Unregistry — Push Docker Images Directly to Servers Without a Registry

Introduction

Unregistry lets you push Docker images directly to remote servers without running a container registry. It transfers image layers over SSH, making it ideal for small teams and simple deployments where setting up and maintaining a registry adds unnecessary complexity.

What Unregistry Does

• Pushes OCI container images directly from a local machine to a remote Docker host
• Transfers only missing layers to minimize bandwidth and transfer time
• Uses SSH as the transport layer, requiring no additional infrastructure
• Works with containerd on the remote host for importing image content
• Supports standard image references and tagging conventions

Architecture Overview

Unregistry reads image layers from the local container runtime, computes which layers are already present on the remote host, and streams only the missing content over an SSH connection. On the remote side, it writes layers directly into the containerd content store, then creates the image reference. The entire process bypasses the registry pull/push protocol, using SSH as a secure and authenticated channel.

Self-Hosting & Configuration

• Install the binary via go install or download a release from GitHub
• Ensure SSH key-based authentication is configured for target servers
• The remote server needs containerd running with the default socket path
• No configuration files required; all options are passed via CLI flags
• Works alongside existing Docker and containerd setups without conflicts

Key Features

• Zero infrastructure overhead with no registry server to deploy or maintain
• Delta transfers that skip layers already present on the target host
• SSH-based security using existing authentication and encryption
• Single static binary written in Go with no runtime dependencies
• Compatible with standard OCI image formats and multi-architecture manifests

Comparison with Similar Tools

• Docker Registry — full registry server with HTTP API; Unregistry avoids the server entirely
• Skopeo — copies images between registries and storage; Unregistry pushes directly to a containerd host
• docker save/load — exports and imports tar archives; Unregistry transfers only missing layers incrementally
• ko — builds Go images without Docker; Unregistry is language-agnostic and focuses on deployment

FAQ

Q: Does Unregistry work with Docker Engine or only containerd? A: It works with containerd, which is the runtime underlying Docker Engine on modern Linux hosts.

Q: Can I push to multiple servers at once? A: You can push to servers sequentially. Parallel push to multiple hosts would require scripting multiple commands.

Q: Is there support for private registries as a source? A: Unregistry reads from the local container store. You would first pull the image locally, then push it to the remote host.

Q: Does it handle multi-platform images? A: Yes, it supports OCI manifests including multi-architecture image indexes.

Sources

• https://github.com/psviderski/unregistry