ORAS Go library

oras-go is a Go library for managing OCI artifacts, compliant with the OCI Image Format Specification and the OCI Distribution Specification. It provides unified APIs for pushing, pulling, and managing artifacts across OCI-compliant registries, local file systems, and in-memory stores.

Note

The main branch follows Go's Security Policy and supports the two latest versions of Go (currently 1.24 and 1.25).

Getting Started

Concepts

Gain insights into the fundamental concepts:

• Modeling Artifacts
• Targets and Content Stores

Quickstart

Follow the step-by-step tutorial to use oras-go v2:

• Quickstart: Managing OCI Artifacts with oras-go v2

Examples

Check out sample code for common use cases:

• Artifact copying
• Registry operations
• Repository operations
• Authentication
• Credentials management

Find more API examples at pkg.go.dev.

Versioning

This project follows Semantic Versioning (MAJOR.MINOR.PATCH), with MAJOR for breaking changes, MINOR for backward-compatible features, and PATCH for backward-compatible fixes.

Previous Major Versions

v1 (maintenance)

The v1 branch is maintained for dependency updates and security fixes only. All feature development happens in the main branch.

To migrate from v1 to v2, see MIGRATION_GUIDE.md.

Community

• Code of Conduct: CODE_OF_CONDUCT.md
• Security Policy: SECURITY.md
• Reviewing Guide: Reviewing Guide
• Slack: #oras channel on CNCF Slack