A registry in Bahriya is a set of credentials for a private container image registry. Any OCI-compliant registry is supported. It allows Bahriya to pull your container images during deployment.
When you need a registry
You only need to add a registry if your container image is in a private registry that requires authentication. Common examples:
- A private repository on Docker Hub
- GitHub Container Registry (ghcr.io) with a private image
- GitLab Container Registry
- AWS Elastic Container Registry (ECR)
- Your own self-hosted registry
If your image is publicly accessible (e.g. nginx:latest on Docker Hub), no registry entry is needed — Bahriya can pull it directly.
What you configure
| Field | Description |
|---|
| Handle | A unique identifier for this registry (e.g. my-dockerhub). Used to reference the registry when creating containers. |
| Server | The registry hostname (e.g. docker.io, ghcr.io, registry.gitlab.com). |
| Username | The username or access token name used to authenticate. |
| Password | The password or access token value. Stored encrypted. |
How credentials are used
Registry credentials are encrypted using AES-256 and stored in Bahriya. During deployment, Bahriya decrypts the credentials inside a secure, isolated environment and configures the cluster to authenticate with your registry when pulling images.
The credentials never leave the Bahriya infrastructure in plaintext — decryption happens only at deployment time and the plaintext is discarded immediately after the cluster has been configured.
Linking a registry to a container
When creating or editing a container, you select a registry from the ones you have added. The container then uses those credentials to pull its image.
A single registry can be used by multiple containers within the same project.
Registry regions
Registry credentials are applied to every region where the container runs. If your container is deployed to three regions, Bahriya configures authentication in all three automatically — you do not need to do anything extra.
Updating credentials
If your registry credentials change (e.g. you rotate an access token), update the registry entry in Bahriya. The next deployment of any container using that registry will pick up the new credentials.
Deleting a registry
Deleting a registry removes its credentials from all regions. Any container still referencing it will fail to pull its image on the next deployment. Unlink the registry from all containers before deleting it.
