Embedded OCI registry

ReaperCI serves a Distribution-compatible OCI registry on the same HTTPS origin as the dashboard. Dockerfile pipeline steps push immutable build images to it, and deployment runners authenticate immediately before pulling the selected image. The hub does not mount the host Docker socket.

Inventory

The dashboard Registry page lists repositories, current tags, manifest digests, media types, and manifest sizes. It is a read-only operational view: builds publish through the OCI /v2/ protocol, while tag deletion and garbage collection remain deliberate maintenance operations.

Agents and other clients can request the same paginated inventory:

GET /api/v1/registry/repositories?limit=50
GET /api/v1/registry/repositories?limit=50&last=team/example

The optional next response field is the last cursor for the next page. The host field is the configured pull host used to construct deployable image references; it can differ from the dashboard origin in development. Viewer identities may read inventory, but registry writes require the private hub-managed robot credential used by BuildKit and deployment runners. That credential is encrypted at rest and is never returned by the management API. Repository responses include at most 100 tags; tagsTruncated signals that additional tags exist.

Windows development starts a Docker-volume-backed registry because host filesystem uploads do not provide the required Linux rename semantics. The development scripts set REAPERCI_REGISTRY_CATALOG_URL to its loopback URL so the same Registry page shows the images BuildKit actually pushed. Production normally leaves this variable unset and inventories the embedded registry root.

Storage and recovery

Registry data lives below <data>/registry in the same durable data volume as the hub state. Production backup and restore includes the complete registry root. On supported Linux hosts, use a Docker volume or a filesystem whose rename, locking, and durability semantics have passed the release upload test.

After restoring, verify both the management inventory and an authenticated manifest pull before reopening builds or deployments. Run offline garbage collection only with the hub stopped:

reaperci registry gc --root <data>/registry --dry-run
reaperci registry gc --root <data>/registry

The first command is mandatory evidence for the maintenance record. Never run mark-and-sweep while uploads, builds, or deployment pulls are active.