Images

Use the Images page to search registries and pull, tag, inspect, prune, and remove images on the selected host. Arcane also flags images with a newer release.

Compare image tags and see which images your containers use.

×

Compare image tags and see which images your containers use.

Browse images

Open Images in the sidebar. The table shows each image’s tag, ID, size, and creation date. With scan results, sort Vulnerabilities to order by vulnerability count.

Pull an image

1. Click Pull Image.
2. Enter the image reference, e.g. redis:latest.
3. Click Pull. The image appears once the download finishes.

Search a registry

Don’t know the exact name? Use Search Registry in the pull dialog: search, pick a result and a tag, and Arcane pulls it.

Inspect an image

Click the image’s name, ID, or Inspect for tags, configuration, layer history, vulnerability results, and labels.

Image history

The History tab shows layer IDs, creation time, size, command, tags, and comments. Use it to see how an image was built or compare images after a rebuild.

Attestations

The Attestations tab shows in-toto attestations: signed statements published with an image, such as build provenance or an SBOM. They need a registry tag or digest Arcane can resolve, so local-only images may have none. Filter by platform and predicate type; open one for its digest, media type, statement type, subject, platform, and size.

Tag an image

With the images:tag permission:

1. On the image detail page, click Tag Image.
2. Enter the target repository and tag. Without a tag, Docker uses latest.
3. Save.

Remove an image

1. Click the trash icon on the image row.
2. Confirm.

Note

Images used by any container can’t be removed.

Prune unused images

1. Click Prune Unused.
2. Pick what to remove: Dangling Only removes images without tags, All Unused removes every image no container uses.
3. Confirm.

Check for image updates

Click Check Updates to ask registries for newer images; Refresh only reloads the list. Arcane also checks on the Auto Updates schedule. Updated images show:

• Version Update: a newer version tag is available.
• Digest Update: the same tag now points to a different build, because its digest (the registry’s content hash for one exact image) changed. Common with tags like latest.

Open the indicator to see the latest version or digest, update the containers using the image, or select Re-check Updates. If updates don’t appear, check that Arcane can reach the registry and has its credentials.

Private registries

Save registry credentials so Arcane can pull private images and check them for updates.

1. Open Customization → Container Registries.
2. Add the registry host, username, and password or token, and optionally Repository Names.
3. Save.

You can save several registries; Arcane matches credentials by each image reference’s hostname.

Note

If you change a registry’s URL, re-enter its credentials in the same save, or Arcane rejects it, so secrets never go to a new host. This applies wherever a secret is tied to a URL: an environment’s API URL, the OIDC issuer, the Trivy server, and notification provider hosts.

Repository names

Repository Names lists the repositories you push to on this registry, one complete name per line:

team/api
team/platform/api

Arcane validates each against Docker’s reference format and removes duplicates. They fill the Repository name dropdown for pushing builds. Without them, a registry works for pulls and update checks but can’t be a push target.

Browse a registry

With registries:read and registries:browse, click Browse on a saved registry to see repositories and tags, each with digest, size, platforms, and a copyable image reference. With registries:delete-tags, you can delete tags singly or in bulk.

Catalog registries, such as self-hosted Distribution, list every repository. Docker Hub, GHCR, and similar don’t, so Arcane shows the saved Repository Names. Type any other repository into Open Repository to load its tags.

Warning

Arcane deletes a tag by its manifest digest, so every other tag pointing to the same manifest is removed too. The registry only frees the storage after it runs garbage collection.

Amazon ECR

ECR is a first-class registry type. Provide an AWS access key ID, secret access key, and region; Arcane exchanges them for a temporary ECR token and refreshes it as needed. When you change an ECR registry’s URL, re-enter both the access key ID and the secret access key.