# `oci_pull`

Imports an image from a registry by content digest. It produces an Open
Container Initiative layout that other targets can extend, copy from, load,
or publish. The toolchain needs `crane`, not Docker.

## Pin the input

Set the required `image` registry reference and `digest`. Use `platform` to
select an operating system and architecture when the reference is an index.
`insecure` defaults to `false`; enable it only for a registry whose transport
requirements you understand.

A digest pin makes the base an explicit input. A mutable tag alone is not a
substitute: a registry can change its contents without a manifest edit.

## Outputs and composition

The target emits `container_image`. Its `build` capability exposes `layout`
and `archive`. Use it as the `base` of [`oci_image`](/reference/prelude/oci_image)
or as an `images` dependency of [`dockerfile_image`](/reference/prelude/dockerfile_image).

```sh
once query schema oci_pull
once query example oci_pull oci-pull-and-extend
```

See [Container Images](/guide/graph/containers) for authentication and composition.

`oci_pull`

Imports an image from a registry by content digest. It produces an Open Container Initiative layout that other targets can extend, copy from, load, or publish. The toolchain needs crane, not Docker.

Pin the input#

Set the required image registry reference and digest. Use platform to select an operating system and architecture when the reference is an index. insecure defaults to false; enable it only for a registry whose transport requirements you understand.

A digest pin makes the base an explicit input. A mutable tag alone is not a substitute: a registry can change its contents without a manifest edit.

Outputs and composition#

The target emits container_image. Its build capability exposes layout and archive. Use it as the base of oci_image or as an images dependency of dockerfile_image.

bash

once query schema oci_pull
once query example oci_pull oci-pull-and-extend

See Container Images for authentication and composition.