skopeo/docs/skopeo-copy.1.md

% skopeo-copy(1)

NAME

skopeo-copy - Copy an image (manifest, filesystem layers, signatures) from one location to another.

SYNOPSIS

skopeo copy [--sign-by=key-ID] source-image destination-image

DESCRIPTION

Copy an image (manifest, filesystem layers, signatures) from one location to another.

Uses the system's trust policy to validate images, rejects images not trusted by the policy.

source-image use the "image name" format described above

destination-image use the "image name" format described above

OPTIONS

--authfile path

Path of the authentication file. Default is ${XDG_RUNTIME_DIR}/containers/auth.json, which is set using podman login. If the authorization state is not found there, $HOME/.docker/config.json is checked, which is set using docker login.

--format, -f manifest-type Manifest type (oci, v2s1, or v2s2) to use when saving image to directory using the 'dir:' transport (default is manifest type of source)

--quiet, -q suppress output information when copying images

--remove-signatures do not copy signatures, if any, from source-image. Necessary when copying a signed image to a destination which does not support signatures.

--sign-by=key-id add a signature using that key ID for an image name corresponding to destination-image

--src-creds username[:password] for accessing the source registry

--dest-compress bool-value Compress tarball image layers when saving to directory using the 'dir' transport. (default is same compression type as source)

--dest-creds username[:password] for accessing the destination registry

--src-cert-dir path Use certificates at path (*.crt, *.cert, *.key) to connect to the source registry or daemon

--src-tls-verify bool-value Require HTTPS and verify certificates when talking to container source registry or daemon (defaults to true)

--dest-cert-dir path Use certificates at path (*.crt, *.cert, *.key) to connect to the destination registry or daemon

--dest-ostree-tmp-dir path Directory to use for OSTree temporary files.

--dest-tls-verify bool-value Require HTTPS and verify certificates when talking to container destination registry or daemon (defaults to true)

--src-daemon-host host Copy from docker daemon at host. If host starts with tcp://, HTTPS is enabled by default. To use plain HTTP, use the form http:// (default is unix:///var/run/docker.sock).

--dest-daemon-host host Copy to docker daemon at host. If host starts with tcp://, HTTPS is enabled by default. To use plain HTTP, use the form http:// (default is unix:///var/run/docker.sock).

Existing signatures, if any, are preserved as well.

EXAMPLES

To copy the layers of the docker.io busybox image to a local directory:

$ mkdir -p /var/lib/images/busybox
$ skopeo copy docker://busybox:latest dir:/var/lib/images/busybox
$ ls /var/lib/images/busybox/*
  /tmp/busybox/2b8fd9751c4c0f5dd266fcae00707e67a2545ef34f9a29354585f93dac906749.tar
  /tmp/busybox/manifest.json
  /tmp/busybox/8ddc19f16526912237dd8af81971d5e4dd0587907234be2b83e249518d5b673f.tar

To copy and sign an image:

$ skopeo copy --sign-by dev@example.com atomic:example/busybox:streaming atomic:example/busybox:gold

SEE ALSO

skopeo(1), podman-login(1), docker-login(1)

AUTHORS

Antonio Murdaca runcom@redhat.com, Miloslav Trmac mitr@redhat.com, Jhon Honce jhonce@redhat.com