skopeo tips — authorized image-transport literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run skopeo on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any pull/push/run — never poke production engines without change control.
3. Record short factual notes; quote short Evidence (image name, digest, id — never registry tokens or secret mounts).
4. Optional: runtime peer → podman-tips.
5. Optional: build peer → buildah-tips.
6. Prefer disposable lab images/registries for skopeo drills; quote non-secret labels afterward as Evidence.
7. Prefer read-only inspect/list modes for most Evidence binders unless the syllabus asks for write drills.
8. Stop at literacy — no attack or unauthorized container-escape cookbooks.

Allowed framing

• Classroom labs reviewing skopeo on authorized disposable engines (skopeo inspect / copy / list-tags).
• Binding short factual notes as Evidence (image/id/network — no secrets).
• Documenting expected vs observed image-transport literacy for authorized inventory notes.
• Comparing skopeo ↔ peer tip pages under one binder.
• Testing write/push/run only when the syllabus authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via skopeo.
• No intentional unauthorized container escapes or privileged mounts against foreign hosts.
• No secret-theft or credential harvesting via secret mounts / registry tokens on hosts you do not own.
• No cookbooks that weaken registry auth or smuggle layers against foreign registries without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with a usable skopeo toolchain.
2. Prefer a throwaway lab image/registry before any write drill.
3. With authorization, run a syllabus-approved skopeo list/inspect; quote non-secret labels as Evidence (skopeo inspect docker://… only against registries the syllabus authorizes).
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized escape cookbooks.

Practical notes for authorized labs

• skopeo moves/inspects image transports without a full runtime — keep Evidence labels distinct from podman-tips containers and buildah-tips builds.
• Pair with journalctl-logs-tips when lab CI units own the copy jobs.
• Registry logins and secret mounts may embed credentials — never paste them into notes or git.
• Prefer documenting image/name/network labels the syllabus authorized without dumping full secret inspect JSON.
• Never commit skopeo dumps with secrets to git — even for labs.
• Label lab-only artifacts clearly so they are not mistaken for production posture.
• Prefer transport URIs the syllabus named (lab registry / local dir / oci) — never assume public foreign registries are fair game.

FAQ-aligned refusals (quick)

• Foreign-host container inspect / escape → refuse.
• Unauthorized registry auth-weaken / layer-smuggle cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources