diff --git a/docker/docker_client.go b/docker/docker_client.go
index 6d2c5b670d..99eac42677 100644
--- a/docker/docker_client.go
+++ b/docker/docker_client.go
@@ -100,17 +100,18 @@ type authScope struct {
 	actions    string
 }
 
-// sendAuth determines whether we need authentication for v2 or v1 endpoint.
-type sendAuth int
+// SendAuth determines whether we need authentication for v2 or v1 endpoint.
+type SendAuth int
 
 const (
-	// v2 endpoint with authentication.
-	v2Auth sendAuth = iota
+	// V2Auth is v2 endpoint with authentication.
+	V2Auth SendAuth = iota
 	// v1 endpoint with authentication.
 	// TODO: Get v1Auth working
 	// v1Auth
-	// no authentication, works for both v1 and v2.
-	noAuth
+
+	// NoAuth is no authentication, works for both v1 and v2.
+	NoAuth
 )
 
 func newBearerTokenFromJSONBlob(blob []byte) (*bearerToken, error) {
@@ -182,9 +183,9 @@ func dockerCertDir(sys *types.SystemContext, hostPort string) (string, error) {
 	return fullCertDirPath, nil
 }
 
-// newDockerClientFromRef returns a new dockerClient instance for refHostname (a host a specified in the Docker image reference, not canonicalized to dockerRegistry)
+// NewDockerClientFromRef returns a new dockerClient instance for refHostname (a host a specified in the Docker image reference, not canonicalized to dockerRegistry)
 // “write” specifies whether the client will be used for "write" access (in particular passed to lookaside.go:toplevelFromSection)
-func newDockerClientFromRef(sys *types.SystemContext, ref dockerReference, write bool, actions string) (*dockerClient, error) {
+func NewDockerClientFromRef(sys *types.SystemContext, ref DockerReference, write bool, actions string) (*dockerClient, error) {
 	registry := reference.Domain(ref.ref)
 	username, password, err := config.GetAuthentication(sys, reference.Domain(ref.ref))
 	if err != nil {
@@ -247,7 +248,7 @@ func CheckAuth(ctx context.Context, sys *types.SystemContext, username, password
 		return errors.Wrapf(err, "error creating new docker client")
 	}
 
-	resp, err := newLoginClient.makeRequest(ctx, "GET", "/v2/", nil, nil, v2Auth)
+	resp, err := newLoginClient.MakeRequest(ctx, "GET", "/v2/", nil, nil, V2Auth)
 	if err != nil {
 		return err
 	}
@@ -323,7 +324,7 @@ func SearchRegistry(ctx context.Context, sys *types.SystemContext, registry, ima
 		u.RawQuery = q.Encode()
 
 		logrus.Debugf("trying to talk to v1 search endpoint\n")
-		resp, err := client.makeRequest(ctx, "GET", u.String(), nil, nil, noAuth)
+		resp, err := client.MakeRequest(ctx, "GET", u.String(), nil, nil, NoAuth)
 		if err != nil {
 			logrus.Debugf("error getting search results from v1 endpoint %q: %v", registry, err)
 		} else {
@@ -340,7 +341,7 @@ func SearchRegistry(ctx context.Context, sys *types.SystemContext, registry, ima
 	}
 
 	logrus.Debugf("trying to talk to v2 search endpoint\n")
-	resp, err := client.makeRequest(ctx, "GET", "/v2/_catalog", nil, nil, v2Auth)
+	resp, err := client.MakeRequest(ctx, "GET", "/v2/_catalog", nil, nil, V2Auth)
 	if err != nil {
 		logrus.Debugf("error getting search results from v2 endpoint %q: %v", registry, err)
 	} else {
@@ -367,9 +368,9 @@ func SearchRegistry(ctx context.Context, sys *types.SystemContext, registry, ima
 	return nil, errors.Wrapf(err, "couldn't search registry %q", registry)
 }
 
