unregistry

Unregistry is a lightweight container image registry that stores and serves images directly from the Docker daemon's storage (containerd image store). It is designed to remove the need for an external registry when moving images between machines. The project ships a Docker CLI plugin command, `docker pussh` (the extra 's' stands for SSH), which pushes images straight to a remote Docker server over SSH. Only layers that are missing on the remote side are transferred, which the README describes as making the operation fast and efficient. How it works, per the README: the command establishes an SSH tunnel to the remote server, starts a temporary unregistry container there, forwards a random localhost port to the unregistry port through the tunnel, runs `docker push` to unregistry through that forwarded port (transferring only layers not already present remotely), then stops the unregistry container and closes the tunnel. The transferred image becomes available on the remote Docker daemon. The README compares the approach to rsync for Docker images. Motivation: the README lists common alternatives and their drawbacks — public registries (code exposure or paid private repos), self-hosted registries (extra service to maintain and secure), `docker save | ssh ... docker load` (transfers the whole image even when most layers already exist remotely), and remote rebuilds (wasted time and resources). Unregistry was originally created for Uncloud, a tool for deploying containers across multiple Docker hosts. Requirements: locally, a Docker CLI with plugin support (Docker 19.03+) and an OpenSSH client. On the remote server, Docker must be installed and running, the SSH user must be able to run docker commands (root or a user in the docker group), and passwordless `sudo docker` is needed if sudo is required. The server needs internet access to ghcr.io to pull the unregistry image on first use, unless the image is preloaded manually for air-gapped or restricted environments. The unregistry container needs access to the containerd socket at /run/containerd/containerd.sock and runs as root. Installation options documented: Homebrew (`brew install psviderski/tap/docker-pussh`, plus a symlink into ~/.docker/cli-plugins), direct download of the docker-pussh script into the plugins directory, and unofficial Debian packages maintained in a separate repository. Windows is not currently supported, though WSL 2 with the Linux instructions is suggested. Installation can be verified with `docker pussh --help`. A notable configuration topic is the containerd image store. Unregistry stores images in containerd's image store, but by default Docker keeps its own separate storage layer. With the containerd image store enabled in Docker, pushed images are immediately available to Docker with no duplication and faster pussh operations. Without it, pussh runs an additional `docker pull` on the remote host, images are stored twice, and unmanaged containerd images can accumulate; the README shows `ctr -n moby images ls` and `ctr -n moby images rm` for manual cleanup. Enabling the containerd image store is documented as causing temporary loss of images and containers created with the classic storage driver. Usage examples include pushing to a remote host, SSH key authentication with `-i`, a custom SSH port, a custom SSH config file with `-F`, selecting a platform for multi-platform images (requiring the containerd image store locally), and overriding the unregistry image version via the UNREGISTRY_IMAGE environment variable. Documented use cases are deploying to production servers, CI/CD pipelines, and homelab or air-gapped environments. Unregistry can also be run standalone as a local registry on port 5000 by mounting the containerd socket. The README links third-party projects: a GitHub Action to push images with docker-pussh, a GitHub Action to install the plugin, and a Python tool for cleaning up images in self-hosted registries. It credits Spegel as inspiration for using the containerd image store as a registry backend and Docker Distribution as the registry implementation unregistry is based on.