OCI Daemon#
The SKAO OCI Daemon securely primes OCI images into compute nodes and OCI registries across the pipeline. It cuts image pull times in edge locations and keeps deployments resilient when the link to the upstream registry is slow, intermittent, or absent.
Where it fits in the SKA supply chain#
SKAO secures the delivery stage of its software supply chain by building and
signing container images inside secure runners and storing them in the Central
Artefact Repositories. Images live in Harbor
(harbor.skao.int), which surfaces signatures and vulnerability scans and can
block images that are unsigned or carry critical vulnerabilities. Because the
signatures travel with the artefacts, their provenance can be verified downstream —
both Podman and Kubernetes can check an image’s signature before it is deployed.
Compute nodes that run workloads are still connected to the internet, which leaves them exposed. The OCI Daemon is the last mile that closes this gap: it securely primes images from the central repositories into the compute nodes and local registries at each datacentre and telescope site, enforcing image-signature validation in every operation mode. It keeps a local, on-disk OCI-layout registry that can be shared between daemon instances, cutting layer copies and storage use.
The daemon runs in one of two modes:
cache — prime other OCI registries (for example
registry:2, Nexus, or Zot).node — prime the OCI engine (containerd, Docker, or Podman) directly on a compute node.
It lets SKAO run segregated, air-gapped networks — using only pre-approved images — without changing how applications are deployed.
Product documentation#
The daemon is documented and maintained in its own project. That documentation is the source of truth — refer to it directly so you always get the behaviour that matches the current release.
Tutorial
Overview, key capabilities, and the two operating modes.
(external link)How-to
Run the daemon locally, in a container, or on Kubernetes with the Helm chart, and source configuration from Vault.
(external link)Reference
Configuration schema, CLI flags, tag-selection syntax, and metrics.
(external link)Explanation
The design, the two operating modes, and the trade-offs behind them.
(external link)