crane

Log in to a registry

$ crane auth login [registry] [[-u|--username]] [user] [[-p|--password]] [password]

$ crane catalog [registry] --full-ref

$ crane ls [repository] [[-o|--omit-digest-tags]]

$ crane pull [image] [tarball]

$ crane push [path/to/directory_or_tarball] [image]

$ crane tag [image] [tag]

$ crane [[cp|copy]] [source] [destination] [[-a|--all-tags]]

$ crane delete [image]

crane [OPTIONS] <COMMAND> [<ARGS>]...

-h, --help
    Show help for command

--insecure
    Allow insecure (HTTP/non-TLS) registry connections

--platform <PLATFORM>
    Set target platform (e.g., linux/amd64)

--platform-file <FILE>
    Read platforms from file

--log-level <LEVEL>
    Set logging level (debug,info,warn,error)

Crane is a lightweight, standalone binary for interacting with container registries using the OCI distribution spec. It enables daemonless operations like pulling, pushing, copying, listing, and inspecting images without Docker or Podman. Ideal for CI/CD pipelines, air-gapped environments, and scripts needing registry access.

Key features include multi-platform support, layer rebase, manifest inspection, and verification with cosign. Crane fetches only necessary layers, supports tar exports, and handles authentication via standard mechanisms. It's written in Go, statically linked, and has no runtime dependencies, making it portable across Linux, macOS, and Windows.

Does not build or run containers; registry ops only.
Push requires auth and write perms.
Large images may need significant disk space.

pull <src> <dest>: Download image to tar.
push <src> <dest>: Upload tar to registry.
cp <src> <dest>: Copy between refs.
ls <repo>: List tags.
cat-config <img>: Show config JSON.

Developed by Google as part of go-containerregistry (2019+). Evolved for sigstore/cosign integration, emphasizing speed and minimalism over full Docker replacement.

skopeo(1), regctl(1), docker(1), podman(1)