stackabletech · NickLarsenNZ · Apr 17, 2026 · Apr 16, 2026 · Apr 16, 2026 · Apr 16, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -15,7 +15,9 @@ clap_complete_nushell = "4.5.8"
 git2 = "0.20.1"
 glob = "0.3.2"
 oci-spec = "0.9.0"
+reqwest = { version = "0.13.2", features = ["json"] }
 rstest = "0.26.1"
+secrecy = "0.10.3"
 regex = "1.12.3"
 serde = { version = "1.0.217", features = ["derive"] }
 serde_json = "1.0.140"

diff --git a/airflow/boil-config.toml b/airflow/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 # Deprecated since SDP 25.11
 [versions."2.9.3".local-images]
 "shared/statsd-exporter" = "0.28.0"

diff --git a/boil.toml b/boil.toml
@@ -11,5 +11,3 @@ authors = "Stackable GmbH <info@stackable.tech>"
 vendor-tag-prefix = "stackable"
 vendor = "Stackable GmbH"
 licenses = "Apache-2.0"
-
-[docker-config]
diff --git a/druid/boil-config.toml b/druid/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 # LTS since 24.11
 [versions."30.0.1".local-images]
 # https://druid.apache.org/docs/30.0.1/operations/java/

diff --git a/hadoop/boil-config.toml b/hadoop/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 # Not part of SDP 25.7.0, but still required for hbase, hive, spark-k8s
 [versions."3.3.6".local-images]
 "hadoop/hadoop" = "3.3.6"

diff --git a/hbase/boil-config.toml b/hbase/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."2.6.3".local-images]
 "hbase/hbase" = "2.6.3"
 "hbase/hbase-operator-tools" = "1.3.0-hbase2.6.3"

diff --git a/hive/boil-config.toml b/hive/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."3.1.3".local-images]
 # Hive 3 must be built with Java 8 but will run on Java 11
 java-base = "11"

diff --git a/java-devel/boil-config.toml b/java-devel/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."8".local-images]
 stackable-devel = "1.0.0"
 

diff --git a/jdk-base/boil-config.toml b/jdk-base/boil-config.toml
@@ -1,6 +1,5 @@
 [versions."21".local-images]
 vector = "0.52.0"
 
-
 [versions."24".local-images]
 vector = "0.52.0"
diff --git a/kafka-testing-tools/boil-config.toml b/kafka-testing-tools/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."1.0.0".local-images]
 stackable-base = "1.0.0"
 "kafka/kcat" = "1.7.0"

diff --git a/kafka/boil-config.toml b/kafka/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."3.9.1".local-images]
 java-base = "21"
 java-devel = "21"

diff --git a/krb5/boil-config.toml b/krb5/boil-config.toml
@@ -1 +1,4 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."1.21.1"]
diff --git a/nifi/boil-config.toml b/nifi/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."1.28.1".local-images]
 java-base = "11"
 java-devel = "11"

diff --git a/omid/boil-config.toml b/omid/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."1.1.2".local-images]
 java-base = "11"
 java-devel = "11"

diff --git a/opa/boil-config.toml b/opa/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 # Version 1.8.0
 [versions."1.8.0".local-images]
 stackable-devel = "1.0.0"

diff --git a/opensearch-dashboards/boil-config.toml b/opensearch-dashboards/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."3.1.0".local-images]
 stackable-devel = "1.0.0"
 vector = "0.52.0"
@@ -25,22 +28,22 @@ cdxgen-version = "12.0.0"
 
