OCI Registry, A Blob Pushed And Pulled
The CNCF Distribution registry from the upstream release (sha256-verified) as a hardened system service on loopback with filesystem storage and deletion enabled, for a TLS proxy that authenticates. The live test walks the OCI protocol: starts an upload, puts a blob by digest, reads its headers back and deletes it. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-20 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-registry?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [OCI Registry, A Blob Pushed And Pulled](https://www.iac-bazaar.com/catalog/ansible-registry?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# OCI Registry, A Blob Pushed And Pulled: https://www.iac-bazaar.com/catalog/ansible-registry (download from your IaC Bazaar account)
```Preview:
Documentation
registry
The CNCF Distribution registry (the reference OCI registry, once
docker/distribution) from the upstream release (sha256-verified), as a
hardened system service on loopback with filesystem storage and deletion
enabled. Original role for EL 10, live-tested with podman on Rocky Linux
10.
No package, so the checksum is the whole story. EL 10 carries no
registry; CNCF Distribution ships a release with a checksum file beside it. The
role downloads both and has Ansible's get_url refuse the asset unless its
SHA-256 is the one in the vendor's file, then installs the binaries as
root's in /usr/local/bin, pinned by registry_version.
A service account, a hardened unit, a loopback listener. registry
is a system user with no shell that owns the data directory and nothing
else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and
ProtectSystem=strict. The listener is 127.0.0.1:5000 by default,
for a proxy that authenticates or a client on the same host; the live test
reads the listening sockets and expects loopback only.
A blob, pushed and pulled. The live test walks the OCI distribution
protocol: it starts an upload, puts a fourteen-byte blob by digest, reads
its headers back and deletes it, the four calls every podman push makes
in the same order. A storage driver health check runs every ten seconds.
Loopback, for a proxy that authenticates. The registry itself has no
users; it trusts whoever reaches it. On loopback that is this host; for a
network, put it behind a TLS proxy that authenticates (this catalogue's
caddy-https or haproxy-tls), which is what the upstream documentation says
too. The vendor publishes one .sha256 per asset holding only the hash,
which get_url reads as is.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-crane
crane on EL 10 from the GitHub release; get_url refuses it unless its SHA-256 is in the vendor's checksums file, and the live test re-checks it, then builds an image tarball from one layer with append --oci-empty-base, lists its manifest.json, and has crane ls reach a registry on a dead port (connection refused). Pinned. Original role, live-tested on Rocky Linux 10.
ansible-dive
dive on EL 10 from the GitHub release; get_url refuses it unless its SHA-256 is in the vendor's checksums file, and the live test re-checks it, then writes a one-layer image in docker-archive form and has dive --ci analyse it (PASS) and export the analysis as JSON, asserting the layer and the file in it. Pinned. Original role, live-tested on Rocky Linux 10.
ansible-zot
zot, the OCI-native registry, from the upstream release binary (sha256-verified, the minimal build by default) as a hardened system service on loopback with dedupe and garbage collection, its config checked by zot verify before it lands. The live test uploads a blob by digest, reads it back, sees the repository in the catalogue, deletes the blob. Original role, live-tested on Rocky Linux 10.