Orkestia Registry

Orkestia Registry is the container registry for your organization. Images live at registry.orkestia.dev/<namespace>/<name>. An owner or an admin turns it on once. You get one namespace, and that name is the first part of every image path.

In Cockpit, open Registry under Your Orkestia bill. The page shows the host, the namespace, the bytes in use, and the quota. On the console, Container registries shows the same host, namespace, and the login and push lines, under Orkestia Registry.

A registry you already connected keeps its own host. This page is registry.orkestia.dev.

Turn it on

In Cockpit, an owner or an admin presses Enable registry.

From the API, an organization admin runs registry.native.enable. Leave namespace empty and Orkestia builds one from the organization name. Pass namespace when you want to choose it.

A namespace is 2 to 41 characters: lowercase letters, digits, and hyphens, starting with a letter or a digit. It stays fixed after enable. Enable again and you receive the same namespace. A name another organization already holds is refused.

The default quota is 5 GiB.

Push and pull

In Cockpit, an owner or an admin presses Create a one-hour password. The username is the namespace. The password lasts one hour. From the API, anyone in the organization can run registry.native.login and read username and token. The token is the password, and it is shown once.

Sign in, then tag and push. Replace acme with your namespace:

printf '%s' "$PASSWORD" | docker login registry.orkestia.dev --username acme --password-stdin
docker build -t registry.orkestia.dev/acme/api:1.0 .
docker push registry.orkestia.dev/acme/api:1.0
docker pull registry.orkestia.dev/acme/api:1.0

The image name has two path parts: your namespace, then the repository name. Create a new password for each CI job and pass it on stdin. Let it expire.

Docker exchanges that password with registry.orkestia.dev for an access token that can push, pull, and delete tags under your namespace. A repository whose first path part is another namespace is refused.

Usage

The Registry page shows bytes in use and the quota. Usage is estimated at Azure cost ×5 and is not a line on the invoice.

New passwords stop when the latest daily reading reaches the quota. Remove tags or wait until the reading is under the quota, then create another password.

Turn passwords off

An organization admin runs registry.native.disable. New passwords stop. The images stay for 30 days. registry.native.enable during that window turns passwords back on and keeps the namespace.

After those 30 days, registry.native.purge starts removal. The namespace stays reserved until the images are gone.

registry.native.status returns the host, the namespace, the quota, the bytes from the last daily reading, and the login and push lines.