# Hanzo Registry — Hanzo AI

> Container registry with IAM-token auth. Push, pull, and sign OCI images without rotating long-lived registry passwords.

Container Registry

# Hanzo Registry

A private registry for your container images at oci.hanzo.ai. It serves the OCI distribution API, so docker, podman, buildkit, skopeo and crane already know how to talk to it — and the credential is a short-lived token minted by your Hanzo IAM login, not a password living in a dockerconfigjson secret.

[Push an Image](https://docs.hanzo.ai/docs/registry)[View Source](https://github.com/hanzoai)

```
$ hanzo login oci.hanzo.ai# IAM mints a short-lived token$ docker push oci.hanzo.ai/acme/api:v1.2.3
```

## Built on Hanzo IAM

The credential expires on its own, so there is nothing to rotate and nothing to leak

### IAM Token Auth

An unauthenticated pull gets a 401 naming Hanzo IAM. Your client fetches a token there, the registry checks its signature against a certificate it holds, and the push goes through. No password is stored at either end.

### Org-Scoped Repos

A repository name begins with your org, and what a token may do with it is decided by IAM at the moment the token is minted. Adding a teammate is one grant in one place, not a secret copied into a second.

### Cosign + Attestation

cosign signatures and in-toto attestations are ordinary OCI artifacts, so they push and pull to the same repository as the image they describe. Verification happens where the image runs, against exactly what the registry stored.

### OCI Compliant

The registry HTTP API v2 at /v2/, and nothing bespoke on top of it. Every client, scanner and admission controller that reads an image already speaks it, which is the whole point of not inventing one.

### Tags come off cleanly

Deletes are enabled, so a tag you pushed by mistake goes away and the blobs behind it are reclaimed. A registry you can only add to is one that only grows.

### The same account as everything else

Whoever signs into Hanzo Cloud is who pushes an image. One directory of people, one place to revoke someone — and no separate registry account to remember when they leave.

## Delete the dockerconfigjson secret

Put a token IAM mints in its place, and let it expire on its own. There is nothing left to rotate.

[Quickstart](https://docs.hanzo.ai/docs/registry)[About IAM](https://hanzo.ai/iam)

## Get started with Registry

[Read the docs](https://docs.hanzo.ai/docs/registry)[View on GitHub](https://github.com/hanzoai)

## Open source

License: Apache-2.0[hanzoai](https://github.com/hanzoai)

## Get Registry

OCI image registry

[Deploy to Cloud](https://console.hanzo.ai/deploy)[Self-host](https://docs.hanzo.ai/docs/registry)