Skopeo
skopeo is a command-line utility for working with container image registries without requiring a Docker daemon or root privileges. Developed under the containers organisation (Red Hat / OCI ecosystem) alongside Podman, Buildah, and CRI-O, it supports Docker V2 and OCI image formats across any standards-compliant registry. The project has approximately 10,900 GitHub stars, holds an OpenSSF Best Practices badge, and was last updated in May 2026.
Core operations: inspect (examine a remote image's manifest and config without pulling), copy (transfer images directly between any two registries or local formats without a daemon intermediary), sync (mirror an external registry to an internal one from a declarative YAML config), and delete (remove an image from a registry). Image signing via Sigstore-compatible workflows is also supported.
Placed in Tools / Assess / inner.
skopeo's primary value over docker pull/docker push is twofold. First, daemon-free operation: it works in CI environments where the Docker socket is unavailable or undesirable. Second, registry-to-registry copy without a local pull: skopeo copy docker://source/image docker://dest/image transfers directly between registries, avoiding the bandwidth and storage cost of pulling to the host first.
The skopeo sync command is the standout capability for self-hosted infrastructure: it mirrors a remote registry or repository to an internal one using a YAML manifest, making it the standard tool for air-gapped Kubernetes or container deployments where external registry access is unavailable at runtime.
Inner position reflects ~11k stars, active maintenance as part of the established OCI containers ecosystem, and direct applicability to any CI pipeline or self-hosted registry workflow — particularly air-gapped deployments. Complements SlimToolkit (image minification) and dockcheck (update detection) already on this radar.
Trial gate: skopeo used to either inspect a remote image without pulling in a real CI pipeline, or sync at least one repository to a private registry for an air-gapped or mirrored deployment.
