Hanzo Registry
A private registry for your container images at oci.hanzo.ai. It serves the OCI distribution API, so docker, podman, buildkit, skopeo and crane already know how to talk to it — and the credential is a short-lived token minted by your Hanzo IAM login, not a password living in a dockerconfigjson secret.
$ hanzo login oci.hanzo.ai
# IAM mints a short-lived token
$ docker push oci.hanzo.ai/acme/api:v1.2.3Built on Hanzo IAM
The credential expires on its own, so there is nothing to rotate and nothing to leak
IAM Token Auth
An unauthenticated pull gets a 401 naming Hanzo IAM. Your client fetches a token there, the registry checks its signature against a certificate it holds, and the push goes through. No password is stored at either end.
Org-Scoped Repos
A repository name begins with your org, and what a token may do with it is decided by IAM at the moment the token is minted. Adding a teammate is one grant in one place, not a secret copied into a second.
Cosign + Attestation
cosign signatures and in-toto attestations are ordinary OCI artifacts, so they push and pull to the same repository as the image they describe. Verification happens where the image runs, against exactly what the registry stored.
OCI Compliant
The registry HTTP API v2 at /v2/, and nothing bespoke on top of it. Every client, scanner and admission controller that reads an image already speaks it, which is the whole point of not inventing one.
Tags come off cleanly
Deletes are enabled, so a tag you pushed by mistake goes away and the blobs behind it are reclaimed. A registry you can only add to is one that only grows.
The same account as everything else
Whoever signs into Hanzo Cloud is who pushes an image. One directory of people, one place to revoke someone — and no separate registry account to remember when they leave.
Delete the dockerconfigjson secret
Put a token IAM mints in its place, and let it expire on its own. There is nothing left to rotate.