Pack: no network at all
pack materializes the current snapshot as an OCI artifact inside the local layout, with no registry
involved. It is also what persists a travelling index — see the warning at the end of
Ingestion.
Two identities per layer, and the pair is the point
Push
org/brain@sha256:… resolvable, the only way to point
at a version nobody can move a tag away from.
Tags move; digests do not
A tag is a pointer, like a git branch. Pushing tov1 repeatedly moves it. Your local history keeps every
version (ten by default, RetentionPolicy.retained_roots), each still verifying. The remote does not —
when v1 moves, the previous manifest is untagged, and registries collect untagged manifests.
So the discipline is the one you already use for container images:
Plan a pull
One manifest request, no layers:Pull, selectively
A selective install is a first-class outcome, not a partial failure. Taking the semantic module
without the canonical one is a real way to consume a brain, and the manifest records what was left out.
Asking for a module you did not install is an error, never an empty module.
Publishing without a registry
LocalLayoutRegistry speaks the same RegistryClient protocol against directories on disk — useful for
tests, air-gapped transfers, and understanding what a push does:
Supplying your own transport
OrasRegistryClient requires the oci extra. The rest of distribution — packing, layer construction,
local layouts — needs nothing beyond the standard library.