lazer.sh
lazer.sh is a private container registry. It speaks the OCI Distribution Specification, so
every tool you already use — docker, podman, nerdctl, crane, skopeo, Kubernetes —
works against it without a plugin or a wrapper.
Two things make it different from the registry attached to your cloud provider:
- Pulls are unmetered. No egress charge, on any plan, including free.
- Keys carry an explicit scope. A credential is bound to a project, a repository, and a set of actions. There is no policy language to get wrong.
The model
Four nouns, and they nest:
| Noun | What it is |
|---|---|
| User | You. A user holds a plan, and the plan grants a storage pool and a project count |
| Project | A namespace with a storage allocation drawn from its owner's pool. acme in lazer.sh/acme/api |
| Repository | A named image stream inside a project. api in lazer.sh/acme/api |
| Key | A credential carrying scopes, optionally bound to one project |
The important consequence: plans belong to users, not projects. A plan gives you a pool of gigabytes, and each project reserves an allocation from that pool. Move storage between projects whenever you like without changing what you pay.
An image reference
text
lazer.sh/acme/api:2.4.1
└──────┘ └──┘ └─┘ └───┘
registry proj repo tagWhere to go next
- Quickstart — push and pull your first image.
- Keys and scopes — how access is expressed and enforced.
- Retention — how untagged images are reclaimed, and on what schedule.
- GitHub Actions — a working CI pipeline.