 [versions."3.4.0".local-images]
 stackable-devel = "1.0.0"
-"opensearch-dashboards/alerting-dashboards-plugin"= "3.4.0.0"
-"opensearch-dashboards/anomaly-detection-dashboards-plugin"= "3.4.0.0"
-"opensearch-dashboards/dashboards-assistant"= "3.4.0.0"
-"opensearch-dashboards/dashboards-flow-framework"= "3.4.0.0"
-"opensearch-dashboards/dashboards-maps"= "3.4.0.0"
-"opensearch-dashboards/dashboards-notifications"= "3.4.0.0"
-"opensearch-dashboards/dashboards-observability"= "3.4.0.0"
-"opensearch-dashboards/dashboards-query-workbench"= "3.4.0.0"
-"opensearch-dashboards/dashboards-reporting"= "3.4.0.0"
-"opensearch-dashboards/dashboards-search-relevance"= "3.4.0.0"
-"opensearch-dashboards/index-management-dashboards-plugin"= "3.4.0.0"
-"opensearch-dashboards/ml-commons-dashboards"= "3.4.0.0"
-"opensearch-dashboards/query-insights-dashboards"= "3.4.0.0"
-"opensearch-dashboards/security-analytics-dashboards-plugin"= "3.4.0.0"
-"opensearch-dashboards/security-dashboards-plugin"= "3.4.0.0"
-"opensearch-dashboards/opensearch-build"= "3.4.0"
+"opensearch-dashboards/alerting-dashboards-plugin" = "3.4.0.0"
+"opensearch-dashboards/anomaly-detection-dashboards-plugin" = "3.4.0.0"
+"opensearch-dashboards/dashboards-assistant" = "3.4.0.0"
+"opensearch-dashboards/dashboards-flow-framework" = "3.4.0.0"
+"opensearch-dashboards/dashboards-maps" = "3.4.0.0"
+"opensearch-dashboards/dashboards-notifications" = "3.4.0.0"
+"opensearch-dashboards/dashboards-observability" = "3.4.0.0"
+"opensearch-dashboards/dashboards-query-workbench" = "3.4.0.0"
+"opensearch-dashboards/dashboards-reporting" = "3.4.0.0"
+"opensearch-dashboards/dashboards-search-relevance" = "3.4.0.0"
+"opensearch-dashboards/index-management-dashboards-plugin" = "3.4.0.0"
+"opensearch-dashboards/ml-commons-dashboards" = "3.4.0.0"
+"opensearch-dashboards/query-insights-dashboards" = "3.4.0.0"
+"opensearch-dashboards/security-analytics-dashboards-plugin" = "3.4.0.0"
+"opensearch-dashboards/security-dashboards-plugin" = "3.4.0.0"
+"opensearch-dashboards/opensearch-build" = "3.4.0"
 "vector" = "0.52.0"
 
 [versions."3.4.0".build-arguments]

diff --git a/opensearch/boil-config.toml b/opensearch/boil-config.toml
@@ -1,3 +1,6 @@
+[metadata.registries]
+"oci.stackable.tech" = { namespace = "sdp" }
+
 [versions."3.1.0".local-images]
 java-devel = "21"
 jdk-base = "21"

diff --git a/rust/boil/Cargo.toml b/rust/boil/Cargo.toml
@@ -15,7 +15,9 @@ clap_complete_nushell.workspace = true
 git2.workspace = true
 glob.workspace = true
 oci-spec.workspace = true
+reqwest.workspace = true
 regex.workspace = true
+secrecy.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 snafu.workspace = true

diff --git a/rust/boil/src/cli/build.rs b/rust/boil/src/cli/build.rs
@@ -2,19 +2,20 @@ use std::{
     fmt::{Debug, Display},
     path::PathBuf,
     str::FromStr,
-    sync::LazyLock,
 };
 
 use clap::{Args, ValueHint, value_parser};
-use regex::Regex;
 use snafu::{ResultExt, Snafu, ensure};
 use strum::EnumDiscriminants;
 use url::Host;
 
-use crate::core::{
-    docker::BuildArgument,
-    image::ImageSelector,
-    platform::{Architecture, TargetPlatform},
+use crate::{
+    cli::Cli,
+    core::{
+        docker::BuildArgument,
+        image::ImageSelector,
+        platform::{Architecture, TargetPlatform},
+    },
 };
 
 #[derive(Debug, Args)]
@@ -27,8 +28,8 @@ pub struct BuildArguments {
     /// The image version being built.
     #[arg(
         short, long,
-        value_parser = BuildArguments::parse_image_version,
-        default_value_t = Self::default_image_version(),
+        value_parser = Cli::parse_image_version,
+        default_value_t = Cli::default_image_version(),
         help_heading = "Image Options"
     )]
     pub image_version: String,
@@ -46,7 +47,7 @@ pub struct BuildArguments {
     /// The format is host[:port].
     #[arg(
         short, long,
-        default_value_t = Self::default_registry(),
+        default_value_t = Cli::default_registry(),
         value_hint = ValueHint::Hostname,
         help_heading = "Registry Options"
     )]
@@ -130,33 +131,7 @@ pub struct BuildArguments {
     pub rest: Vec<String>,
 }
 
-// This is derived from the general rule where the length of the tag can be up to 128 chars
-// See: https://github.com/opencontainers/distribution-spec/blob/main/spec.md
-// But that checking needs to be at a higher layer.
-static VALID_IMAGE_TAG: LazyLock<Regex> =
-    LazyLock::new(|| Regex::new(r"^[a-zA-Z0-9_][a-zA-Z0-9_.-]+$").expect("regex is valid"));
-
 impl BuildArguments {
-    /// Ensure that the given version will be valid for use in the image tag
-    fn parse_image_version(version: &str) -> Result<String, ParseImageVersionError> {
-        if !VALID_IMAGE_TAG.is_match(version) {
-            return ParseVersionSnafu { version }.fail();
-        }
-
-        Ok(version.to_owned())
-    }
-
-    fn default_image_version() -> String {
-        "0.0.0-dev".to_owned()
-    }
-
-    fn default_registry() -> HostPort {
-        HostPort {
-            host: Host::Domain(String::from("oci.stackable.tech")),
-            port: None,
-        }
-    }
-
     // TODO: Auto-detect this
     fn default_architecture() -> TargetPlatform {
         TargetPlatform::Linux(Architecture::Amd64)
@@ -167,12 +142,6 @@ impl BuildArguments {
     }
 }
 