-// makeRequest creates and executes a http.Request with the specified parameters, adding authentication and TLS options for the Docker client.
+// MakeRequest creates and executes a http.Request with the specified parameters, adding authentication and TLS options for the Docker client.
 // The host name and schema is taken from the client or autodetected, and the path is relative to it, i.e. the path usually starts with /v2/.
-func (c *dockerClient) makeRequest(ctx context.Context, method, path string, headers map[string][]string, stream io.Reader, auth sendAuth) (*http.Response, error) {
+func (c *dockerClient) MakeRequest(ctx context.Context, method, path string, headers map[string][]string, stream io.Reader, auth SendAuth) (*http.Response, error) {
 	if err := c.detectProperties(ctx); err != nil {
 		return nil, err
 	}
@@ -382,7 +383,7 @@ func (c *dockerClient) makeRequest(ctx context.Context, method, path string, hea
 // streamLen, if not -1, specifies the length of the data expected on stream.
 // makeRequest should generally be preferred.
 // TODO(runcom): too many arguments here, use a struct
-func (c *dockerClient) makeRequestToResolvedURL(ctx context.Context, method, url string, headers map[string][]string, stream io.Reader, streamLen int64, auth sendAuth) (*http.Response, error) {
+func (c *dockerClient) makeRequestToResolvedURL(ctx context.Context, method, url string, headers map[string][]string, stream io.Reader, streamLen int64, auth SendAuth) (*http.Response, error) {
 	req, err := http.NewRequest(method, url, stream)
 	if err != nil {
 		return nil, err
@@ -400,7 +401,7 @@ func (c *dockerClient) makeRequestToResolvedURL(ctx context.Context, method, url
 	if c.sys != nil && c.sys.DockerRegistryUserAgent != "" {
 		req.Header.Add("User-Agent", c.sys.DockerRegistryUserAgent)
 	}
-	if auth == v2Auth {
+	if auth == V2Auth {
 		if err := c.setupRequestAuth(req); err != nil {
 			return nil, err
 		}
@@ -514,7 +515,7 @@ func (c *dockerClient) detectProperties(ctx context.Context) error {
 
 	ping := func(scheme string) error {
 		url := fmt.Sprintf(resolvedPingV2URL, scheme, c.registry)
-		resp, err := c.makeRequestToResolvedURL(ctx, "GET", url, nil, nil, -1, noAuth)
+		resp, err := c.makeRequestToResolvedURL(ctx, "GET", url, nil, nil, -1, NoAuth)
 		if err != nil {
 			logrus.Debugf("Ping %s err %s (%#v)", url, err.Error(), err)
 			return err
@@ -541,7 +542,7 @@ func (c *dockerClient) detectProperties(ctx context.Context) error {
 		// best effort to understand if we're talking to a V1 registry
 		pingV1 := func(scheme string) bool {
 			url := fmt.Sprintf(resolvedPingV1URL, scheme, c.registry)
-			resp, err := c.makeRequestToResolvedURL(ctx, "GET", url, nil, nil, -1, noAuth)
+			resp, err := c.makeRequestToResolvedURL(ctx, "GET", url, nil, nil, -1, NoAuth)
 			if err != nil {
 				logrus.Debugf("Ping %s err %s (%#v)", url, err.Error(), err)
 				return false
@@ -566,9 +567,9 @@ func (c *dockerClient) detectProperties(ctx context.Context) error {
 
