crane
FIPS 140-3Developer toolsCrane is a tool for interacting with remote images and registries. It allows to efficiently inspect, verify and manipulate containers, manifests and image layers as well as checking cryptographic signatures.
Crane is a tool for interacting with remote images and registries. It allows to efficiently inspect, verify and manipulate containers, manifests and image layers as well as checking cryptographic signatures.
Pull the latest version of this image from the Ghost registry. Pulling requires authentication — generate a token and run docker login first (see Authentication below).
The Ghost catalog is public to browse, but pulling images requires an account. Generate a pull token below (or from your Account → Tokens page) — you'll get a ready-to-paste docker login command, then docker pull works.
The username is generated automatically (it looks like robot$<project>+<auto-id>, not the name you typed) and is included in the docker login command above. The secret is shown only once when you create the token.
All Ghost images are signed with cosign. Verifying the signature before deployment ensures the image has not been tampered with.
Install cosign via brew install cosign or download from the Sigstore releases page.
Reference this image in your Dockerfile as a base layer:
This is a vendor-built FIPS-enabled image: its cryptography runs on FIPS 140-3 validated modules configured by the upstream vendor. You can inspect the image metadata:
| Standard | FIPS 140-3 |
| Crypto module | Vendor-configured validated modules |
| Cryptography | Validated modules only |
| Use case | Government, regulated industries, compliance workloads |
This guide provides practical examples for using the Crane Ghost hardened image to manage OCI artifacts in registries.
All examples in this guide use the public image. If you’ve mirrored the repository for your own use (for example, to your Docker Hub namespace), update your commands to reference the mirrored image instead of the public one.
For example:
registry.ghost-prod.alphabravo.io/ghost-base/<repository>:<tag><your-namespace>/dhi-<repository>:<tag>For the examples, you must first use docker login registry.ghost-prod.alphabravo.io to authenticate to the registry to pull the images.
# Check Crane version
docker run --rm registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> version
# Get help for Crane commands
docker run --rm registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> --help
For operations requiring authentication, mount your Docker configuration:
# Using Docker credentials
docker run --rm -v ~/.docker:/home/nonroot/.docker:ro \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> version
# Using specific credential file
docker run --rm \
-v /path/to/config.json:/home/nonroot/.docker/config.json:ro \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> version
# Obtain a container image manifest
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> manifest \
registry.example.com/myrepo/hello:latest
# Obtain a container image config file
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> config \
registry.example.com/myrepo/hello:latest
# Obtains a container image digest
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> digest \
registry.example.com/myrepo/hello:latest
# Copies efficiently a container image from one registry to another
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> copy \
registry.example.com/myrepo/foo:latest registry.example.com/myrepo/bar:latest
# Stores a container image as a tar blob
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
-v "$(pwd)":/workspace \
-w /workspace \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> pull \
registry.example.com/myrepo/hello:latest hello.tar
# Push the file to a registry
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
-v "$(pwd)":/workspace:ro \
-w /workspace \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> push \
/workspace/hello.tar registry.example.com/myrepo/hello:latest
# Flattens a container image into another tag
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
-v "$(pwd)":/workspace:ro \
-w /workspace \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> flatten \
registry.example.com/myrepo/hello:latest -t registry.example.com/myrepo/hello:flattened
# Lists the repos in a registry
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> catalog \
registry.example.com
# List all tags in a repository
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> ls \
registry.example.com/myrepo/artifact
# Validates that a container image is well-formed
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> validate \
--remote registry.example.com/myrepo/app:latest
name: Copies Image
on: [push]
jobs:
push-artifact:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Login to registry
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Push artifact
run: |
docker run --rm \
-v ~/.docker:/home/nonroot/.docker:ro \
-v "${{ github.workspace }}":/workspace:ro \
-w /workspace \
registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag> copy \
ghcr.io/${{ github.repository }}-stage:${{ github.sha }} \
ghcr.io/${{ github.repository }}-prod:${{ github.sha }}
push-artifact:
image: registry.ghost-prod.alphabravo.io/ghost-base/crane:<tag>
before_script:
- echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER \
--password-stdin $CI_REGISTRY
script:
- crane push $CI_REGISTRY_IMAGE-stage:$CI_COMMIT_SHA
$CI_REGISTRY_IMAGE-prod:$CI_COMMIT_SHA
latest for production workflows.