-#[derive(Debug, Snafu)]
-pub enum ParseImageVersionError {
-    #[snafu(display("invalid image tag characters for {version:?}"))]
-    ParseVersion { version: String },
-}
-
 #[derive(Debug, PartialEq, Snafu, EnumDiscriminants)]
 pub enum ParseHostPortError {
     #[snafu(display("unexpected empty input"))]

diff --git a/rust/boil/src/cli/image.rs b/rust/boil/src/cli/image.rs
@@ -1,6 +1,6 @@
 use clap::{Args, Subcommand, ValueEnum};
 
-use crate::core::image::ImageSelector;
+use crate::{cli::Cli, core::image::ImageSelector};
 
 #[derive(Debug, Args)]
 pub struct ImageArguments {
@@ -10,7 +10,13 @@ pub struct ImageArguments {
 
 #[derive(Debug, Subcommand)]
 pub enum ImageCommand {
+    /// Lists images known by boil with all available versions.
     List(ImageListArguments),
+
+    /// Checks if all images known by boil are available in the specified registries.
+    ///
+    /// Access tokens must be provided with the following name: `BOIL_REGISTRY_TOKEN_<REGISTRY_URI>`.
+    Check(ImageCheckArguments),
 }
 
 #[derive(Debug, Args)]
@@ -23,6 +29,22 @@ pub struct ImageListArguments {
     pub pretty: Pretty,
 }
 
+#[derive(Debug, Args)]
+pub struct ImageCheckArguments {
+    /// Optionally specify one or more images to check. Checks all images by default.
+    pub image: Vec<ImageSelector>,
+
+    // NOTE (@Techassi): Should this maybe be renamed to vendor_version?
+    /// The image version being built.
+    #[arg(
+        short, long,
+        value_parser = Cli::parse_image_version,
+        default_value_t = Cli::default_image_version(),
+        help_heading = "Image Options"
+    )]
+    pub image_version: String,
+}
+
 // #[derive(Clone, Debug, Default, strum::Display, strum::EnumString)]
 #[derive(Clone, Debug, Default, ValueEnum)]
 pub enum Pretty {

diff --git a/rust/boil/src/cli/mod.rs b/rust/boil/src/cli/mod.rs
@@ -1,6 +1,8 @@
-use std::path::PathBuf;
+use std::{path::PathBuf, sync::LazyLock};
 
 use clap::{Parser, Subcommand};
+use regex::Regex;
+use snafu::Snafu;
 
 mod build;
 mod completions;
@@ -9,6 +11,19 @@ mod image;
 pub use build::*;
 pub use completions::*;
 pub use image::*;
+use url::Host;
+
+// This is derived from the general rule where the length of the tag can be up to 128 chars
+// See: https://github.com/opencontainers/distribution-spec/blob/main/spec.md
+// But that checking needs to be at a higher layer.
+static VALID_IMAGE_TAG: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"^[a-zA-Z0-9_][a-zA-Z0-9_.-]+$").expect("regex is valid"));
+
+#[derive(Debug, Snafu)]
+pub enum ParseImageVersionError {
+    #[snafu(display("invalid image tag characters for {version:?}"))]
+    ParseVersion { version: String },
+}
 
 #[derive(Debug, Parser)]
 #[command(author, version, about)]
@@ -25,6 +40,26 @@ impl Cli {
     fn default_config_path() -> PathBuf {
         PathBuf::from("./boil.toml")
     }
+
+    pub(super) fn default_image_version() -> String {
+        "0.0.0-dev".to_owned()
+    }
+
+    pub(super) fn default_registry() -> HostPort {
+        HostPort {
+            host: Host::Domain(String::from("oci.stackable.tech")),
+            port: None,
+        }
+    }
+
+    /// Ensure that the given version will be valid for use in the image tag
+    pub(super) fn parse_image_version(version: &str) -> Result<String, ParseImageVersionError> {
+        if !VALID_IMAGE_TAG.is_match(version) {
+            return ParseVersionSnafu { version }.fail();
+        }
+
+        Ok(version.to_owned())
+    }
 }
 
 #[derive(Debug, Subcommand)]