 // getExtensionsSignatures returns signatures from the X-Registry-Supports-Signatures API extension,
 // using the original data structures.
-func (c *dockerClient) getExtensionsSignatures(ctx context.Context, ref dockerReference, manifestDigest digest.Digest) (*extensionSignatureList, error) {
+func (c *dockerClient) getExtensionsSignatures(ctx context.Context, ref DockerReference, manifestDigest digest.Digest) (*extensionSignatureList, error) {
 	path := fmt.Sprintf(extensionsSignaturePath, reference.Path(ref.ref), manifestDigest)
-	res, err := c.makeRequest(ctx, "GET", path, nil, nil, v2Auth)
+	res, err := c.MakeRequest(ctx, "GET", path, nil, nil, V2Auth)
 	if err != nil {
 		return nil, err
 	}
diff --git a/docker/docker_image.go b/docker/docker_image.go
index 2ab95f329d..dca62684c5 100644
--- a/docker/docker_image.go
+++ b/docker/docker_image.go
@@ -24,7 +24,7 @@ type Image struct {
 // newImage returns a new Image interface type after setting up
 // a client to the registry hosting the given image.
 // The caller must call .Close() on the returned Image.
-func newImage(ctx context.Context, sys *types.SystemContext, ref dockerReference) (types.ImageCloser, error) {
+func newImage(ctx context.Context, sys *types.SystemContext, ref DockerReference) (types.ImageCloser, error) {
 	s, err := newImageSource(sys, ref)
 	if err != nil {
 		return nil, err
@@ -52,13 +52,13 @@ func (i *Image) GetRepositoryTags(ctx context.Context) ([]string, error) {
 // GetRepositoryTags list all tags available in the repository. The tag
 // provided inside the ImageReference will be ignored.
 func GetRepositoryTags(ctx context.Context, sys *types.SystemContext, ref types.ImageReference) ([]string, error) {
-	dr, ok := ref.(dockerReference)
+	dr, ok := ref.(DockerReference)
 	if !ok {
-		return nil, errors.Errorf("ref must be a dockerReference")
+		return nil, errors.Errorf("ref must be a DockerReference")
 	}
 
 	path := fmt.Sprintf(tagsPath, reference.Path(dr.ref))
-	client, err := newDockerClientFromRef(sys, dr, false, "pull")
+	client, err := NewDockerClientFromRef(sys, dr, false, "pull")
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create client")
 	}
@@ -66,7 +66,7 @@ func GetRepositoryTags(ctx context.Context, sys *types.SystemContext, ref types.
 	tags := make([]string, 0)
 
 	for {
-		res, err := client.makeRequest(ctx, "GET", path, nil, nil, v2Auth)
+		res, err := client.MakeRequest(ctx, "GET", path, nil, nil, V2Auth)
 		if err != nil {
 			return nil, err
 		}
diff --git a/docker/docker_image_dest.go b/docker/docker_image_dest.go
index 9bbffef939..6320c547b7 100644
--- a/docker/docker_image_dest.go
+++ b/docker/docker_image_dest.go
@@ -26,15 +26,15 @@ import (
 )
 
 type dockerImageDestination struct {
-	ref dockerReference
+	ref DockerReference
 	c   *dockerClient
 	// State
 	manifestDigest digest.Digest // or "" if not yet known.
 }
 
