Launching OCI image from local repo

1

I have an OCI repository in a local docker archive tarball. I can inspect it happily with skopeo:

/opt/incus/bin/skopeo inspect docker-archive:blah.tar.gz
/opt/incus/bin/skopeo list-tags docker-archive:blah.tar.gz

However, incus (7.0 LTS) will only accept https repositories for --protocol=oci

My question is, is there a straightforward way I can get incus to launch a container from this? Or do I have to push this into a separate registry first (e.g. CNCF Distribution)?

2

Yes, a registry is the intended route. The Incus docs are explicit on both points: the incus remote add manpage states that remote URLs must be HTTPS, and the “How to use remote images” guide repeats that constraint specifically for --protocol=oci. I found no documented way to point Incus at a local docker-archive tarball or an OCI layout directory directly.

Two practical notes:

  • It does not have to be Docker Hub or another hosted service: any OCI-compliant registry works, including a small local one like the CNCF Distribution you mention. Since the remote URL must be HTTPS, the registry needs TLS too - a plain HTTP localhost registry does not satisfy the documented requirement. I have not tested whether current Incus versions make a localhost exception; the docs only say HTTPS.
  • skopeo can push straight out of your archive, no intermediate pull needed: skopeo copy docker-archive:blah.tar.gz docker://registry-host/your-image:tag. The skopeo-copy man page documents docker-archive as a transport and docker:// as a destination.

So: registry with TLS, skopeo copy into it, incus remote add with the https URL, launch. Not hands-on tested on my side - this is from the Incus docs/manpages and the skopeo man page.

3

Thanks. I’ve tested it, and did manage to make it work, but it’s very long-winded. As you say, you need to enable HTTPS on the registry, and therefore create a certificate:

incus launch oci-docker:registry:3 reg \
  -d eth0,ipv4.address=100.125.0.91 \
  -c environment.REGISTRY_HTTP_TLS_CERTIFICATE=/cert.pem \
  -c environment.REGISTRY_HTTP_TLS_KEY=/key.pem \
  -c boot.autorestart=true

# Self-signed cert
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650 -nodes -subj '/CN=localhost/' -addext subjectAltName=IP:100.125.0.91
incus file push cert.pem reg/cert.pem --mode=644
incus file push key.pem reg/key.pem --mode=644

But you also have to get skopeo to trust this cert (when running skopeo at the CLI you can use flags like --dest-tls-verify=false, but incus won’t do this). That needed some digging

mkdir -p /etc/containers/certs.d/100/125.0.91:5000
cp cert.pem /etc/containers/certs.d/100.125.0.91\:5000/cert.crt

You can then push the repo into the registry:

/opt/incus/bin/skopeo copy docker-archive:blah.tar.gz:foo/bar:baz docker://100.125.0.91:5000/foo/bar:baz --insecure-policy

and finally add a remote:

incus remote add oci-local https://100.125.0.91:5000 --protocol=oci
incus launch oci-local:foo/bar:baz qux