Private container registries
Save a pull credential in your workspace, grant it to selected projects, then choose it when deploying a Docker image. Registry access is separate from the GitHub source-code integration.
Add a credential
Open Workspace → Integrations → Container registries. Add a recognizable name and choose the provider. Follow the provider-specific instructions displayed beside the fields and give the account only the image-pull permissions it needs.
Use the registry hostname, with an optional port, without a repository path. The image field supplies the repository and tag separately.
Grant project access
A workspace owner or accepted administrator selects which projects may use the credential and saves project access. A project owner alone cannot grant a workspace credential.
Select it for an application
In Deploy application → Docker image, choose the credential under Registry access. Use the matching registry hostname in Container image. An existing application selects it in Settings → Source and build.
Deploy and verify
Review the image and credential name, then deploy. Infralane checks project authorization and the node’s registry capability before pulling. If a node upgrade is required, update Crane and retry.
Supported credential choices
The form supports Docker Hub, GitHub Container Registry, GitLab, Amazon ECR, Google Artifact Registry, Azure Container Registry, Quay and Docker Registry-compatible custom hosts. Use the current form’s provider instructions for credential format and required pull permissions.
The registry must be reachable from the server and use TLS trusted by its Docker Engine. Adding a credential does not configure a cloud-provider resource pool, disable TLS verification or set up custom certificate trust on the server.
Who can manage access
Workspace writers can add and manage their own credentials. Workspace owners and accepted administrators can manage all workspace credentials and project grants. Project writers can deploy using credentials granted to their project; they do not receive the saved secret.
Granting a credential allows use of images that its registry account can pull. Limit that account’s repository access at the provider before sharing it with a project.
Rotate or remove a credential
Replace the secret when it expires or rotates. Replacement retains project grants and affects future deployments; running containers continue. Saved passwords and tokens are not revealed again.
Removing a grant blocks future authorized pulls and redeployments. It cannot cancel a pull Docker has already accepted. Before deleting a credential used by an application, switch that application to another granted credential or public access.
Pull fails
Confirm the exact image host and tag, project grant, provider pull permission and token expiry. Temporary provider credentials need replacement when they expire. Never put credentials in the image reference, build command, logs or support messages.
Private registry selection is currently a dashboard feature; the MCP interface does not accept registry credentials.