...The library handles authentication via a pluggable keychain system that understands Docker config files, credential helpers, and environment credentials. It understands multiple on-disk layouts (tarball, OCI layout, remote) and lets you transform images in memory by adding or rebasing layers, adjusting config, and annotating manifests. Because everything is regular Go code, it’s straightforward to embed in CI/CD systems, policy engines, and bespoke supply-chain tooling.