skopeo

To inspect a container image without pulling it, you use skopeo to perform read-only registry inspections, retrieving image metadata and layers directly from Harbor, Docker Hub, Quay, or GHCR without a local Docker daemon.

Yes, you can copy or retag container images across different registries without Docker installed. The process uses skopeo for cross-registry image copies, enforcing secure credential retrieval and strict operational confirmations for safe execution.

To handle self-signed TLS certificates for a private Harbor registry, you disable TLS verification by passing the --tls-verify=false flag during your skopeo operations, allowing secure connections without requiring valid certificate chains.

You securely retrieve registry credentials for container image operations by enforcing Vault-based credential retrieval at runtime, injecting the authenticated username and password directly into the skopeo command execution environment.

The best way to verify container image architecture and OS compatibility is to use skopeo inspect to check the image manifest details, ensuring the target architecture and operating system match your deployment requirements before pulling or copying.

You list tags and verify image digests across multiple container registries by running skopeo list-tags and inspect commands, comparing the cryptographic digest output against expected values to ensure image integrity across Harbor and public registries.