 // newImageDestination creates a new ImageDestination for the specified image reference.
-func newImageDestination(sys *types.SystemContext, ref dockerReference) (types.ImageDestination, error) {
-	c, err := newDockerClientFromRef(sys, ref, true, "pull,push")
+func newImageDestination(sys *types.SystemContext, ref DockerReference) (types.ImageDestination, error) {
+	c, err := NewDockerClientFromRef(sys, ref, true, "pull,push")
 	if err != nil {
 		return nil, err
 	}
@@ -130,7 +130,7 @@ func (d *dockerImageDestination) PutBlob(ctx context.Context, stream io.Reader,
 	// FIXME? Chunked upload, progress reporting, etc.
 	uploadPath := fmt.Sprintf(blobUploadPath, reference.Path(d.ref.ref))
 	logrus.Debugf("Uploading %s", uploadPath)
-	res, err := d.c.makeRequest(ctx, "POST", uploadPath, nil, nil, v2Auth)
+	res, err := d.c.MakeRequest(ctx, "POST", uploadPath, nil, nil, V2Auth)
 	if err != nil {
 		return types.BlobInfo{}, err
 	}
@@ -147,7 +147,7 @@ func (d *dockerImageDestination) PutBlob(ctx context.Context, stream io.Reader,
 	digester := digest.Canonical.Digester()
 	sizeCounter := &sizeCounter{}
 	tee := io.TeeReader(stream, io.MultiWriter(digester.Hash(), sizeCounter))
-	res, err = d.c.makeRequestToResolvedURL(ctx, "PATCH", uploadLocation.String(), map[string][]string{"Content-Type": {"application/octet-stream"}}, tee, inputInfo.Size, v2Auth)
+	res, err = d.c.makeRequestToResolvedURL(ctx, "PATCH", uploadLocation.String(), map[string][]string{"Content-Type": {"application/octet-stream"}}, tee, inputInfo.Size, V2Auth)
 	if err != nil {
 		logrus.Debugf("Error uploading layer chunked, response %#v", res)
 		return types.BlobInfo{}, err
@@ -166,7 +166,7 @@ func (d *dockerImageDestination) PutBlob(ctx context.Context, stream io.Reader,
 	// TODO: check inputInfo.Digest == computedDigest https://github.com/containers/image/pull/70#discussion_r77646717
 	locationQuery.Set("digest", computedDigest.String())
 	uploadLocation.RawQuery = locationQuery.Encode()
-	res, err = d.c.makeRequestToResolvedURL(ctx, "PUT", uploadLocation.String(), map[string][]string{"Content-Type": {"application/octet-stream"}}, nil, -1, v2Auth)
+	res, err = d.c.makeRequestToResolvedURL(ctx, "PUT", uploadLocation.String(), map[string][]string{"Content-Type": {"application/octet-stream"}}, nil, -1, V2Auth)
 	if err != nil {
 		return types.BlobInfo{}, err
 	}
@@ -191,7 +191,7 @@ func (d *dockerImageDestination) HasBlob(ctx context.Context, info types.BlobInf
 	checkPath := fmt.Sprintf(blobsPath, reference.Path(d.ref.ref), info.Digest.String())
 
 	logrus.Debugf("Checking %s", checkPath)
-	res, err := d.c.makeRequest(ctx, "HEAD", checkPath, nil, nil, v2Auth)
+	res, err := d.c.MakeRequest(ctx, "HEAD", checkPath, nil, nil, V2Auth)
 	if err != nil {
 		return false, -1, err
 	}
@@ -226,7 +226,7 @@ func (d *dockerImageDestination) PutManifest(ctx context.Context, m []byte) erro
 	}
 	d.manifestDigest = digest
 
-	refTail, err := d.ref.tagOrDigest()
+	refTail, err := d.ref.TagOrDigest()
 	if err != nil {
 		return err
 	}
@@ -237,7 +237,7 @@ func (d *dockerImageDestination) PutManifest(ctx context.Context, m []byte) erro
 	if mimeType != "" {
 		headers["Content-Type"] = []string{mimeType}
 	}
-	res, err := d.c.makeRequest(ctx, "PUT", path, headers, bytes.NewReader(m), v2Auth)
+	res, err := d.c.MakeRequest(ctx, "PUT", path, headers, bytes.NewReader(m), V2Auth)
 	if err != nil {
 		return err
 	}
@@ -442,7 +442,7 @@ sigExists:
 		}
 
 		path := fmt.Sprintf(extensionsSignaturePath, reference.Path(d.ref.ref), d.manifestDigest.String())
-		res, err := d.c.makeRequest(ctx, "PUT", path, nil, bytes.NewReader(body), v2Auth)
+		res, err := d.c.MakeRequest(ctx, "PUT", path, nil, bytes.NewReader(body), V2Auth)
 		if err != nil {
 			return err
 		}
diff --git a/docker/docker_image_src.go b/docker/docker_image_src.go
index aedab97318..f064bbe30b 100644
--- a/docker/docker_image_src.go
+++ b/docker/docker_image_src.go
@@ -21,7 +21,7 @@ import (
 )
 
 type dockerImageSource struct {
-	ref dockerReference
+	ref DockerReference
 	c   *dockerClient
 	// State
 	cachedManifest         []byte // nil if not loaded yet
@@ -30,8 +30,8 @@ type dockerImageSource struct {
 
