Skopeo — Registry-Agnostic Container Image Toolkit

What it is

Skopeo is a command-line utility for performing operations on container images and image registries. It can inspect, copy, sign, and delete images across any OCI-compliant or Docker registry without requiring a running Docker daemon. Skopeo is part of the Red Hat containers ecosystem alongside Podman, Buildah, and CRI-O.

DevOps engineers, CI pipeline authors, and platform teams who need to mirror, audit, or transfer container images across registries will find Skopeo essential. It supports multiple transports including Docker registries, OCI layouts, OCI archives, and local directories.

How it saves time or tokens

Traditional image mirroring requires pulling an image to a local Docker daemon and then pushing it to a destination registry. Skopeo performs registry-to-registry copies directly, skipping the local storage layer entirely. This eliminates disk I/O overhead and reduces pipeline execution time. For air-gapped environments, skopeo sync can mirror entire repositories in a single command rather than scripting individual pull-tag-push sequences.

How to use

1. Install Skopeo via your package manager (brew install skopeo on macOS, apt install skopeo on Debian/Ubuntu)
2. Inspect a remote image to check its manifest and layers:

skopeo inspect docker://alpine:latest

1. Copy images between registries without a local daemon:

skopeo copy docker://quay.io/prometheus/prometheus:latest \
  docker://registry.example.com/prom/prometheus:latest

1. Mirror a full repository for air-gapped deployments:

skopeo sync --src docker --dest dir registry.io/myorg/myapp /local/mirror/

Example

# Inspect image metadata without pulling
skopeo inspect docker://nginx:1.25 | jq '.Digest, .Architecture'

# Copy to an OCI layout for offline transfer
skopeo copy docker://postgres:16 oci:./oci-layout:postgres:16

# List all tags in a remote repository
skopeo list-tags docker://docker.io/library/python

# Sign an image on copy with cosign
skopeo copy --sign-by key@example.com \
  docker://src-registry.io/app:v1 \
  docker://dst-registry.io/app:v1

Related on TokRepo

• DevOps Automation Tools -- explore automation workflows for CI/CD pipelines
• Self-Hosted Tools -- discover self-hosted infrastructure tools

Common pitfalls

• Skopeo does not build images. Use Buildah or Docker for image creation, then Skopeo for transport.
• Authentication credentials must be configured per-registry via skopeo login or ~/.docker/config.json. Missing auth causes cryptic 401 errors.
• The sync command mirrors all tags by default. Use --scoped to preserve repository paths and avoid tag collisions in the destination.