podman-artifact-push(1)

💅 podman-artifact-push(1) — General Commands Manual 🎀

okay so bestie, welcome to podman-artifact-push, straight out of the General Commands Manual — yes that's the manual name, we're fancy like that ✨. This is the page where your local OCI artifact finally gets to leave the house and go be famous on an image registry. Let's get into it 🦋

---

🌸 NAME 🌸

podman-artifact-push — push an OCI artifact from local storage to an image registry. literally packing its bags and sending it off 💅

---

✨ SYNOPSIS ✨

podman artifact push [options] image

---

🫶 DESCRIPTION 🫶

So what it does: it pushes an artifact from the local artifact store up to an image registry. that's the whole vibe. no cap. 🔥

Like, for example:

# Push artifact to a container registry
$ podman artifact push quay.io/artifact/foobar1:latest

iconic behavior honestly 👑

---

🎀 OPTIONS 🎀

• --authfile=path — the path to your authentication file. The default is ${XDG_RUNTIME_DIR}/containers/auth.json on Linux, and $HOME/.config/containers/auth.json on Windows/macOS. This file is created by podman login. If the authorization state is not found there, $HOME/.docker/config.json gets checked instead — that one's set using docker login. 🍓

Note bestie: you can also override that default path by setting the REGISTRY_AUTH_FILE environment variable, like export REGISTRY_AUTH_FILE=path. slay 💜

• --cert-dir=path — use the certificates at path (*.crt, *.cert, *.key) to connect to the registry. Default is /etc/containers/certs.d. For the details, peep containers-certs.d(5). 🧚

heads up: this option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines. 💀

• --creds=[username[:password]] — the [username[:password]] to use to authenticate with the registry, if it's required. If one or both values aren't supplied, a command line prompt pops up and you can enter the value there. The password is entered without echo — stealth mode fr fr 🙈

Note that the specified credentials are only used to authenticate against target registries. They are not used for mirrors or when the registry gets rewritten (see containers-registries.conf(5)). To authenticate against those, consider using a containers-auth.json(5) file instead. iykyk 🌈

• --digestfile=Digestfile — after copying the image, write the digest of the resulting image to the file. Receipts, basically 🧾
• --quiet, -q — suppress informational output messages (the ones telling you which instruction is being processed and the progress of the instruction). Print only the final error message or the successful completion info, such as the image or container ID. lowkey peaceful 😌
• --retry=attempts — how many times to retry pulling or pushing images between the registry and local storage if it fails. Default is 3. never give up, never surrender 💪
• --retry-delay=duration — the duration of delay between retry attempts when pulling or pushing images between the registry and local storage if it fails. The default is to start at two seconds and then exponentially back off. If you set this value, that delay is used and no exponential back off occurs. ⏳
• --sign-by=key — add a “simple signing” signature at the destination using the specified key. 🖊️

this one's also not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines.

• --sign-by-sigstore=param-file — add a sigstore signature based on further options specified in a container's sigstore signing parameter file param-file. See containers-sigstore-signing-params.yaml(5) for the deets on the file format. 📄
• --sign-by-sigstore-private-key=path — add a sigstore signature at the destination using a private key at the specified path. 🔑

again — not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines.

• --sign-by-sq-fingerprint=fingerprint — add a “simple signing” signature using a Sequoia-PGP key with the specified fingerprint. 🫆

and yep, not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines.

• --sign-passphrase-file=path — if you're signing the image (using --sign-by, sign-by-sq-fingerprint or --sign-by-sigstore-private-key), read the passphrase to use from the specified path. 🤫
• --tls-verify — require HTTPS and verify certificates when contacting registries (default: true). If explicitly set to true, TLS verification is used. If set to false, TLS verification is not used. If not specified, TLS verification is used unless the target registry is listed as an insecure registry in containers-registries.conf(5). stay safe out there bestie 🛡️

---

🔥 EXAMPLE 🔥

Push the specified image to a container registry:

$ podman artifact push quay.io/baude/artifact:single
Getting image source signatures
Copying blob 3ddc0a3cdb61 done   |
Copying config 44136fa355 done   |
Writing manifest to image destination

look at it go 😭👑

---

⭐ SEE ALSO ⭐

podman(1), podman-artifact(1), podman-pull(1), podman-login(1), containers-certs.d(5)

---

💖 HISTORY 💖

Jan 2025 — originally compiled by Brent Baude bbaude@redhat.com ⟨mailto:bbaude@redhat.com⟩ 🫶

---

and that's the whole page, bestie!! 💅✨🎀🦋🌸 this was podman-artifact-push(1) from the General Commands Manual, dated Jan 2025, and the footer is literally just podman-artifact-push(1) again because the man page said so. go push something iconic 🍓💜👑