 // newImageSource creates a new ImageSource for the specified image reference.
 // The caller must call .Close() on the returned ImageSource.
-func newImageSource(sys *types.SystemContext, ref dockerReference) (*dockerImageSource, error) {
-	c, err := newDockerClientFromRef(sys, ref, false, "pull")
+func newImageSource(sys *types.SystemContext, ref DockerReference) (*dockerImageSource, error) {
+	c, err := NewDockerClientFromRef(sys, ref, false, "pull")
 	if err != nil {
 		return nil, err
 	}
@@ -89,7 +89,7 @@ func (s *dockerImageSource) fetchManifest(ctx context.Context, tagOrDigest strin
 	path := fmt.Sprintf(manifestPath, reference.Path(s.ref.ref), tagOrDigest)
 	headers := make(map[string][]string)
 	headers["Accept"] = manifest.DefaultRequestedManifestMIMETypes
-	res, err := s.c.makeRequest(ctx, "GET", path, headers, nil, v2Auth)
+	res, err := s.c.MakeRequest(ctx, "GET", path, headers, nil, V2Auth)
 	if err != nil {
 		return nil, "", err
 	}
@@ -116,7 +116,7 @@ func (s *dockerImageSource) ensureManifestIsLoaded(ctx context.Context) error {
 		return nil
 	}
 
-	reference, err := s.ref.tagOrDigest()
+	reference, err := s.ref.TagOrDigest()
 	if err != nil {
 		return err
 	}
@@ -137,7 +137,7 @@ func (s *dockerImageSource) getExternalBlob(ctx context.Context, urls []string)
 		err  error
 	)
 	for _, url := range urls {
-		resp, err = s.c.makeRequestToResolvedURL(ctx, "GET", url, nil, nil, -1, noAuth)
+		resp, err = s.c.makeRequestToResolvedURL(ctx, "GET", url, nil, nil, -1, NoAuth)
 		if err == nil {
 			if resp.StatusCode != http.StatusOK {
 				err = errors.Errorf("error fetching external blob from %q: %d (%s)", url, resp.StatusCode, http.StatusText(resp.StatusCode))
@@ -169,7 +169,7 @@ func (s *dockerImageSource) GetBlob(ctx context.Context, info types.BlobInfo) (i
 
 	path := fmt.Sprintf(blobsPath, reference.Path(s.ref.ref), info.Digest.String())
 	logrus.Debugf("Downloading %s", path)
-	res, err := s.c.makeRequest(ctx, "GET", path, nil, nil, v2Auth)
+	res, err := s.c.MakeRequest(ctx, "GET", path, nil, nil, V2Auth)
 	if err != nil {
 		return nil, 0, err
 	}
@@ -309,7 +309,7 @@ func (s *dockerImageSource) getSignaturesFromAPIExtension(ctx context.Context, i
 }
 
 // deleteImage deletes the named image from the registry, if supported.
-func deleteImage(ctx context.Context, sys *types.SystemContext, ref dockerReference) error {
+func deleteImage(ctx context.Context, sys *types.SystemContext, ref DockerReference) error {
 	// docker/distribution does not document what action should be used for deleting images.
 	//
 	// Current docker/distribution requires "pull" for reading the manifest and "delete" for deleting it.
@@ -317,7 +317,7 @@ func deleteImage(ctx context.Context, sys *types.SystemContext, ref dockerRefere
 	// OpenShift ignores the action string (both the password and the token is an OpenShift API token identifying a user).
 	//
 	// We have to hard-code a single string, luckily both docker/distribution and quay.io support "*" to mean "everything".
-	c, err := newDockerClientFromRef(sys, ref, true, "*")
+	c, err := NewDockerClientFromRef(sys, ref, true, "*")
 	if err != nil {
 		return err
 	}
@@ -327,12 +327,12 @@ func deleteImage(ctx context.Context, sys *types.SystemContext, ref dockerRefere
 	headers := make(map[string][]string)
 	headers["Accept"] = []string{manifest.DockerV2Schema2MediaType}
 
