Go fetch your OCI assets — across every zone, all the way to air-gap.
Transfer OCI assets between network zones — from connected, through restricted, down to fully air-gapped — driven by declarativeRecipes, with a portable registry built in.
A Recipe describes an application as a pinned list of OCI artifacts; a Retriever lists what one zone wants. Tobby does the rest — in whichever mode the zone requires.
A long-lived service between two connected zones. It periodically re-resolves the zone's Retriever, verifies signatures and policy, and pushes only what is missing to the zone registry — recipes included, so every zone stays self-describing.
A single binary on a workstation synchronizes recipes onto a self-contained transportable store. The medium crosses the air gap physically; on the far side, the same application re-verifies everything — media contents are untrusted until proven — and pushes to the zone registry.
Cooked recipes are digest-pinned and cosign-signed (key-based — verification needs zero network). One signature attests the exact bytes of the whole delivery, re-checked before every push.
Every ingredient lands under its canonical source host — docker.io/bitnami/wordpress stays recognizable in any zone, across any number of hops. Mirror snippets are generated for the clusters.
Trivy scanning with a configurable block/warn policy — and the vulnerability database travels as an OCI artifact through Tobby itself, so air-gapped scanning never goes stale by design.
Sources and destinations are checked against an explicit registry allow-list before any transfer; a recipe cannot grant itself access that zone policy does not allow.
Tobby gates what enters hardened zones — so its own releases are built to survive the same reviewers.
slsa-verifierThe complete design was public before the first line of product code — and every milestone since is built against it. Review it, file issues, disagree with an ADR.
Every functional and non-functional requirement, numbered, testable, with acceptance criteria. docs/SRS.md
Context, decision, consequences, alternatives — from the recipe format to the crucible test infrastructure. docs/adr/
The format, strict JSON Schemas, examples — Apache-2.0, separate repository, usable by any tool (Go SDK at the first tagged release). recipe-spec
Milestones and features in three readings — technical, plain-language, business value (French). View the roadmap