ORAS
1 min read
OCI Registry As Storage. Push and pull arbitrary artifacts — configs, binaries, Helm charts, SBOMs, signatures, Wasm modules — to/from any OCI-compliant registry.
Basic usage
sh
# Push a file to a registry
oras push ghcr.io/myuser/myartifact:v1.0 myfile.tar.gz
# Push with media type
oras push ghcr.io/myuser/config:latest \
--artifact-type application/vnd.myapp.config.v1 \
config.json:application/json
# Pull artifacts
oras pull ghcr.io/myuser/myartifact:v1.0
# Discover artifact types attached to an image
oras discover ghcr.io/myuser/myimage:latest
# Copy between registries
oras copy ghcr.io/source/image:tag registry.example.com/dest/image:tag
# Inspect manifest
oras manifest fetch ghcr.io/myuser/myartifact:v1.0
# Resolves digest of the target artifact
oras resolve ghcr.io/myuser/myartifact:v1.0
Attach artifacts to existing images
sh
# Attach an SBOM to an existing image
oras attach ghcr.io/myuser/myimage:latest \
--artifact-type application/vnd.cyclonedx \
sbom.json:application/json
# Discover what's attached
oras discover ghcr.io/myuser/myimage:latest
Authentication
sh
oras login ghcr.io -u USERNAME --password-stdin
oras logout ghcr.io
Use cases
• Distributing Helm charts, OPA policies, Wasm modules
• Storing SBOMs and signatures alongside container images
• Binary distribution via OCI registries
• Config and artifact versioning with registry semantics