OCI Repositories

The Open Container Initiative (OCI) format provides an open, vendor-neutral standard for storing and distributing container images and related artifacts. Nexus Repository implements the OCI Distribution Specification. You can use Nexus Repository to proxy, host, and group container images, Helm charts, software bills of materials (SBOMs), signatures, and other OCI artifacts with OCI-compatible tools, including Docker, Podman, Helm, ORAS, Cosign, Syft, Crane, and Skopeo.

Compared to a basic container registry, Nexus Repository support for OCI includes the following capabilities:

• Supply chain metadata support – Store and manage signatures, software bills of materials (SBOMs), attestations, and other OCI artifacts that are associated with container images through the OCI 1.1 Referrers API.

• Enterprise repository management – Use proxy, hosted, and group repositories with centralized access control, auditing, and repository policies such as immutability.

• Multi-architecture image support – Publish multi-architecture image indexes so a single image tag can serve multiple platforms.

OCI is available in Sonatype Nexus Repository Pro and Community editions of self-hosted deployments and also in Nexus Repository Cloud. Nexus Repository Cloud supports path based routing and requires authentication for all client access. Self-hosted deployments support subdomain and port routing along with path-based routing.

See OCI Distribution Specification and OCI Image Specification.

Getting Started with OCI in Nexus

Explore the following topics to learn how to configure and use OCI with Nexus Repository:

1. Nexus for OCI
2. Create an OCI Repository
3. Configure OCI with Nexus
4. OCI CLI Usage

Nexus for OCI

• Proxy Repository: Caches images and artifacts from an external OCI registry, such as Docker Hub, GitHub Container Registry, or another Nexus Repository instance, so repeated pulls are served locally.

• Hosted Repository: Stores images and artifacts published by your developers and CI pipelines while preventing a published tag from being overwritten with different content.

• Group Repository: Exposes multiple proxy and hosted repositories through a single URL, so clients can use one endpoint for internal and upstream content.

• Multi-Architecture Images: Stores and serves image indexes also called manifest lists. A single tag can support multiple platforms, such as linux/amd64 and linux/arm64.

• OCI 1.1 Supply Chain Metadata: Supports the Referrer API so signatures, SBOMs, and attestations attach directly to an image and are discoverable in the same repository.

• Tag Immutability: Enforce tag immutability on hosted repositories to prevent a published tag from being overwritten with different content.

• Authentication: Supports user tokens, username and password, and authenticated proxy upstreams. Anonymous access is supported on self-hosted deployments when enabled. Nexus Repository Cloud always requires authentication.