22 Nov 2022 10:51:14 GMT
  12. $ curl -s -k -u "registryuser:registryuserpassword" --header "Accept: application/vnd.docker.distribution.manifest.v2+json"
  13.  -I -X GET https://192.168.10.80:5000/v2/busybox/manifests/latest | grep -i "Docker-Content-Digest" | cut -d ' ' -f 2
  14. sha256:f75f3d1a317fc82c793d567de94fc8df2bece37acd5f2bd364a0d91a0d1f3dab
  16. $ curl -u 'registryuser:registryuserpassword' -k -X DELETE https://192.168.10.80:5000/v2/busybox/manifests/sha256:f75f3d1a317fc82c793d567de94fc8df2bece37acd5f2bd364a0d91a0d1f3dab

我写了一个关于通过 API 删除仓库镜像的delete_images.sh脚本，当然你的仓库需要配置REGISTRY_STORAGE_DELETE_ENABLED=true，才能执行删除操作，否则不支持。

  1. #!/bin/bash
  4. default() {
  6.  Images=${1-'busybox:latest'}
  7.  Registry_Url=${2-'192.168.10.80:5000'}
  8.  Registry_Username=${3-'registryuser'}
  9.  Registry_Password=${4-'registryuserpassword'}
  11. }
  13. help() {
  14.     echo "Usage:"
  15.     echo "test.sh [-i Images] [-h Registry_Url] [-u Registry_Username] [-p Registry_Password] [-d]"
  16.     echo "Description:"
  17.     echo "  Images,One or more mirror images,exmple: (busybox:latest alpine:latest)."
  18.     echo "  Registry_Url, registry name，exmaple: docker.io."
  19.     echo "  Registry_Username, registry username，exmaple: 'admin'."
  20.     echo "  Registry_Password, registry password，exmaple: 'Harbor12345'."
  21.     echo "  -d, Indicates the deletion action."
  22.     exit -1
  23. }
  29. delete() {
  31. for Image in ${Images}
  32. do
  34.   Image_Name=`echo $Image | cut -d ':' -f 1 `
  35.   Image_Version=`echo $Image | cut -d ':' -f 2`
  37.   echo " Starting delete ${Registry_Url}/$Image_Name:$Image_Version..."
  38. DockerContentDigest=$(curl -s -k -u "$Registry_Username:$Registry_Password" --header "Accept: application/vnd.docker.distribution.manifest.v2+json" -I -X GET "https://${Registry_Url}/v2/${Image_Name}/manifests/${Image_Version}" | grep -i "Docker-Content-Digest" | cut -d ' ' -f 2 )
  40. DockerContentDigest=${DockerContentDigest%$'\r'}
  42.   if [[ $DockerContentDigest != '' ]];then
  43.     curl -u ${Registry_Username}:${Registry_Password} -k -X DELETE  https://${Registry_Url}/v2/${Image_Name}/manifests/${DockerContentDigest} && [ $? == 0 ] && echo "Ok, $Registry_Url/$Image delete sucessful!"
  45.    else
  46.      echo "Sorry, $Registry_Url/$Image not find!"
  47.    fi
  49. done
  51. }
  54. #[ $# == 0 ] && help
  55. [ $# == 0 ] &&  default && delete && exit 0
  59. while getopts 'i:h:u:p:d' OPT; do
  60.     case $OPT in
  61.         i) Images="$OPTARG";;
  62.         h) Registry_Url="$OPTARG";;
  63.         u) Registry_Username="$OPTARG";;
  64.         p) Registry_Password="$OPTARG";;
  65.         d) delete;;
  66.         h) help;;
  67.         ?) help;;
  68.     esac
  69. done

执行效果：我们尝试删除仓库192.168.10.80:5000的busybox:latest镜像。

  1. $ skopeo list-tags docker://192.168.10.80:5000/alpine
  2. {
  3.     "Repository": "192.168.10.80:5000/alpine",
  4.     "Tags": [
  5.         "latest"
  6.     ]
  7. }
  9. $ bash   delete_images.sh  -i alpine:latest -h 192.168.10.80:5000 -u registryuser -p registryuserpassword -d
  10.  Starting delete 192.168.10.80:5000/alpine:latest...
  11. Ok, 192.168.10.80:5000/alpine:latest delete sucessful!
  13. $ skopeo list-tags docker://192.168.10.80:5000/alpine
  14. {
  15.     "Repository": "192.168.10.80:5000/alpine",
  16.     "Tags": []
  17. }

关于skopeo 的练习就到此结束了。

参考：

引用链接

[1] Skopeo: https://github.com/containers/skopeo
[4] Podman: https://podman.io/
[5] Buildah: https://buildah.io/
[6] OCI: https://github.com/opencontainers
[7] docker.io: https://www.docker.com/
[8] quay.io: https://quay.io/
[9] Skopeo: https://github.com/containers/skopeo
[10] CRI-O: https://cri-o.io/
[11] Understanding root inside and outside a container: https://www.redhat.com/zh/blog/understanding-root-inside-and-outside-container
[12] Package Info: https://src.fedoraproject.org/rpms/skopeo
[13] Bugzilla: https://bugzilla.redhat.com/buglist.cgi?bug_status=__open__&classification=Fedora&component=skopeo&product=Fedora
[14] Package Info: https://gitlab.com/redhat/centos-stream/rpms/skopeo/-/tree/c9s
[15] Package Info: https://git.centos.org/rpms/skopeo/tree/c8s-stream-rhel8
[16] 更多 skopeo 安装方式看这里: https://github.com/containers/skopeo/blob/main/install.md
[17] Package Repo: https://git.centos.org/rpms/skopeo/tree/c7-extras
[18] Package Info: https://packages.ubuntu.com/jammy/skopeo
[19] skopeo-copy(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-copy.1.md
[20] skopeo-delete(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-delete.1.md
[21] skopeo-inspect(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-inspect.1.md
[22] skopeo-list-tags(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-list-tags.1.md
[23] skopeo-login(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-login.1.md
[24] skopeo-logout(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-logout.1.md
[25] skopeo-manifest-digest(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-manifest-digest.1.md
[26] skopeo-standalone-sign(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-standalone-sign.1.md
[27] skopeo-standalone-verify(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-standalone-verify.1.md
[28] skopeo-sync(1): https://github.com/containers/skopeo/blob/main/docs/skopeo-sync.1.md
[29] 关于 inspect 用法更多细节请看这里: https://ghostwritten.blog.csdn.net/article/details/108062031
[30] image-syncer: https://github.com/AliyunContainerService/image-syncer
[31] 如何使用 Skopeo 做一个优雅的镜像搬运工: https://www.hi-linux.com/posts/55385.html