Accessing the OCI Registry

Last updated July 27, 2026Open markdown version

Accessing the OCI registry

💡 Note
Customers can access Tines images from our OCI registry at oci.tines.com. To request access, contact Tines Support. Once approved, Tines will provide registry credentials.

The Open Container Initiative (OCI) defines open standards for container images and their distribution. The Tines OCI registry stores OCI-compatible container images and supports standard tooling such as Docker, Podman, containerd, Kubernetes, and ORAS. It also supports version tags, digest-based references, multi-architecture images where available, and Cosign signature verification.

Logging in

After receiving your username and password, log in to the Tines registry.

Registry usernames often contain a dollar sign (for example, tines$example). Always assign credentials with single quotes so the shell does not expand $… to an empty string:

OCI_USERNAME='tines$example'
OCI_PASSWORD='your-password'

echo "$OCI_PASSWORD" | docker login oci.tines.com \
  --username "$OCI_USERNAME" \
  --password-stdin

echo "$OCI_PASSWORD" | oras login oci.tines.com \
  --username "$OCI_USERNAME" \
  --password-stdin

If authentication fails, Harbor may have treated the request as anonymous. That usually means the username was shell-expanded (for example, double-quoting tines$example turns it into tines). Reassign credentials with single quotes and log in again.

Available images

The following images are available:

tines/tines-app
tines/tines-command-runner
tines/tines-nginx
tines/command-over-http
tines/postgres
tines/valkey
tines-tunnel/tines-tunnel

The images available to an account depend on its entitlements. Contact Tines Support if you cannot access an expected image.

Some image paths differ from Docker Hub and registry.tines.com:

Legacy path                  OCI path
---------------------------  ---------------------------
tines/tines-tunnel                 tines-tunnel/tines-tunnel
redis                              tines/valkey
postgres                           tines/postgres
tines/nginx-unprivileged           tines/tines-nginx
tines/tines-app-with-fips          tines-fips/tines-app
tines/tines-command-runner-fips    tines-fips/tines-command-runner

Listing tags for an image

Set the repository you want to access:

REPOSITORY="tines/tines-app"

List its tags:

oras repo tags "oci.tines.com/${REPOSITORY}"

Looking up an image by digest

Set the tag you want to inspect:

TAG="vX.Y.Z"

Resolve its digest:

DIGEST=$(oras resolve "oci.tines.com/${REPOSITORY}:${TAG}")
echo "$DIGEST"

Fetch the manifest using that digest:

oras manifest fetch --pretty "oci.tines.com/${REPOSITORY}@${DIGEST}"

You can also fetch the manifest by tag directly:

oras manifest fetch --pretty "oci.tines.com/${REPOSITORY}:${TAG}"

Pulling images

Pull Tines images using:

docker pull oci.tines.com/tines/tines-app:vX.Y.Z
docker pull oci.tines.com/tines/tines-command-runner:vX.Y.Z
docker pull oci.tines.com/tines/tines-nginx:<nginx-version>
docker pull oci.tines.com/tines/command-over-http:vX.Y.Z
docker pull oci.tines.com/tines/postgres:<postgres-version>
docker pull oci.tines.com/tines/valkey:<valkey-version>

The app and command runner images also support major and minor version tags, such as vX and vX.Y, in addition to full vX.Y.Z versions.

ARM support

ARM-compatible images are available starting from Tines version 37.2.0. Most core images (tines-app, tines-command-runner, tines-nginx, postgres, and valkey) publish multi-arch manifests. command-over-http is currently amd64 only; on ARM hosts, pull it with --platform linux/amd64.

Verifying images

Tines images can be verified using Cosign:

cosign verify \
  --key ./cosign.pub \
  oci.tines.com/tines/tines-app:vX.Y.Z

Use the following public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUnTLRvsoHNEC04P2aBriS8p+0dAb
LgXrtHxEyC4R+rh44PB0unsYAEdNeLvPDnnn7GigylmaFwOPeQzLJigV6Q==
-----END PUBLIC KEY-----