An OCI registry that resolves container images published on Nostr.
Pull an image by the pubkey that published it. There is nothing to sign up for.
docker pull ncontainer.io/<npub>/<repo>:<tag>
Or in a Dockerfile:
FROM ncontainer.io/<npub>/myapp:latest
The image name is the publisher's identity, so provenance needs no separate signature. Layers are Blossom blobs, addressed by the same sha256 digests the OCI spec already uses; the Nostr event supplies only the mutable part, which is the map from tag to manifest digest.
Four spellings of a repository resolve here:
ncontainer.io/<npub>/<repo> ncontainer.io/<npub> ncontainer.io/<naddr> ncontainer.io/<domain>/<repo>
This registry is read-only. Images are published by uploading their blobs to a Blossom server and signing a repository event.