diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index 9826ac7655..d91a0cc4b7 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -57,6 +57,7 @@ COPY yum.conf /etc/yum.conf
 
 {% if base_arch == 'x86_64' %}
     {% set base_yum_repo_files = [
+        'crane.repo',
         'elasticsearch.repo',
         'grafana.repo',
         'influxdb.repo',
diff --git a/docker/base/crane.repo b/docker/base/crane.repo
new file mode 100644
index 0000000000..55d7084d72
--- /dev/null
+++ b/docker/base/crane.repo
@@ -0,0 +1,7 @@
+# TODO(mandre) Remove when crane is in centos repos
+# NOTE python-crane package is not signed
+[pulp-2-testing]
+name=Pulp 2 Testing
+baseurl=https://repos.fedorapeople.org/pulp/pulp/testing/automation/2-master/stage/7Server/$basearch/
+enabled=1
+gpgcheck=0
diff --git a/docker/crane/Dockerfile.j2 b/docker/crane/Dockerfile.j2
new file mode 100644
index 0000000000..c9fa12af2a
--- /dev/null
+++ b/docker/crane/Dockerfile.j2
@@ -0,0 +1,68 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+
+{% block crane_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{% if install_type == 'binary' %}
+    {% if base_distro in ['centos', 'rhel'] %}
+
+        {% set crane_packages = [
+                'httpd',
+                'mod_ssl',
+                'mod_wsgi',
+                'mod_xsendfile',
+                'python-crane'
+        ] %}
+
+{{ macros.install_packages(crane_packages | customizable("packages")) }}
+
+RUN sed -i -r 's,^(Listen 80),#\1,' /etc/httpd/conf/httpd.conf \
+    && sed -i -r 's,^(Listen 443),#\1,' /etc/httpd/conf.d/ssl.conf
+
+    {% else %}
+RUN echo 'crane not yet available for {{ base_distro }}' && /bin/false
+    {% endif %}
+
+{% elif install_type == 'source' %}
+    {% if base_distro in ['centos', 'oraclelinux', 'rhel'] %}
+        {% set crane_packages = [
+                'httpd',
+                'mod_ssl',
+                'mod_wsgi',
+                'mod_xsendfile',
+                'python-flask'
+        ] %}
+
+{{ macros.install_packages(crane_packages | customizable("packages")) }}
+
+RUN sed -i -r 's,^(Listen 80),#\1,' /etc/httpd/conf/httpd.conf \
+    && sed -i -r 's,^(Listen 443),#\1,' /etc/httpd/conf.d/ssl.conf
+
+    {% elif base_distro in ['debian', 'ubuntu'] %}
+RUN echo 'crane not yet available for {{ base_distro }}' && /bin/false
+    {% endif %}
+
+{% block crane_source_install_python_pip %}
+RUN curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py \
+    && python get-pip.py \
+    && rm get-pip.py
+{% endblock %}
+
+ADD crane-archive /crane-source
+
+{% set crane_pip_packages = [
+    '/crane'
+] %}
+
+RUN ln -s crane-source/* crane \
+    && {{ macros.install_pip(crane_pip_packages | customizable("pip_packages"), constraints=false) }}
+
+{% endif %}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 755 /usr/local/bin/kolla_extend_start
+
+{% block crane_footer %}{% endblock %}
+{% block footer %}{% endblock %}
diff --git a/docker/crane/extend_start.sh b/docker/crane/extend_start.sh
new file mode 100644
index 0000000000..ada839e961
--- /dev/null
+++ b/docker/crane/extend_start.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# Assume the service runs on top of Apache when user is root
+if [[ "$(whoami)" == 'root' ]]; then
+    # NOTE(pbourke): httpd will not clean up after itself in some cases which
+    # results in the container not being able to restart. (bug #1489676, 1557036)
+    if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then
+        # Loading Apache2 ENV variables
+        . /etc/apache2/envvars
+        rm -rf /var/run/apache2/*
+    else
+        rm -rf /var/run/httpd/* /run/httpd/* /tmp/httpd*
+    fi
+fi
diff --git a/kolla/common/config.py b/kolla/common/config.py
index 18cfe9e3d4..dd190cdbca 100755
--- a/kolla/common/config.py
+++ b/kolla/common/config.py
@@ -323,6 +323,10 @@ SOURCES = {
         'type': 'url',
         'location': ('$tarballs_base/cloudkitty/'
                      'cloudkitty-master.tar.gz')},
+    'crane': {
+        'type': 'git',
+        'reference': 'master',
+        'location': ('https://github.com/pulp/crane.git')},
     'designate-base': {
         'type': 'url',
         'location': ('$tarballs_base/designate/'
diff --git a/kolla/image/build.py b/kolla/image/build.py
index f588484010..9b41dd3a6b 100755
--- a/kolla/image/build.py
+++ b/kolla/image/build.py
@@ -99,7 +99,7 @@ SKIPPED_IMAGES = {
         "tripleoclient",
         # TODO(jeffrey4l): remove tripleo-ui when following bug is fixed
         # https://bugs.launchpad.net/tripleo/+bug/1744215
-        "tripleo-ui"
+        "tripleo-ui",
     ],
     'ubuntu+binary': [
         "almanach-base",
@@ -107,6 +107,7 @@ SKIPPED_IMAGES = {
         "blazar-base",
         "cloudkitty-base",
         "congress-base",
+        "crane",
         "dragonflow-base",
         "ec2-api",
         "freezer-base",
@@ -133,6 +134,7 @@ SKIPPED_IMAGES = {
         "zun-base",
     ],
     'ubuntu+source': [
+        "crane",
         # There is no qdrouterd package for ubuntu bionic
         "qdrouterd",
         "tripleoclient",
@@ -146,6 +148,7 @@ SKIPPED_IMAGES = {
         "blazar-base",
         "cloudkitty-base",
         "congress-base",
+        "crane",
         "dragonflow-base",
         "ec2-api",
         "freezer-base",
@@ -171,6 +174,7 @@ SKIPPED_IMAGES = {
         "zun-base"
     ],
     'debian+source': [
+        "crane",
         "sensu-base",
         "tripleoclient",
         "tripleo-ui"
@@ -179,6 +183,7 @@ SKIPPED_IMAGES = {
         "almanach-base",
         "bifrost-base",
         "blazar-base",
+        "crane",
         "dragonflow-base",
         "freezer-base",
         "karbor-base",
diff --git a/releasenotes/notes/add-crane-image-c6b381b2a6ce62d2.yaml b/releasenotes/notes/add-crane-image-c6b381b2a6ce62d2.yaml
new file mode 100644
index 0000000000..4ba300a771
--- /dev/null
+++ b/releasenotes/notes/add-crane-image-c6b381b2a6ce62d2.yaml
@@ -0,0 +1,3 @@
+---
+features:
+  - Add crane image. Crane is a lightweight 'pull only' container registry implementation.