Use the Oracle Container Registry to pull open source and licensed Oracle software container images.

The Oracle Container Registry is an open standards-based, Oracle-managed container registry service for securely storing and sharing container images. The Oracle Container Registry contains both licensed and open source Oracle software, and the images are built and signed by Oracle. Use of the container images is subject to the terms of their respective licenses.

The Oracle Container Registry is at https://container-registry.oracle.com. It provides a web interface to browse and select the images for the software that an organization can use. Oracle Container Registry hosts container images for both open source and licensed Oracle products. Licensed content requires you to authenticate and accept license agreement terms before downloading images. Before you can sign in, you must generate an authentication token.

You can use one of the Oracle Container Registry mirrors for faster download in different geographical regions.

Use the Docker Hub Registry to pull software container images.

The Docker Hub registry provides many software images, primarily for use with Docker but which are compatible with Podman. The Docker Hub registry provides a web interface for browsing available images.

The Docker Hub contains Docker images for licensed commercial Oracle software products that you might use in an enterprise.

To access images hosted in the Docker Hub, you must sign in with a valid Docker account. To get more information about creating a Docker account and using the Docker Hub, see the Docker Hub documentation.

The Docker Hub provides a web interface where you can select the Docker Certified images that you want to install. For some images, you would need to select Proceed to Checkout to either agree to any terms and conditions that might apply or to make payment if required before you can access the image.

At the conclusion of the transaction, the image is stored in the My Content area, which you can revisit later. Each image provides a description and set up instructions.

Use the podman login command to sign in to Docker Hub and pull images. For example:

podman login docker.io

podman pull docker.io/library/alpine:latest

podman logout docker.io

Set up Podman to pull images that are signed by a validated public key for a container registry. Any unsigned images can't be pulled.

1. Create a registry configuration file.

   For each registry where you require signature validation, create a YAML format configuration file in the /etc/containers/registries.d/ directory (or in $HOME/.config/containers/registries.d/ directory for standard users) and provide the value for the sigstore for that registry.

   For example, for the Oracle Container Registry, create the /etc/containers/registries.d/oracle.yaml file and populate it with the following content:

   docker:
     container-registry.oracle.com:
       sigstore: https://container-trust.oci.oraclecloud.com/podman

   See /etc/containers/registries.d/default.yaml for more information and to view a template configuration.

2. Download the public GPG key.

   Download and store the public GPG key that must be used to validate signatures for images from the registry. For the Oracle Container Registry, you can download the public GPG key from https://container-trust.oci.oraclecloud.com/podman/GPG-KEY-oracle. For example:

   sudo mkdir -p /etc/pki/containers

   sudo wget -O /etc/pki/containers/GPG-KEY-oracle https://container-trust.oci.oraclecloud.com/podman/GPG-KEY-oracle

3. Set the container policy.

   Edit the container policy configuration to add the location of the public GPG key that must be used to validate the signatures for images that are pulled from a particular registry.

   The policy configuration is in JSON format and is at /etc/containers/policy.json. Registry configuration appears under the docker key, which you might need to add under the transports key in the existing configuration. For example, a default policy configuration that has been edited to include an entry for the Oracle Container Registry appears as follows:

   {
     "default": [
       {
         "type": "insecureAcceptAnything"
       }
     ],
     "transports":
       {
         "docker-daemon":
           {
             "": [{"type":"insecureAcceptAnything"}]
           },
         "docker":
           {
             "container-registry.oracle.com": [
               {
                 "type": "signedBy",
                 "keyType": "GPGKeys",
                 "keyPath": "/etc/pki/containers/GPG-KEY-oracle"
               }
             ]
           }
       }
   }

   See the containers-policy.json(5) manual page for more information about the format of this configuration file.

4. Validate the configuration.

   Validate that the configuration is correct by pulling an image from the remote registry. For example:

   podman pull container-registry.oracle.com/os/oraclelinux:9-slim

   If the signature requirement is configured correctly, the output isn't different from an output when you pull an image without signature validation configured.

5. (Optional) Confirm GPG key is used.

   You can test that validation is taking place by setting the GPG keyPath in the policy configuration to use another key. For example, you can configure the path to use the GPG key used to validate RPM packages at /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle. When pulling the same image, validation of the signature fails with an error similar to:

   Trying to pull container-registry.oracle.com/os/oraclelinux:9-slim...
   Error: copying system image from manifest list: Source image rejected: Invalid GPG signature: 
   gpgme.Signature{Summary:128, Fingerprint:"4451CA2B13A2D6522D9E12DF357217938FC350A2", 
   Status:gpgme.Error{err:0x9}, Timestamp:time.Date(2025, time.July, 16, 19, 18, 22, 0, time.Local), 
   ExpTimestamp:time.Date(1970, time.January, 1, 0, 0, 0, 0, time.Local), WrongKeyUsage:false, 
   PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}

Edit the container registry configuration file to set registry options for the environment. This can be set system wide, and for users.

cp /etc/containers/registries.conf $HOME/.config/containers/registries.conf