# OCI Repositories

The Open Container Initiative (OCI) format provides an open, vendor-neutral standard for storing and distributing container images and related artifacts. Nexus Repository implements the [OCI Distribution Specification](https://github.com/opencontainers/distribution-spec). You can use Nexus Repository to proxy, host, and group container images, Helm charts, software bills of materials (SBOMs), signatures, and other OCI artifacts with OCI-compatible tools, including Docker, Podman, Helm, ORAS, Cosign, Syft, Crane, and Skopeo.

Compared to a basic container registry, Nexus Repository support for OCI includes the following capabilities:

- **Supply chain metadata support** – Store and manage signatures, software bills of materials (SBOMs), attestations, and other OCI artifacts that are associated with container images through the OCI 1.1 Referrers API.

- **Enterprise repository management** – Use proxy, hosted, and group repositories with centralized access control, auditing, and repository policies such as immutability.

- **Multi-architecture image support** – Publish multi-architecture image indexes so a single image tag can serve multiple platforms.

OCI is available in Sonatype Nexus Repository Pro and Community editions of self-hosted deployments and also in Nexus Repository Cloud. Nexus Repository Cloud supports path based routing and requires authentication for all client access. Self-hosted deployments support subdomain and port routing along with path-based routing.

See [OCI Distribution Specification](https://github.com/opencontainers/distribution-spec) and [OCI Image Specification](https://github.com/opencontainers/image-spec).

## Getting Started with OCI in Nexus  
Explore the following topics to learn how to configure and use OCI with Nexus Repository:

1. [Nexus for OCI](https://help.sonatype.com/en/oci-repositories.html#nexus-for-oci "Nexus for OCI")  
2. [Create an OCI Repository](https://help.sonatype.com/en/create-an-oci-repository.html "Create an OCI Repository")  
3. [Configure OCI with Nexus](https://help.sonatype.com/en/configure-oci-repository.html "Configure OCI Repository")  
4. [OCI CLI Usage](https://help.sonatype.com/en/oci-cli-usage.html "OCI CLI Usage")

## Nexus for OCI

- **Proxy Repository:** Caches images and artifacts from an external OCI registry, such as Docker Hub, GitHub Container Registry, or another Nexus Repository instance, so repeated pulls are served locally.

- **Hosted Repository:** Stores images and artifacts published by your developers and CI pipelines while preventing a published tag from being overwritten with different content.

- **Group Repository:** Exposes multiple proxy and hosted repositories through a single URL, so clients can use one endpoint for internal and upstream content.

- **Multi-Architecture Images:** Stores and serves image indexes also called manifest lists. A single tag can support multiple platforms, such as `linux/amd64` and `linux/arm64`.

- **OCI 1.1 Supply Chain Metadata:** Supports the Referrer API so signatures, SBOMs, and attestations attach directly to an image and are discoverable in the same repository.

- **Tag Immutability**: Enforce tag immutability on hosted repositories to prevent a published tag from being overwritten with different content.

- **Authentication:** Supports user tokens, username and password, and authenticated proxy upstreams. Anonymous access is supported on self-hosted deployments when enabled. Nexus Repository Cloud always requires authentication.