Occy Strap
Occy Strap is a Docker/OCI container image manipulation toolkit that lets you work with container images without requiring Docker to be installed. It follows a flexible input -> filter -> output pipeline: download images from registries, local Docker/Podman daemons, or tarballs; transform them with filters (normalize timestamps for reproducible builds, exclude files, search for content); and export them to tarballs, directories, OCI runtime bundles, or push them to a registry. A persistent filtering registry proxy supports batch builds and pull-through caching.
It will mostly be of interest to people building container images in CI, mirroring images into airgapped environments, or wanting reproducible image builds.
Installation
pip install occystrap
See docs/installation.md for details and verification steps.
Usage
# Download from registry to tarball
occystrap process registry://docker.io/library/busybox:latest tar://busybox.tar
# Download from registry to directory
occystrap process registry://docker.io/library/busybox:latest dir://busybox
# Export from local Docker to tarball with timestamp normalization
occystrap process docker://myimage:v1 tar://output.tar -f normalize-timestamps
# Search for files in an image
occystrap search registry://docker.io/library/busybox:latest "bin/*sh"
# Inspect image metadata
occystrap info registry://docker.io/library/busybox:latest
# Validate an image end to end
occystrap check registry://docker.io/library/busybox:latest
See the command reference for all commands, URI schemes, filters, authentication, compression, verification, the layer cache, the registry proxy, and the legacy command mappings.
Documentation
In the docs/ directory:
- Documentation Index - Overview and key concepts
- Installation - Getting started guide
- Command Reference - Complete CLI reference
- Use Cases - Common scenarios and examples, including airgapped mirroring and Podman
- Performance Tuning - Parallelism, rate limiting, retries, and benchmarking
- Pipeline Architecture - How inputs, filters, and outputs compose
- Implementation Internals - Quay discovery, the Docker integrations, the proxy, parallelism, caching, and the HTTP layer
- Development - Setup, tests, releasing, and the PR bot commands
- Docker Tarball Formats - Docker save tarball format reference
Project reference files:
- ARCHITECTURE.md - Directory structure and an index into docs/
- AGENTS.md - Guide for AI coding assistants
- IMAGE_STORES.md - Image storage format notes
This project includes Claude Code skills in .claude/skills/ covering
documentation updates, testing discipline, and PR preparation.
License
Apache License 2.0. See LICENSE.
1 maintainer
Metadata
1 maintainer
Release files for occystrap 0.4.17
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| occystrap-0.4.17.tar.gz | 365.2 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| occystrap-0.4.17-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 538.5 kB
Release files / occystrap-0.4.17.tar.gz
| Download URL | occystrap-0.4.17.tar.gz |
|---|---|
| Size | 365.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
801068930ad803e1b16b97c9f486a7a1a9f1993bbc50fc1b7d11f24ce63abcde
|
|
BLAKE2b-256 checksum How to use checksums |
c9b1e5e87eed7dc5b32d101af0edb34eb5c875d8900289a86daa419f844c5052
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 6, 2026.
Transparency logRelease files / occystrap-0.4.17-py3-none-any.whl
| Download URL | occystrap-0.4.17-py3-none-any.whl |
|---|---|
| Size | 173.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c643ada234cd7b583d48a75c8db34720634665f887703b6476d52d9b6d8501a8
|
|
BLAKE2b-256 checksum How to use checksums |
18f5d8e34ff9ec382162daec3085f62f4c9cf927ec3dd3f8e67de37d7a7fb9c2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 6, 2026.
Transparency logSecurity for occystrap 0.4.17
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for occystrap-0.4.17.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 6, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
