crane ls: List Tags in a Repository
crane ls prints all tags in a repository by querying the registry tag list API, no daemon required.
To find what tags exist for an image (for cleanup, promotion, or picking the latest release) crane ls returns the registry tag list directly.
What it does
crane ls calls the registry _catalog/tags endpoint for a repository and prints each tag on its own line. It is easy to pipe into grep, sort, or a cleanup loop.
Common usage
# list all tags in a repo
crane ls ghcr.io/acme/app
# find the highest semver-looking tag
crane ls ghcr.io/acme/app | grep -E '^[0-9]+\.' | sort -V | tail -1
# delete every pr-* tag
for t in $(crane ls ghcr.io/acme/app | grep '^pr-'); do
crane delete "ghcr.io/acme/app:$t"
doneOptions
| Flag | What it does |
|---|---|
| REPO | Repository to list (no tag) (positional) |
| --omit-digest-tags | Hide the sha256-... helper tags cosign/others create |
| --full-ref | Print full references instead of bare tags |
In CI
crane ls plus crane delete gives a daemonless tag-cleanup loop for ephemeral PR images. Use --omit-digest-tags so signature and attestation tags (the sha256-... entries) do not clutter the list.
Common errors in CI
"NAME_UNKNOWN: repository name not known to registry" means the repo path is wrong or has no images yet. "UNAUTHORIZED: authentication required" means authenticate first. An empty list with no error usually means the tag was pushed only by digest, or you are pointing at the wrong registry host.