-	refTail, err := ref.tagOrDigest()
+	refTail, err := ref.TagOrDigest()
 	if err != nil {
 		return err
 	}
 	getPath := fmt.Sprintf(manifestPath, reference.Path(ref.ref), refTail)
-	get, err := c.makeRequest(ctx, "GET", getPath, headers, nil, v2Auth)
+	get, err := c.MakeRequest(ctx, "GET", getPath, headers, nil, V2Auth)
 	if err != nil {
 		return err
 	}
@@ -354,7 +354,7 @@ func deleteImage(ctx context.Context, sys *types.SystemContext, ref dockerRefere
 
 	// When retrieving the digest from a registry >= 2.3 use the following header:
 	//   "Accept": "application/vnd.docker.distribution.manifest.v2+json"
-	delete, err := c.makeRequest(ctx, "DELETE", deletePath, headers, nil, v2Auth)
+	delete, err := c.MakeRequest(ctx, "DELETE", deletePath, headers, nil, V2Auth)
 	if err != nil {
 		return err
 	}
diff --git a/docker/docker_transport.go b/docker/docker_transport.go
index 3c67efb4ac..b58dc972d1 100644
--- a/docker/docker_transport.go
+++ b/docker/docker_transport.go
@@ -41,8 +41,8 @@ func (t dockerTransport) ValidatePolicyConfigurationScope(scope string) error {
 	return nil
 }
 
-// dockerReference is an ImageReference for Docker images.
-type dockerReference struct {
+// DockerReference is an ImageReference for Docker images.
+type DockerReference struct {
 	ref reference.Named // By construction we know that !reference.IsNameOnly(ref)
 }
 
@@ -74,12 +74,12 @@ func NewReference(ref reference.Named) (types.ImageReference, error) {
 	if isTagged && isDigested {
 		return nil, errors.Errorf("Docker references with both a tag and digest are currently not supported")
 	}
-	return dockerReference{
+	return DockerReference{
 		ref: ref,
 	}, nil
 }
 
-func (ref dockerReference) Transport() types.ImageTransport {
+func (ref DockerReference) Transport() types.ImageTransport {
 	return Transport
 }
 
@@ -88,14 +88,14 @@ func (ref dockerReference) Transport() types.ImageTransport {
 // NOTE: The returned string is not promised to be equal to the original input to ParseReference;
 // e.g. default attribute values omitted by the user may be filled in in the return value, or vice versa.
 // WARNING: Do not use the return value in the UI to describe an image, it does not contain the Transport().Name() prefix.
-func (ref dockerReference) StringWithinTransport() string {
+func (ref DockerReference) StringWithinTransport() string {
 	return "//" + reference.FamiliarString(ref.ref)
 }
 
 // DockerReference returns a Docker reference associated with this reference
 // (fully explicit, i.e. !reference.IsNameOnly, but reflecting user intent,
 // not e.g. after redirect or alias processing), or nil if unknown/not applicable.
-func (ref dockerReference) DockerReference() reference.Named {
+func (ref DockerReference) DockerReference() reference.Named {
 	return ref.ref
 }
 
