Everlock One server for your digital life

Documentation

OCI backend

The OCI backend turns Everlock into a self-hosted container registry.

It serves the OCI Distribution API over HTTP, stores registry data inside Everlock-managed storage, and authenticates access through normal Everlock users and grants.

The Distribution protocol itself comes from apimeister-registry, an open-source OCI registry engine that Everlock embeds and wraps in its own host routing, versioned storage, identity, and TLS — see The apimeister-registry engine for what the upstream project is and how it is configured.

What it is for

Use the OCI backend when you want:

  • a private registry for container images and artifacts
  • registry hosting that lives in the same binary as the rest of your Everlock services
  • image push and pull access controlled with Everlock identities

How it fits in the system

  • frontend-http handles HTTP auth, routing, and transport
  • backend-oci-http owns registry behavior and persistence
  • the admin backends manage registry instances and vhosts

The OCI backend is not one global registry. It is host-dispatched:

  • each configured registry has its own vhost list
  • each configured registry has its own store
  • the backend selects the registry by Host header

This makes the current OCI implementation closer to site hosting than to a single monolithic registry service.

Multi-instance and addressing

Like sites and the image backend, the OCI backend hosts many isolated registries from one process and reaches them two ways:

  • Public registries are addressed by DNS hostname with automatic ACME certificates — which matters for OCI because docker and podman expect HTTPS.
  • Private registries can use .local vhosts that Everlock announces over mDNS, so a LAN registry resolves by name with no DNS server.

Typical operator flow

  1. enable the backend
  2. create a registry instance
  3. assign one or more vhosts (public for ACME, .local for mDNS)
  4. grant pull or push access
  5. point docker, podman, or other OCI clients at the registry host

Getting started

Pages