Registry connections
You do not have to move your container images into the platform. Connect the OCI registries you already use, browse their repositories, and pin the exact images you want to ship. Devices never receive your registry credentials.
Connecting a registry
A connection is identified by its registry host — for example ghcr.io,
quay.io, registry.example.com:5000, or Docker Hub. If you paste a browser URL,
it is reduced to the host. Docker Hub's various web and CLI hostnames all resolve
to the registry that serves the distribution API, and single-name official images
(nginx) are expanded to their canonical path (library/nginx), matching the
docker CLI.
Connections come in a few provider shapes:
| Provider | Credentials | Typical registries |
|---|---|---|
| Static username + token | Stored, encrypted at rest | GHCR, Quay, Harbor, JFrog, ACR, Docker Hub |
| Anonymous | None | Public registries |
| Cloud service account | A provider config, exchanged for a short-lived token at pull time | Google Artifact Registry |
| Cloud role | A role configuration, exchanged for a short-lived token at pull time | AWS ECR |
For the cloud providers, the platform exchanges your stored configuration for a short-lived token at pull time and caches it per host until shortly before it expires — your long-lived secret is never handed downstream. Stored tokens and configs are sealed; the API never returns them, and a listing shows only the host, username, and provider.
Even an anonymous public registry must be explicitly connected. That connection is what authorizes the platform to pull from a host on your behalf.
Browse and import
Once a registry is connected, you can browse a repository's tags and then pin the ones you want as signed artifacts.
- Browsing lists a repository's tags, following the registry's pagination and telling you when a very large repository has been clipped — it never implies the list is complete when it isn't. Tags are ordered newest-likely-first as a best-effort convenience; registries don't return push dates with tag lists.
- Importing resolves each chosen tag to the digest it currently points at and freezes the artifact to that digest. Tags are for finding; digests are for shipping. A batch import reports its outcome per tag, so a single bad tag never fails the rest.
The pull-through facade
Connecting a registry does not copy images into the platform, and it does not push credentials to devices. At rollout time, devices pull the image through the platform — a facade — by digest, authenticating with their own mutual-TLS device identity. The control plane is the only party that talks to your upstream registry; the device only ever knows it is fetching a specific, signed digest.
This keeps the trust boundary clean: your registry secret lives in one place, every device authenticates as itself, and what reaches the device is verified against the signed update metadata before anything is applied. See Zero-trust architecture and Device identity.