@@ -106,7 +106,7 @@ func (ref dockerReference) DockerReference() reference.Named {
 // It is fine for the return value to be equal to StringWithinTransport(), and it is desirable but
 // not required/guaranteed that it will be a valid input to Transport().ParseReference().
 // Returns "" if configuration identities for these references are not supported.
-func (ref dockerReference) PolicyConfigurationIdentity() string {
+func (ref DockerReference) PolicyConfigurationIdentity() string {
 	res, err := policyconfiguration.DockerReferenceIdentity(ref.ref)
 	if res == "" || err != nil { // Coverage: Should never happen, NewReference above should refuse values which could cause a failure.
 		panic(fmt.Sprintf("Internal inconsistency: policyconfiguration.DockerReferenceIdentity returned %#v, %v", res, err))
@@ -119,7 +119,7 @@ func (ref dockerReference) PolicyConfigurationIdentity() string {
 // in order, terminating on first match, and an implicit "" is always checked at the end.
 // It is STRONGLY recommended for the first element, if any, to be a prefix of PolicyConfigurationIdentity(),
 // and each following element to be a prefix of the element preceding it.
-func (ref dockerReference) PolicyConfigurationNamespaces() []string {
+func (ref DockerReference) PolicyConfigurationNamespaces() []string {
 	return policyconfiguration.DockerReferenceNamespaces(ref.ref)
 }
 
@@ -128,29 +128,29 @@ func (ref dockerReference) PolicyConfigurationNamespaces() []string {
 // NOTE: If any kind of signature verification should happen, build an UnparsedImage from the value returned by NewImageSource,
 // verify that UnparsedImage, and convert it into a real Image via image.FromUnparsedImage.
 // WARNING: This may not do the right thing for a manifest list, see image.FromSource for details.
-func (ref dockerReference) NewImage(ctx context.Context, sys *types.SystemContext) (types.ImageCloser, error) {
+func (ref DockerReference) NewImage(ctx context.Context, sys *types.SystemContext) (types.ImageCloser, error) {
 	return newImage(ctx, sys, ref)
 }
 
 // NewImageSource returns a types.ImageSource for this reference.
 // The caller must call .Close() on the returned ImageSource.
-func (ref dockerReference) NewImageSource(ctx context.Context, sys *types.SystemContext) (types.ImageSource, error) {
+func (ref DockerReference) NewImageSource(ctx context.Context, sys *types.SystemContext) (types.ImageSource, error) {
 	return newImageSource(sys, ref)
 }
 
 // NewImageDestination returns a types.ImageDestination for this reference.
 // The caller must call .Close() on the returned ImageDestination.
-func (ref dockerReference) NewImageDestination(ctx context.Context, sys *types.SystemContext) (types.ImageDestination, error) {
+func (ref DockerReference) NewImageDestination(ctx context.Context, sys *types.SystemContext) (types.ImageDestination, error) {
 	return newImageDestination(sys, ref)
 }
 
 // DeleteImage deletes the named image from the registry, if supported.
-func (ref dockerReference) DeleteImage(ctx context.Context, sys *types.SystemContext) error {
+func (ref DockerReference) DeleteImage(ctx context.Context, sys *types.SystemContext) error {
 	return deleteImage(ctx, sys, ref)
 }
 
