# regctl tag ls: List Repository Tags

> regctl tag ls lists the tags of a remote repository without a daemon. Reference for authentication, TLS config, output, and CI errors.

Source: https://latchkey.dev/learn/command-reference/regctl-tag-list  
Updated: 2026-06-30

regctl tag ls prints all tags in a repository by querying the registry, no Docker daemon required.

regctl tag ls is the regclient equivalent of crane ls: it lists the tags of a repository so you can pick, promote, or clean them up.

## What it does

regctl tag ls queries the registry tag listing endpoint for a repository and prints each tag. It respects the login and TLS settings you configure with `regctl registry`.

## Common usage

```Terminal
# list tags
regctl tag ls ghcr.io/acme/app

# newest semver tag
regctl tag ls ghcr.io/acme/app | grep -E '^[0-9]' | sort -V | tail -1

# delete a specific tag
regctl tag rm ghcr.io/acme/app:pr-123
```

## Options

| Flag | What it does |
| --- | --- |
| REPO | Repository to list (positional) |
| --limit N | Limit the number of tags returned |
| --format <tmpl> | Go-template output (e.g. raw JSON) |

## In CI

Pair regctl tag ls with regctl tag rm for daemonless tag cleanup, or with regctl image copy to promote a chosen tag. Configure the registry once per job with `regctl registry login`.

## Common errors in CI

"401 Unauthorized" means run `regctl registry login <host>`. "repository not found" means the path is wrong or empty. "x509: certificate signed by unknown authority" on an internal registry needs a mounted CA or `regctl registry set --tls insecure <host>`.

## FAQ

### regctl tag ls: List Repository Tags?

regctl tag ls is the regclient equivalent of crane ls: it lists the tags of a repository so you can pick, promote, or clean them up.

### What it does?

regctl tag ls queries the registry tag listing endpoint for a repository and prints each tag. It respects the login and TLS settings you configure with regctl registry.

### In CI?

Pair regctl tag ls with regctl tag rm for daemonless tag cleanup, or with regctl image copy to promote a chosen tag. Configure the registry once per job with regctl registry login.

### Common errors in CI?

"401 Unauthorized" means run regctl registry login <host>. "repository not found" means the path is wrong or empty. "x509: certificate signed by unknown authority" on an internal registry needs a mounted CA or regctl registry set --tls insecure <host>.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt