crane

Crane is Google's CLI for working directly with container registries and remote OCI images. It covers the registry-side operations around inspection, copy, tagging, export or import, and targeted image mutation without requiring a local Docker daemon.

• Inspect remote image manifests, configs, digests, tags, and registry catalogs, then export filesystems or pull images into tarballs or OCI layouts.
• Copy, retag, delete, validate, and push images across registries while preserving digests where the registry-side operation allows it.
• Append layers, mutate labels or annotations or entrypoints, filter multi-platform indexes, assemble new indexes, and rebase images onto patched base layers.

• Manifest, config, and auth read paths are already machine-readable, and commands like push, append, index filter, and rebase print resulting references that chain cleanly into shell pipelines.
• Most subcommands are direct non-interactive operations, so they fit inspect or change or verify loops in CI, release tooling, and registry automation.
• Structured output is not uniform across the whole CLI, and remote-state commands still depend on registry credentials, network access, and guardrails around risky operations like rebase.

• Most useful workflows target remote registries rather than local daemon state, so authentication and network reachability are prerequisites.
• crane rebase is documented as experimental and not safe in general; rebased images should be validated before promotion.