---
title: Accessing the OCI Registry
url: https://www.tines.com/stories/docs/self-hosted/getting-started/accessing-the-oci-registry/
updated: 2026-07-27T19:21:10+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Self-Hosted](https://www.tines.com/llm/stories/docs/self-hosted.md) › [Getting Started](https://www.tines.com/llm/stories/docs/self-hosted/getting-started.md)*

# Accessing the OCI Registry

*[View on tines.com](https://www.tines.com/stories/docs/self-hosted/getting-started/accessing-the-oci-registry/)*

# Accessing the OCI registry

> 💡 **Note**
> 
> Customers can access Tines images from our OCI registry at `oci.tines.com`. To request access, contact Tines Support. Once approved, Tines will provide registry credentials.

The Open Container Initiative (OCI) defines open standards for container images and their distribution. The Tines OCI registry stores OCI-compatible container images and supports standard tooling such as Docker, Podman, containerd, Kubernetes, and ORAS. It also supports version tags, digest-based references, multi-architecture images where available, and Cosign signature verification.

## Logging in

After receiving your username and password, log in to the Tines registry.

Registry usernames often contain a dollar sign (for example, `tines$example`). Always assign credentials with single quotes so the shell does not expand `$…` to an empty string:

```bash
OCI_USERNAME='tines$example'
OCI_PASSWORD='your-password'
```

Log in with Docker for image pulls, and with ORAS for listing tags and inspecting manifests:

```bash
echo "$OCI_PASSWORD" | docker login oci.tines.com \
  --username "$OCI_USERNAME" \
  --password-stdin

echo "$OCI_PASSWORD" | oras login oci.tines.com \
  --username "$OCI_USERNAME" \
  --password-stdin
```

If authentication fails, Harbor may have treated the request as anonymous. That usually means the username was shell-expanded (for example, double-quoting `tines$example` turns it into `tines`). Reassign credentials with single quotes and log in again.

## Available images

The following images are available:

- `tines/tines-app`
- `tines/tines-command-runner`
- `tines/tines-nginx`
- `tines/command-over-http`
- `tines/postgres`
- `tines/valkey`
- `tines-tunnel/tines-tunnel`

The images available to an account depend on its entitlements. Contact Tines Support if you cannot access an expected image.

Some image paths differ from Docker Hub and `registry.tines.com`:

```text
Legacy path                  OCI path
---------------------------  ---------------------------
tines/tines-tunnel                 tines-tunnel/tines-tunnel
redis                              tines/valkey
postgres                           tines/postgres
tines/nginx-unprivileged           tines/tines-nginx
tines/tines-app-with-fips          tines-fips/tines-app
tines/tines-command-runner-fips    tines-fips/tines-command-runner
```

### Listing tags for an image

Set the repository you want to access:

```bash
REPOSITORY="tines/tines-app"
```

List its tags:

```bash
oras repo tags "oci.tines.com/${REPOSITORY}"
```

### Looking up an image by digest

Set the tag you want to inspect:

```bash
TAG="vX.Y.Z"
```

Resolve its digest:

```bash
DIGEST=$(oras resolve "oci.tines.com/${REPOSITORY}:${TAG}")
echo "$DIGEST"
```

Fetch the manifest using that digest:

```bash
oras manifest fetch --pretty "oci.tines.com/${REPOSITORY}@${DIGEST}"
```

You can also fetch the manifest by tag directly:

```bash
oras manifest fetch --pretty "oci.tines.com/${REPOSITORY}:${TAG}"
```

## Pulling images

Pull Tines images using:

```bash
docker pull oci.tines.com/tines/tines-app:vX.Y.Z
docker pull oci.tines.com/tines/tines-command-runner:vX.Y.Z
docker pull oci.tines.com/tines/tines-nginx:<nginx-version>
docker pull oci.tines.com/tines/command-over-http:vX.Y.Z
docker pull oci.tines.com/tines/postgres:<postgres-version>
docker pull oci.tines.com/tines/valkey:<valkey-version>
```

The app and command runner images also support major and minor version tags, such as `vX` and `vX.Y`, in addition to full `vX.Y.Z` versions.

## ARM support

ARM-compatible images are available starting from Tines version 37.2.0. Most core images (`tines-app`, `tines-command-runner`, `tines-nginx`, `postgres`, and `valkey`) publish multi-arch manifests. `command-over-http` is currently amd64 only; on ARM hosts, pull it with `--platform linux/amd64`.

## Verifying images

Tines images can be verified using Cosign:

```bash
cosign verify \
  --key ./cosign.pub \
  oci.tines.com/tines/tines-app:vX.Y.Z
```

Use the following public key:

```text
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUnTLRvsoHNEC04P2aBriS8p+0dAb
LgXrtHxEyC4R+rh44PB0unsYAEdNeLvPDnnn7GigylmaFwOPeQzLJigV6Q==
-----END PUBLIC KEY-----
```