Temporary anonymous registry (tmp.cgruser.dev)

tmp.cgruser.dev is a free, anonymous, ephemeral OCI registry run by Chainguard. Push an image with no account, no login, and no configuration, hand the reference to a teammate or a test cluster, and it works until it expires. It is handy for sharing a quick build, testing CI pipelines, or pulling into a Kubernetes cluster without configuring pull secrets.

This service is experimental. It has no SLA, its hostname may change, and anything on it can disappear at any time. Never use it for production images, and never push anything secret: everything on this registry is publicly readable, writable, and deletable by anyone.

Quick start

Standard OCI clients just work, because there is no auth to configure:

# Something to push
cat > Dockerfile <<'DOCKERFILE'
FROM cgr.dev/chainguard/busybox:latest
CMD ["echo", "hello from the temporary registry"]
DOCKERFILE

# Pick a random name once so build, push, and pull all agree
IMAGE="tmp.cgruser.dev/$(uuidgen | tr 'A-F' 'a-f')/demo:1h"

docker build -t "$IMAGE" .
docker push "$IMAGE"

# Anyone with the reference can pull it, from anywhere, with no login
docker pull "$IMAGE"

Or skip the build entirely and copy an existing image with crane:

crane copy cgr.dev/chainguard/busybox:latest \
  "tmp.cgruser.dev/$(uuidgen | tr 'A-F' 'a-f')/busybox:30m"

The tag is the time-to-live

A tag whose name is a duration sets how long the tag is served, up to a maximum of 24 hours:

Details worth knowing:

• A duration is a whole number with one unit: s, m, h, or d.
• Every push restarts the clock.
• When a duration tag’s time is up, pulling it by tag stops working. Pulling by digest may keep working for a while longer.
• Expiry is a ceiling, not a guarantee of availability: any content may be removed at any time.

Pulling from Kubernetes

Because pulls are anonymous, a cluster needs no imagePullSecrets and no registry configuration. You can verify the whole flow in a couple of minutes with kind:

# Push something to a random repository name
IMAGE="tmp.cgruser.dev/$(uuidgen | tr 'A-F' 'a-f')/hello:1h"
crane copy cgr.dev/chainguard/busybox:latest "$IMAGE"

# A fresh local cluster, no registry configuration anywhere
kind create cluster --name tmp-demo

# A pod that pulls it; note: no imagePullSecrets
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: tmp-registry-demo
spec:
  restartPolicy: Never
  containers:
    - name: hello
      image: ${IMAGE}
EOF

The kubelet pulls the image anonymously and the pod runs:

$ kubectl describe pod tmp-registry-demo | grep Pulled
  Normal  Pulled  1s  kubelet  Successfully pulled image "tmp.cgruser.dev/.../hello:1h" in 1.722s

$ kubectl delete pod tmp-registry-demo && kind delete cluster --name tmp-demo

The same applies to any cluster that can reach the internet: hand it the image reference and it pulls, no secrets required.

Ground rules

• Everything is public and anonymous. Anyone can pull, overwrite, or delete any tag. Use a long random repository name (the uuidgen trick above) and pull by digest when integrity matters:

  docker pull tmp.cgruser.dev/<name>/demo@sha256:<digest>

• Repositories cannot be listed. There is no catalog endpoint, so content is only reachable by someone who knows the name. Tag listing works within a repository you already know.

• Reserved namespaces are rejected. Pushes under chainguard, cgr, wolfi, and lookalike names are refused, so content here cannot impersonate Chainguard’s own images. Chainguard’s real images live at cgr.dev.

• Every response carries a warning. The registry sends an OCI Warning header reminding you that content is anonymous and unreviewed; clients like crane display it on every push and pull.

• Content is not scanned or endorsed by Chainguard. Treat anything you pull from this registry exactly as you would a file from an unknown stranger, because that is what it is.

What this registry is not

The temporary registry is entirely separate from Chainguard’s main registry at cgr.dev, and has no connection to Chainguard accounts or images. If you need secure, minimal, signed images with real support, that is what Chainguard Containers are for.