Support for Nexus Repository 3 and Helm OCI Proxy Repositories – Sonatype Support

Assumptions

You are comfortable with Linux, Docker and Helm
You have a fundamental understanding how Nexus Repository 3 works

Helm OCI Support

Nexus Repository 3 does not currently support Helm OCI proxy repositories (URL with "OCI://").

There is an existing Product Idea for this to be addressed in a future release:

https://ideas.sonatype.com/ideas/IDEAS-I-1989 Add OCI support for both hosted Helm repositories and proxied Helm repositories

Workaround - Use Docker Proxy instead

However, we do provide support for Docker "OCI" images in Nexus Repository 3, but you cannot use the "OCI" protocol in a proxy repository, i.e. you cannot configure oci:// as the remote storage URL inside a Nexus proxy repository.

Instead, in Nexus Repository 3 you need to use the "HTTPS" protocol.

For example, if you require to use the "oci://registry-1.docker.io/bitnamicharts/" as the location of the remote repository to be proxied, then you will need to create a docker proxy repository with the following remote storage:-

https://registry-1.docker.io/

Direction	`oci://`	Supported?
Nexus remote storage URL	`oci://<upstream-registry>/...`	❌ Not supported
Nexus remote storage URL	`https://<upstream-registry>/`	✅ Use this
Client → Nexus Docker proxy endpoint	`oci://<nexus-subdomain-or-port>/...`	✅ Can work

Once the Docker proxy is correctly exposed (via subdomain, reverse proxy, or connector port), clients can use oci:// commands pointing at the Nexus endpoint , for example, first login (e.g. helm registry login <nexus-host>:<port> --username <user> --password <password>), then helm pull oci://<nexus-host>:<port>/bitnamicharts/postgresql or helm pull oci://<nexus-subdomain>/bitnamicharts/postgresql