Use private registries

A container service whose image lives in a private registry needs credentials. A team admin stores them once for the team; every Sync and every pod of the team's container services uses them. Public images need none.

Add a registryCopy Anchor Link

Only team admins see and change the registries.

1. Open team Settings → Container registries and click Add registry.
2. Fill in the form:
   • Name: what it is, for example GitHub packages.
   • Address: the host with an optional port and path, without a scheme: ghcr.io, ghcr.io/acme or registry.example.com:5000/team. Docker Hub is docker.io.
   • Username and Password or token: a read-only token is enough.
3. Click Add registry.

The token is stored sealed and never shown again. It is not checked when you save; the next Sync reports a refused pull as a blocker.

Which registry a Sync usesCopy Anchor Link

A Sync resolves each image with the registry whose address matches it best, and the service's pods pull with the same credentials. With both ghcr.io and ghcr.io/acme registered, ghcr.io/acme/app uses the second.

Change or remove a registryCopy Anchor Link

Edit changes the name, address or user; leave the password empty to keep the stored one. A new host needs the password again: the stored one is only sent to the host it was entered for.

Remove deletes the credentials. Images from that address are pulled without credentials after the next reconcile; running pods keep their image.

When a pull is refusedCopy Anchor Link

The Sync review blocks with image-unavailable at the service's image and names the image and the reason. Check:

• the address of the registry matches the image's prefix,
• the token can read the repository,
• the image and tag or digest exist.

Your installation may also allow only some registries; ask your administrator which.

Next stepsCopy Anchor Link