---
name: container-registry
description: >
  Bootstrap a sovereign container registry (OCI/Docker) with plan/apply/rollback,
  signature verification hooks, backups, and audit report. Designed to pair with
  gitea-bootstrap on Node B. Triggers: 'container registry', 'docker registry',
  'oci registry', 'self-host registry', 'registry plan'.
version: 1.0.0
---

# Container Registry (Sovereign)

Tier 2 skill: establish a **self-hosted OCI registry** you control.

This skill deploys a Docker Registry v2 (with optional UI) using
plan/apply gates and produces verifiable artifacts.

## Quick Start

```bash
cd ~/.claude/skills/container-registry

export MODE="docker"                 # docker only in v1
export NODE_NAME="node-b"

# Network
export REGISTRY_PORT=5000
export DOMAIN="registry.example.com"   # optional (for reverse proxy)

# Storage
export DATA_DIR="$HOME/registry"
export AUTH_DIR="$HOME/registry/auth"

# Auth (basic auth for v1)
export REGISTRY_USER="sovereign"

# Safety
export DRY_RUN=1
export REQUIRE_CONFIRM=1
export CONFIRM_PHRASE="I UNDERSTAND THIS WILL DEPLOY A CONTAINER REGISTRY"

./scripts/00_preflight.sh
./scripts/10_plan.sh

export DRY_RUN=0
./scripts/11_apply.sh

./scripts/90_verify.sh
./scripts/99_report.sh
```

## Inputs

| Parameter | Required | Default | Description |
|---|---:|---|---|
| MODE | Yes | docker | docker |
| REGISTRY_PORT | No | 5000 | Registry port |
| DOMAIN | No | (empty) | Hostname if proxied |
| DATA_DIR | No | ~/registry | Registry storage |
| AUTH_DIR | No | ~/registry/auth | htpasswd storage |
| REGISTRY_USER | Yes | (none) | Registry username |
| DRY_RUN | No | 1 | Apply refuses unless DRY_RUN=0 |
| REQUIRE_CONFIRM | No | 1 | Require confirmation phrase |
| CONFIRM_PHRASE | No | I UNDERSTAND THIS WILL DEPLOY A CONTAINER REGISTRY | Safety phrase |

## Outputs

- `outputs/compose.yml`
- `outputs/htpasswd`
- `outputs/status_matrix.json`
- `outputs/audit_report.md`
- Backups under `outputs/backups/`

## Security Notes (v1)

- Basic auth (htpasswd)
- TLS termination expected via reverse proxy or Cloudflare Tunnel
- Image signing handled upstream (cosign/notation integration planned)

## EU Compliance

| Aspect | Value |
|---|---|
| Data Residency | EU (Ireland - Dublin) |
| Jurisdiction | Irish Law |
| Images | Stored on Node B |
| Access | Authenticated |

## References
- [OCI Registry Notes](references/registry_notes.md)