Sync container images to your registry

Sync container images to your registry#

The Hybrid Manager software stack is distributed through the EDB Repos 2.0 registry. Before installing or upgrading Hybrid Manager, you need to sync these container images to your own secure, approved internal registry.

Why sync images?#

The sync process ensures:

  • Security : Images are hosted in your organization’s approved registry

  • Immutability : SHA256 digests are preserved across environments

  • Compliance : You control where container images are stored

  • Availability : Images remain accessible even if external registries are unavailable

Prerequisites#

Before syncing images, ensure you have:

  • The Hybrid Manager version you want to install

  • An EDB Repos 2.0 access token with read permissions

  • Access to your destination container registry with push permissions

  • Either edbctl or skopeo installed on your system

Option 2: Using skopeo#

Skopeo is an open-source tool for working with container images. You can use it to sync images if you prefer not to use edbctl .

Install skopeo#

Follow the official skopeo installation instructions for your operating system.

Download the image list#

Each Hybrid Manager release provides an artifact containing the list of all required container images:

#  Configure the HM release version

export HM_RELEASE=<RELEASE_VERSION>

#  Configure the EDB Repos 2.0 access token

export EDB_TOKEN=<EDB_TOKEN>

#  Download the image list artifact

curl -sLO "https://downloads.enterprisedb.com/${EDB_TOKEN}/pgai-platform/raw/names/${HM_RELEASE}-images.txt/versions/${HM_RELEASE}/images.txt"

Authenticate to registries#

#  Configure registries

export EDB_SOURCE_REGISTRY=docker.enterprisedb.com/pgai-platform
export LOCAL_REGISTRY_URI=<LOCAL_REGISTRY_ADDRESS>

#  Login to EDB Repos 2.0 source registry

skopeo login docker.enterprisedb.com

#  Login to destination registry

skopeo login <LOCAL_REGISTRY_ADDRESS>

Sync all images#

#  Parse the image list and sync each image

while read -r image; do
  skopeo --override-os linux copy \
    --multi-arch all \
    docker://$EDB_SOURCE_REGISTRY/${image/:*@/@} \
    docker://$LOCAL_REGISTRY_URI/${image/:*@/@} \
    --retry-times 3
done < images.txt

Sync the Operator image#

#  Sync the HM Operator image

skopeo --override-os linux copy \
    --multi-arch all \
    docker://${EDB_SOURCE_REGISTRY}/edb-hcp-operator/manager:${HM_RELEASE} \
    docker://${LOCAL_REGISTRY_URI}/edb-hcp-operator/manager:${HM_RELEASE} \
    --retry-times 3

!!!note The sync process typically takes several minutes to complete depending on your network speed and the number of images in the release.

Platform-specific notes#

AWS ECR#

If using AWS ECR as your destination registry, you must create separate repositories for each image since ECR doesn’t support images with multiple slashes in their names to be saved in the same repository.

When you run the sync command with edbctl , it will detect ECR and prompt for confirmation, then provide a code snippet with AWS CLI commands to pre-create all required repositories.

For authentication, use:

- -destination-registry-username "AWS" \
- -destination-registry-password "$(aws ecr get-login-password --region ${AWS_REGION})"

See the AWS ECR documentation for more details.

GCP Artifact Registry#

For GCP Artifact Registry authentication, use:

- -destination-registry-username "_json_key" \
- -destination-registry-password "$(cat ~/gcp-service-account-key.json)"

Red Hat Quay / OpenShift#

Standard username and password or token authentication is supported. For OpenShift internal registry, ensure you have the proper service account tokens configured.

Next steps#

After syncing the container images to your private registry:

  1. Update your Helm chart values.yaml to point to your registry:

containerRegistryURL: "<your-local-container-registry-url>"

  1. Proceed with the Hybrid Manager installation for your platform: - Installation phase of Hybrid Manager on Rancher RKE2

Contents