skopeo-copy(1)() skopeo-copy(1)() (NAME) skopeo-copy - ( ) (SYNOPSIS) skopeo copy [] source-image destination-image (DESCRIPTION) ( ) . (trust policy) . source-image << >> . destination-image << >> . source-image destination-image . (OPTIONS) skopeo(1) . --additional-tag=strings ( docker-archive ). --all, -a source-image ( --override-os --override-arch --override-variant) . --authfile path . ${XDG_RUNTIME_DIR}/containers/auth.json . containers-auth.json(5) . skopeo login . REGISTRY\_AUTH\_FILE . --src-authfile path . --authfile . --dest-authfile path . --authfile . --dest-shared-blob-dir directory blob OCI. --digestfile path . --preserve-digests . . --all . --encrypt-layer ints (Experimental) ( 0 -1 ). --format, -f manifest-type (oci v2s1 v2s2) ( fallback ). --help, -h --multi-arch option source-image . system . : - system: - all: - index-only: (index) - platform-list: ( / linux/amd64,linux/arm64) index-only platform-list (sparse) . . --quiet, -q . --remove-signatures ( ) source-image . . --remove-list-signatures (instance) . --remove-signatures . --strip-removed-platforms ( --multi-arch ) . . : --remove-signatures --remove-list-signatures . . --sign-by key-id <> destination-image . --sign-by-sigstore param-file sigstore sigstore param-file. containers-sigstore-signing-params.yaml(5) . --sign-by-sigstore-private-key path sigstore path destination-image . --sign-by-sq-fingerprint fingerprint <> Sequoia-PGP (fingerprint) . --sign-passphrase-file path --sign-by --sign-by-sigstore- private-key --sign-by-sq-fingerprint. . . ..PP --sign-identity reference . docker reference . docker reference . --src-shared-blob-dir directory blob OCI. --encryption-key protocol:keyfile JWE (RFC7516) PGP (RFC4880) PKCS7 (RFC2315) . jwe:/path/to/key.pem pgp:admin@example.com pkcs7:/path/to/x509-file. --decryption-key key[:passphrase] . / . . (passphrase) . --src-creds username[:password] . --dest-compress tarball 'dir'. ( ). --dest-decompress tarball 'dir'. ( ). --dest-oci-accept-uncompressed-layers OCI 'oci'. ( ). --dest-creds username[:password] . --src-cert-dir path path (*.crt, *.cert, *.key) . --src-no-creds . --src-tls-verify=bool HTTPS . . --dest-cert-dir path path (*.crt, *.cert, *.key) . --dest-no-creds . --dest-tls-verify=bool HTTPS . . --src-daemon-host host docker host. host tcp:// HTTPS . HTTP http:// ( unix:///var/run/docker.sock ). --dest-daemon-host host docker host. host tcp:// HTTPS . HTTP http:// ( unix:///var/run/docker.sock ). --dest-compress-format format . : gzip zstd zstd:chunked. zstd:chunked zstd . --dest-compress-level format . zstd 1-20 ( ) gzip 1-9 ( ) . --dest-force-compress-format --dest-compress-format . --src-registry-token token Bearer . --dest-registry-token token Bearer . --dest-precompute-digests (digests) . ( <>) (stream) . --retry-times . . --retry-delay . ( 0s ) . --src-username . --src-password . --dest-username . --dest-password . --image-parallel-copies n (pull/push) . containers/image ..SH " (EXAMPLES)" : $ skopeo copy docker://quay.io/skopeo/stable:latest docker://registry.example.com/skopeo:latest busybox docker.io : $ mkdir -p /var/lib/images/busybox $ skopeo copy docker://busybox:latest dir:/var/lib/images/busybox $ ls /var/lib/images/busybox/* /tmp/busybox/2b8fd9751c4c0f5dd266fcae00707e67a2545ef34f9a29354585f93dac906749.tar /tmp/busybox/manifest.json /tmp/busybox/8ddc19f16526912237dd8af81971d5e4dd0587907234be2b83e249518d5b673f.tar docker load ( ): $ skopeo copy docker://busybox:latest docker-archive:archive-file.tar:busybox:latest : $ skopeo copy --sign-by dev@example.com containers-storage:example/busybox:streaming docker://example/busybox:gold ( / ): $ skopeo copy --multi-arch=linux/amd64,linux/arm64 docker://quay.io/skopeo/stable:latest docker://registry.example.com/skopeo:latest ( ): $ skopeo copy --multi-arch=linux/amd64,linux/arm64 --strip-removed-platforms --remove-list-signatures docker://quay.io/skopeo/stable:latest docker://registry.example.com/skopeo:latest : $ skopeo copy docker://docker.io/library/nginx:1.17.8 oci:local_nginx:1.17.8 $ openssl genrsa -out private.key 1024 $ openssl rsa -in private.key -pubout > public.key $ skopeo copy --encryption-key jwe:./public.key oci:local_nginx:1.17.8 oci:try-encrypt:encrypted : $ skopeo copy --decryption-key ./private.key oci:try-encrypt:encrypted oci:try-decrypt:decrypted : $ skopeo copy oci:try-encrypt:encrypted oci:try-encrypt-copy:encrypted : $ skopeo copy --decryption-key ./private1.key --decryption-key ./private2.key --decryption-key ./private3.key oci:try-encrypt:encrypted oci:try-decrypt:decrypted . (0-indexed) -1 . docker.io/library/nginx:1.17.8 : $ skopeo copy --encryption-key jwe:./public.key --encrypt-layer 1 oci:local_nginx:1.17.8 oci:try-encrypt:encrypted skopeo(1), skopeo-login(1), docker-login(1), containers-auth.json(5), containers-policy.json(5), containers-transports(5), containers-signature(5) (AUTHORS) Antonio Murdaca runcom@redhat.com , Miloslav Trmac mitr@redhat.com , Jhon Honce jhonce@redhat.com skopeo-copy(1)()