Skip to main content

Container Registry

You can deploy your apps just by providing the name of an existing Docker image. See Deploy with Image for the full flow.

If your image lives in a private registry (Docker Hub private repo, GHCR, GCR, an internal registry, …) the platform needs credentials to pull it. Those credentials are stored once on the account and selected per app.

Add a Container Registry credential​

Open My Account → Credentials and add a credential of type Container Registry. See Account Credentials for the full walkthrough — the short version is:

  1. Click Add credential.
  2. Pick the type Container Registry, give it a name (it will appear in the App page selects), and fill server / email / username / password.
  3. Save. The credential is encrypted, scoped to the account, and synced to every region you deploy to.

Account Credentials — Container Registry saved

The first Container Registry credential you create is automatically promoted to the account default. Apps that don't pick a registry explicitly use the default. You can promote a different credential later with the Set as default action on the row.

Use the credential at deploy time​

Two places on the App page reference container-registry credentials.

Image pull (image deploys)​

Apps configured with Use image (deploys an existing image) expose a Container registry for runtime pull select right below the Image input. The platform uses the selected credential to authenticate the image pull at deploy time.

App settings — runtime image pull select

Leave it on Use account default to fall back to the account-wide default Container Registry credential.

Build pull (Docker builds from source)​

Apps configured with Build from source show a Custom registry for pulling images in build process card lower on the page. Pick a credential from Container registry for build pull to authenticate base-image pulls during the Docker build.

App settings — build pull select

Builds do not fall back to the account default — leave the select empty if your base images are public.

Pick credentials by name from the dropdowns. Only Container Registry credentials appear there.

Notes​

  • The credentials are only used to download images. Images you build inside the platform are not pushed to your registry.
  • If all your images are public, you don't need a Container Registry credential at all.
  • Rotating a credential is a one-place change — every app referencing it picks up the new value on the next sync.