> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Push and pull images

> Create a repository and use its URI with an OCI container client.

[Create a repository](/registry/create-repository) in your selected account and
region, then use its returned `uri` to push and pull images.

## Log in

Exchange your platform token for a registry credential. Keep its password out
of shell arguments and logs; use your client's standard input option.

```bash theme={null}
set -o pipefail
curl --fail-with-body --silent --show-error --request POST \
  https://registry.sa-saopaulo-1.basaltic.sh/v1/authorization-token \
  --header "Authorization: Bearer $TOKEN" \
  --header "X-Account-Id: $ACCOUNT" \
  | jq -er '.authorization_data.password' \
  | docker login --username basaltic --password-stdin \
      cr.sa-saopaulo-1.basaltic.cloud
```

The response includes the credential's `expires_at`. Renew it when it expires.
The client obtains separate repository-scoped bearer tokens during push and
pull. Those access tokens last five minutes; policy revocations apply when
access is evaluated for the next token.

## Push a release

Set `IMAGE_URI` to the returned repository URI and push your local image:

```bash theme={null}
docker tag my-app:v1 "$IMAGE_URI:v1"
docker push "$IMAGE_URI:v1"
docker pull "$IMAGE_URI:v1"
```

For reproducible deployments, use `IMAGE_URI@sha256:...` with the digest returned
by the push. A tag is convenient for discovery; a digest identifies the exact
manifest. The parsed `manifest` in a REST response is for inspection. Retrieve
the original manifest through your OCI client when verifying its digest.

## Inspect and remove

List images under `/v1/repositories/{repository_id}/images`, and tags under
`/v1/repositories/{repository_id}/tags`. The image list accepts `tag_status` and
`tag_prefix`; tag pagination uses a tag name as its cursor.

Batch deletion accepts explicit digest or tag entries. Inspect each result:
one failed entry does not make all other entries fail. Deleting a nonempty
repository requires `force=true`; that option never overrides deletion
protection. Disable protection explicitly before deleting the repository.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.