-// tagOrDigest returns a tag or digest from the reference.
-func (ref dockerReference) tagOrDigest() (string, error) {
+// TagOrDigest returns a tag or digest from the reference.
+func (ref DockerReference) TagOrDigest() (string, error) {
 	if ref, ok := ref.ref.(reference.Canonical); ok {
 		return ref.Digest().String(), nil
 	}
diff --git a/docker/docker_transport_test.go b/docker/docker_transport_test.go
index a9b30230c4..20abb3aa60 100644
--- a/docker/docker_transport_test.go
+++ b/docker/docker_transport_test.go
@@ -59,7 +59,7 @@ func testParseReference(t *testing.T, fn func(string) (types.ImageReference, err
 			assert.Error(t, err, c.input)
 		} else {
 			require.NoError(t, err, c.input)
-			dockerRef, ok := ref.(dockerReference)
+			dockerRef, ok := ref.(DockerReference)
 			require.True(t, ok, c.input)
 			assert.Equal(t, c.expected, dockerRef.ref.String(), c.input)
 		}
@@ -80,7 +80,7 @@ func TestNewReference(t *testing.T) {
 		require.NoError(t, err)
 		ref, err := NewReference(parsed)
 		require.NoError(t, err, c.input)
-		dockerRef, ok := ref.(dockerReference)
+		dockerRef, ok := ref.(DockerReference)
 		require.True(t, ok, c.input)
 		assert.Equal(t, c.dockerRef, dockerRef.ref.String(), c.input)
 	}
@@ -188,9 +188,9 @@ func TestReferenceTagOrDigest(t *testing.T) {
 	} {
 		ref, err := ParseReference(input)
 		require.NoError(t, err, input)
-		dockerRef, ok := ref.(dockerReference)
+		dockerRef, ok := ref.(DockerReference)
 		require.True(t, ok, input)
-		tod, err := dockerRef.tagOrDigest()
+		tod, err := dockerRef.TagOrDigest()
 		require.NoError(t, err, input)
 		assert.Equal(t, expected, tod, input)
 	}
@@ -198,7 +198,7 @@ func TestReferenceTagOrDigest(t *testing.T) {
 	// Invalid input
 	ref, err := reference.ParseNormalizedNamed("busybox")
 	require.NoError(t, err)
-	dockerRef := dockerReference{ref: ref}
-	_, err = dockerRef.tagOrDigest()
+	dockerRef := DockerReference{ref: ref}
+	_, err = dockerRef.TagOrDigest()
 	assert.Error(t, err)
 }
diff --git a/docker/lookaside.go b/docker/lookaside.go
index 860f1ad5e2..52cfeaed14 100644
--- a/docker/lookaside.go
+++ b/docker/lookaside.go
@@ -30,7 +30,7 @@ const builtinRegistriesDirPath = "/etc/containers/registries.d"
 // NOTE: Keep this in sync with docs/registries.d.md!
 type registryConfiguration struct {
 	DefaultDocker *registryNamespace `json:"default-docker"`
-	// The key is a namespace, using fully-expanded Docker reference format or parent namespaces (per dockerReference.PolicyConfiguration*),
+	// The key is a namespace, using fully-expanded Docker reference format or parent namespaces (per DockerReference.PolicyConfiguration*),
 	Docker map[string]registryNamespace `json:"docker"`
 }
 
@@ -45,7 +45,7 @@ type registryNamespace struct {
 type signatureStorageBase *url.URL // The only documented value is nil, meaning storage is not supported.
 
 // configuredSignatureStorageBase reads configuration to find an appropriate signature storage URL for ref, for write access if “write”.
-func configuredSignatureStorageBase(sys *types.SystemContext, ref dockerReference, write bool) (signatureStorageBase, error) {
+func configuredSignatureStorageBase(sys *types.SystemContext, ref DockerReference, write bool) (signatureStorageBase, error) {
 	// FIXME? Loading and parsing the config could be cached across calls.
 	dirPath := registriesDirPath(sys)
 	logrus.Debugf(`Using registries.d directory %s for sigstore configuration`, dirPath)
@@ -143,7 +143,7 @@ func loadAndMergeConfig(dirPath string) (*registryConfiguration, error) {
 
 // config.signatureTopLevel returns an URL string configured in config for ref, for write access if “write”.
 // (the top level of the storage, namespaced by repo.FullName etc.), or "" if no signature storage should be used.
-func (config *registryConfiguration) signatureTopLevel(ref dockerReference, write bool) string {
+func (config *registryConfiguration) signatureTopLevel(ref DockerReference, write bool) string {
 	if config.Docker != nil {
 		// Look for a full match.
 		identity := ref.PolicyConfigurationIdentity()
diff --git a/docker/lookaside_test.go b/docker/lookaside_test.go
index b15d8f224f..2f1ee5b72f 100644
--- a/docker/lookaside_test.go
+++ b/docker/lookaside_test.go
@@ -13,10 +13,10 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func dockerRefFromString(t *testing.T, s string) dockerReference {
+func dockerRefFromString(t *testing.T, s string) DockerReference {
 	ref, err := ParseReference(s)
 	require.NoError(t, err, s)
-	dockerRef, ok := ref.(dockerReference)
+	dockerRef, ok := ref.(DockerReference)
 	require.True(t, ok, s)
 	return dockerRef
 }