Private registries

Images from public registries (Docker Hub, ghcr.io for public packages) are pulled without a login. If you build your own images and publish them privately, the server needs a login to pull them.

Adding a login

On Integrations > Registries:

1. Enter the registry host, for example ghcr.io.
2. Enter the username and the token. Use a read-only token: on GitHub a fine-grained personal access token or an organisation token with only read:packages.
3. Click save. The login is tried against the registry first; a wrong token is refused and never stored.

One login per registry host. The login is applied again at every start of the portal software, so deploys keep working after an update. Removing it logs the server out of that registry; deploys of private images then fail.

In the compose file

Simply refer to the full image path:

services:
  app:
    image: ghcr.io/your-organisation/your-app:1.4.2

With a fixed version you know what runs. If you want the newest version automatically, use a moving tag and switch Nightly update on.

Through the API and an assistant

list_registries shows which logins exist (never the secrets); set_registry_credential and remove_registry_credential manage them (scopes registries.read and registries.manage). Those scopes are not in the recommended set for assistants: a registry token is a credential, and you would rather not let an assistant manage those.