HanzoRegistry
A private registry for your container images at oci.hanzo.ai. It serves the OCI distribution API, so docker, podman, buildkit, skopeo and crane already know how to talk to it — and the credential is a short-lived token minted by your Hanzo IAM login, not a password living in a dockerconfigjson secret.
View SourceBuilt on Hanzo IAM
The credential expires on its own, so there is nothing to rotate and nothing to leak
An unauthenticated pull gets a 401 naming Hanzo IAM. Your client fetches a token there, the registry checks its signature against a certificate it holds, and the push goes through. No password is stored at either end.
A repository name begins with your org, and what a token may do with it is decided by IAM at the moment the token is minted. Adding a teammate is one grant in one place, not a secret copied into a second.
cosign signatures and in-toto attestations are ordinary OCI artifacts, so they push and pull to the same repository as the image they describe. Verification happens where the image runs, against exactly what the registry stored.
The registry HTTP API v2 at /v2/, and nothing bespoke on top of it. Every client, scanner and admission controller that reads an image already speaks it, which is the whole point of not inventing one.
Deletes are enabled, so a tag you pushed by mistake goes away and the blobs behind it are reclaimed. A registry you can only add to is one that only grows.
Whoever signs into Hanzo Cloud is who pushes an image. One directory of people, one place to revoke someone — and no separate registry account to remember when they leave.
Delete the dockerconfigjson secret
Put a token IAM mints in its place, and let it expire on its own. There is nothing left to rotate.
$ hanzo login oci.hanzo.ai
# IAM mints a short-lived token
$ docker push oci.hanzo.ai/acme/api:v1.2.3
- Adding a teammate
- a secret copied into a second
- Someone leaves
- a separate registry account to remember when they leave
- acme/gatewayReady
- acme/payments-apiReady
- acme/checkout-webBuilding
- acme/docs-siteReady
The service the session above is changing.
Static, published by the same pipeline as the rest.
Example project. Every name in it is one you would give your own.
Get Registry
OCI image registry
- License: Apache-2.0
- hanzoai
Get started with Registry
View on GitHubPaste and ship
Paste this into any agent. It reads the skill manifest and calls Registry from there.
Read https://hanzo.ai/skill.md and use Hanzo Registry in my project. Start with: hanzo registry images