skopeo Command
Intermediate Containers man(1)Inspect and copy container images without a daemon
š 1 views
š
Updated: Mar 16, 2026
SYNTAX
skopeo [COMMAND] [FLAGS] SOURCE DESTINATION
What Does skopeo Do?
The skopeo command inspects, copies, and manages container images across registries without requiring a running container daemon or pulling the images locally. Part of the Podman ecosystem developed by Red Hat, Skopeo operates directly on container registries, making it ideal for CI/CD pipelines, registry management, and image mirroring.
Unlike docker pull (which downloads the entire image), skopeo inspect can retrieve image metadata (layers, labels, architecture, digests) from a remote registry with a single API call. skopeo copy can transfer images between registries, convert between formats (OCI, Docker v2s2), and even copy to/from local directory structures ā all without a daemon.
Skopeo supports all major registry types: Docker Hub, GitHub Container Registry (GHCR), Amazon ECR, Google Container Registry (GCR), Azure Container Registry (ACR), Quay.io, Harbor, and private registries. It uses the same credentials as Docker/Podman from ~/.docker/config.json or containers-auth.json.
Unlike docker pull (which downloads the entire image), skopeo inspect can retrieve image metadata (layers, labels, architecture, digests) from a remote registry with a single API call. skopeo copy can transfer images between registries, convert between formats (OCI, Docker v2s2), and even copy to/from local directory structures ā all without a daemon.
Skopeo supports all major registry types: Docker Hub, GitHub Container Registry (GHCR), Amazon ECR, Google Container Registry (GCR), Azure Container Registry (ACR), Quay.io, Harbor, and private registries. It uses the same credentials as Docker/Podman from ~/.docker/config.json or containers-auth.json.
Options & Flags
| Option | Description | Example |
|---|---|---|
| inspect | Inspect image metadata without pulling | skopeo inspect docker://docker.io/library/nginx:alpine |
| copy | Copy image between registries/formats | skopeo copy docker://registry.example.com/app:v1 docker://ghcr.io/org/app:v1 |
| list-tags | List all tags for a repository | skopeo list-tags docker://docker.io/library/nginx |
| delete | Delete an image from a registry | skopeo delete docker://registry.example.com/old-image:v1 |
| sync | Sync images between registries | skopeo sync --src docker --dest docker registry.example.com/app ghcr.io/org |
| login | Login to a container registry | skopeo login docker.io -u username |
| --raw | Output raw manifest (with inspect) | skopeo inspect --raw docker://nginx:alpine |
| --override-arch | Inspect specific architecture | skopeo inspect --override-arch arm64 docker://nginx:alpine |
Practical Examples
#1 Inspect image without pulling
Get image metadata: layers, digest, labels, architecture, OS, and creation date ā all without downloading the image.
$ skopeo inspect docker://docker.io/library/nginx:alpine#2 Copy between registries
Copy an image directly between registries without pulling to local storage. Fast, efficient server-side transfer.
$ skopeo copy docker://docker.io/library/nginx:alpine docker://ghcr.io/myorg/nginx:alpine#3 List all tags
List all available tags for a repository. Useful for finding version numbers and variants.
$ skopeo list-tags docker://docker.io/library/postgres | jq .Tags[]#4 Mirror images for air-gapped environment
Save image to a directory structure. Transfer the directory to air-gapped systems and load with skopeo copy dir: docker:// format.
$ skopeo copy docker://docker.io/library/nginx:alpine dir:/tmp/nginx-image/#5 Check multi-arch support
View the manifest list to see which architectures (amd64, arm64, etc.) the image supports.
$ skopeo inspect --raw docker://nginx:alpine | jq .manifests[].platform#6 Sync repository between registries
Sync all tags of nginx from Docker Hub to GitHub Container Registry. --scoped preserves repo structure.
$ skopeo sync --src docker --dest docker docker.io/library/nginx ghcr.io/myorg/ --scopedTips & Best Practices
No daemon required: Skopeo works without Docker or Podman daemons. Perfect for CI/CD pipelines and restricted environments where running a container daemon is not possible.
Transport prefixes: docker:// = registry, dir: = local directory, oci: = OCI layout, docker-archive: = docker save tarball, containers-storage: = local Podman/CRI-O storage.
Use with CI/CD: Skopeo is ideal for CI/CD image promotion: build ā push to staging registry ā test ā skopeo copy to production registry. No need to pull/push through the CI runner.
Install skopeo: Install: apt install skopeo (Debian/Ubuntu 22.04+), dnf install skopeo (Fedora/RHEL). Available on all major distributions.
Frequently Asked Questions
How do I inspect a container image without pulling it?
skopeo inspect docker://IMAGE:TAG ā shows labels, layers, architecture, digest, and more with a single API call, no download required.
How do I copy images between container registries?
skopeo copy docker://SOURCE docker://DEST ā copies directly between registries. Requires authentication to both registries (skopeo login).
What is the difference between skopeo and docker pull?
docker pull downloads the full image locally. skopeo inspect reads only metadata (no download). skopeo copy transfers between registries without local storage. Skopeo needs no daemon.
Can skopeo work with private registries?
Yes. Login with: skopeo login registry.example.com. It reads credentials from containers-auth.json or Docker config.json (~/.docker/config.json).
Related Commands
More Containers Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books ā