CLI Guide

Registry is part of the dodil CLI. Every command is invoked as:


dodil registry <command> [args] [flags]

The CLI talks to the REST control plane — it manages repositories and reads scan reports. Image bytes still move with docker push / docker pull; the CLI’s pull-command prints those for you.

Install and authenticate

Install and authenticate the dodil CLI — see Install the CLI . It covers dodil auth login, the shared config file, and value resolution, all single-sourced there. Registry is the dodil registry group.

Registry-specific notes:

Endpoint — defaults to https://registry.dodil.io, or is derived from your configured gateway (api.<domain> → registry.<domain>). Override with --api-endpoint, the registry.api_endpoint config key, or the DODIL_REGISTRY_ENDPOINT env var.
Environment prefix is REGISTRY_.
Tokens — your login JWT is sent as a Bearer token. A dk_ API key also works (as --token or config): the CLI detects the dk_ prefix and sends it the Basic-auth way the backend expects, so the same key serves docker login, CI, and the CLI.
Org is name-keyed. The registry addresses your org by name (it’s in the image path). Resolution order: --org-name → --org → config org_name → global.org_name → global.org_id (works when name == id).

After login, verify connectivity:


dodil registry health


status: ok   service: registry

Command map

Command	What it does
`repo list`	List repositories in the org
`visibility <repo> <public\|private>`	Set repository visibility (public = anonymous pull)
`artifact list <repo>`	List artifacts with tags, size, and scan severity
`artifact delete <repo> <reference>`	Delete an artifact by digest or tag
`tag list <repo> <reference>`	List tags on an artifact
`vuln <repo> <reference>`	Show the vulnerability scan report (aliases: `vulnerabilities`, `scan`)
`pull-command <repo> [tag]`	Print the `docker pull` command for a repository
`health`	Check registry service health

Note visibility is a top-level command, not nested under repo.

Detailed pages:

Repos & Artifacts — repo, visibility, artifact, tag, pull-command, health.
Vulnerability Scanning — vuln and reading the report.

Global flags

These work on every command:

Flag	Meaning	Example
`-o`, `--output`	Output format: `table` (default) or `json`	`-o json`
`--api-endpoint`	Registry API base URL	`--api-endpoint https://registry.dodil.io`
`--token`	Auth token override (JWT or `dk_` key)	`--token "$DODIL_TOKEN"`
`--org`	Organization id override	`--org acme`
`--org-name`	Organization name override (registry is name-keyed)	`--org-name acme`
`--config`	Config file path	`--config ./config.yaml`
`--debug`	Enable debug output	`--debug`

Use -o json for automation — it prints the raw control-plane response ({"items": [...], "total_count": N} for lists).

CLI Guide

Install and authenticate

Command map

Global flags

See also