šŸŽ New User? Get 20% off your first purchase with code NEWUSER20 Register Now →
Menu

Categories

skopeo Command

Intermediate Containers man(1)

Inspect and copy container images without a daemon

šŸ‘ 1 views šŸ“… Updated: Mar 16, 2026
SYNTAX
skopeo [COMMAND] [FLAGS] SOURCE DESTINATION

What Does skopeo Do?

The skopeo command inspects, copies, and manages container images across registries without requiring a running container daemon or pulling the images locally. Part of the Podman ecosystem developed by Red Hat, Skopeo operates directly on container registries, making it ideal for CI/CD pipelines, registry management, and image mirroring.

Unlike docker pull (which downloads the entire image), skopeo inspect can retrieve image metadata (layers, labels, architecture, digests) from a remote registry with a single API call. skopeo copy can transfer images between registries, convert between formats (OCI, Docker v2s2), and even copy to/from local directory structures — all without a daemon.

Skopeo supports all major registry types: Docker Hub, GitHub Container Registry (GHCR), Amazon ECR, Google Container Registry (GCR), Azure Container Registry (ACR), Quay.io, Harbor, and private registries. It uses the same credentials as Docker/Podman from ~/.docker/config.json or containers-auth.json.

Options & Flags

OptionDescriptionExample
inspect Inspect image metadata without pulling skopeo inspect docker://docker.io/library/nginx:alpine
copy Copy image between registries/formats skopeo copy docker://registry.example.com/app:v1 docker://ghcr.io/org/app:v1
list-tags List all tags for a repository skopeo list-tags docker://docker.io/library/nginx
delete Delete an image from a registry skopeo delete docker://registry.example.com/old-image:v1
sync Sync images between registries skopeo sync --src docker --dest docker registry.example.com/app ghcr.io/org
login Login to a container registry skopeo login docker.io -u username
--raw Output raw manifest (with inspect) skopeo inspect --raw docker://nginx:alpine
--override-arch Inspect specific architecture skopeo inspect --override-arch arm64 docker://nginx:alpine

Practical Examples

#1 Inspect image without pulling

Get image metadata: layers, digest, labels, architecture, OS, and creation date — all without downloading the image.
$ skopeo inspect docker://docker.io/library/nginx:alpine

#2 Copy between registries

Copy an image directly between registries without pulling to local storage. Fast, efficient server-side transfer.
$ skopeo copy docker://docker.io/library/nginx:alpine docker://ghcr.io/myorg/nginx:alpine

#3 List all tags

List all available tags for a repository. Useful for finding version numbers and variants.
$ skopeo list-tags docker://docker.io/library/postgres | jq .Tags[]

#4 Mirror images for air-gapped environment

Save image to a directory structure. Transfer the directory to air-gapped systems and load with skopeo copy dir: docker:// format.
$ skopeo copy docker://docker.io/library/nginx:alpine dir:/tmp/nginx-image/

#5 Check multi-arch support

View the manifest list to see which architectures (amd64, arm64, etc.) the image supports.
$ skopeo inspect --raw docker://nginx:alpine | jq .manifests[].platform

#6 Sync repository between registries

Sync all tags of nginx from Docker Hub to GitHub Container Registry. --scoped preserves repo structure.
$ skopeo sync --src docker --dest docker docker.io/library/nginx ghcr.io/myorg/ --scoped

Tips & Best Practices

No daemon required: Skopeo works without Docker or Podman daemons. Perfect for CI/CD pipelines and restricted environments where running a container daemon is not possible.
Transport prefixes: docker:// = registry, dir: = local directory, oci: = OCI layout, docker-archive: = docker save tarball, containers-storage: = local Podman/CRI-O storage.
Use with CI/CD: Skopeo is ideal for CI/CD image promotion: build → push to staging registry → test → skopeo copy to production registry. No need to pull/push through the CI runner.
Install skopeo: Install: apt install skopeo (Debian/Ubuntu 22.04+), dnf install skopeo (Fedora/RHEL). Available on all major distributions.

Frequently Asked Questions

How do I inspect a container image without pulling it?
skopeo inspect docker://IMAGE:TAG — shows labels, layers, architecture, digest, and more with a single API call, no download required.
How do I copy images between container registries?
skopeo copy docker://SOURCE docker://DEST — copies directly between registries. Requires authentication to both registries (skopeo login).
What is the difference between skopeo and docker pull?
docker pull downloads the full image locally. skopeo inspect reads only metadata (no download). skopeo copy transfers between registries without local storage. Skopeo needs no daemon.
Can skopeo work with private registries?
Yes. Login with: skopeo login registry.example.com. It reads credentials from containers-auth.json or Docker config.json (~/.docker/config.json).

Master Linux with Professional eBooks

Curated IT eBooks covering Linux, DevOps, Cloud, and more

Browse Books →