Overview
Store and manage your OCI-compliant container images and Helm charts from a single, workspace-scoped console. Registry gives your teams one place to distribute and govern artifacts, with vulnerability scanning, retention policies, deployment locks, and fine-grained access control built in, consolidating artifact storage and supply-chain governance into one consistent, IAM-integrated model.
Every repository lives inside a workspace, at a registry hostname your clients log in against.
Pull traffic flows straight through the registry data plane, which speaks the OCI Distribution
protocol so any standard client works; the management operations that need authorization and an
audit trail, creating repositories, deleting tags, and setting policies, run through
qibdo’s API and are gated by IAM.
Core resources
Section titled “Core resources”- Repositories: the top-level registry resource, living directly inside a workspace — a
named collection of artifacts (for example
nginxorredis). Each repository has a visibility (public or private), a format (Docker, Helm, or OCI) fixed at creation, and an optional immutable-tags setting that blocks a tag from being moved once it points at an artifact. - Artifacts and tags: an artifact is one OCI artifact, a manifest plus the blobs it
references, identified by a content digest (
sha256:…). A tag is a movable name that points at a digest; deleting a tag leaves the artifact in place unless it was the last reference. - Access control: access policies grant a principal (a user, group, or service account) a set of actions (pull or push) over the whole workspace registry, a single repository, or every repository whose name matches a pattern. Cross-workspace pull grants extend pull access from one workspace to another, optionally limited by a tag pattern and an expiry.
- Supply-chain governance: scan policies configure vulnerability scanning, retention policies prune artifacts on a schedule (keep the last N, keep newer than N days, or keep tags matching a pattern), and deployment locks pin an in-use artifact so it cannot be deleted while a deployment depends on it.
- Operations: every mutation returns an operation record that captures the request and comes back already completed. A triggered vulnerability scan then runs asynchronously, with the artifact’s scan status advancing as it progresses.