Container Registry

A Container Registry is a private registry for your container images, in your workspace. It speaks the standard registry API, so docker, Kubernetes and any other OCI client push to it and pull from it. Create one from Managed services → New service, under DevOps & infrastructure, as a public instance: its trusted certificate is issued for its public hostname (see Certificate).

Sizes

A registry keeps its images on its own disk, so it comes in the storage sizes:

Like any instance, a registry counts against your workspace's quota.

Sign in and push

The registry's Connection panel shows its address, the hostname and port together, and its user and password. Sign in with the password on standard input, so it stays out of your shell history:

echo "$REGISTRY_PASSWORD" | docker login images-c3d4.db.sahabti.app:40021 -u images --password-stdin

Tag an image with the registry's address, then push it:

docker tag my-app:1.4 images-c3d4.db.sahabti.app:40021/my-app:1.4
docker push images-c3d4.db.sahabti.app:40021/my-app:1.4

Pull it the same way from anywhere that reaches the address. Every request needs the user and password: the registry refuses anonymous clients.

From a Kubernetes cluster

Give the cluster the credentials as an image pull secret, in the namespace of the pods that pull from the registry:

kubectl create secret docker-registry registry-login \
  --docker-server=images-c3d4.db.sahabti.app:40021 \
  --docker-username=images --docker-password="$REGISTRY_PASSWORD"

Then name the secret in those pods:

spec:
  imagePullSecrets:
    - name: registry-login
  containers:
    - name: web
      image: images-c3d4.db.sahabti.app:40021/my-app:1.4

Certificate

The registry serves TLS only. Shortly after a public registry starts, usually within 15 minutes, the platform installs a publicly trusted certificate for its hostname, renews it before it expires, and lists it on the Certificates page as Managed. Until the first certificate is in place, the registry presents a temporary self-signed one, which docker refuses: wait a few minutes rather than marking the registry insecure.

When a renewed certificate is installed, the registry restarts in a moment, and docker retries a push that was under way. A private registry gets no trusted certificate, so docker does not accept it.

What is kept and what is cleaned up

• Tags stay until you delete them. Nothing you tag is removed for you.
• Untagged images are cleaned up. Pushing a tag again leaves the image it pointed to without a tag. Untagged images are deleted 24 hours later.
• Space comes back daily. A cleanup once a day reclaims the space of deleted images. Layers shared by several images are stored once.

To delete a tag or an image yourself, send the registry API's delete, signed in (DELETE /v2/<repository>/manifests/<digest>), or use a registry client that supports it; its space comes back at the next daily cleanup.

The registry has no web interface: use docker or another registry client.