Registries

The registries section describes the container registries up pulls base images from and pushes build output to. Services reference registries by name, not by ID: source.registry and build.output_registry point at the name you give here.

For background on what a registry is and how to get one, see the Registries concept.

registries:
  - name: ghcr
    host: ghcr.io
    username: deploy-bot
    password: $GHCR_TOKEN

name

The unique name that sources and builds use to reference this registry. Required.

name: ghcr

host

The registry hostname, for example ghcr.io or registry.example.com. Required.

host: ghcr.io

username

The registry username. Leave empty for public registries.

username: deploy-bot

password

The registry password or token. It may be a literal value or a $VAR reference resolved from the environment at apply time. Credentials are never written to logs or error messages.

password: $GHCR_TOKEN

Default registry

Exactly one registry is the default push target. Build output goes to the default registry when the service’s build.output_registry is not set. Change the default with up registry set-default:

up registry set-default ghcr

Verification on add

Adding a registry runs a reachability, authentication, and push check before the registry is registered. Skip it with --no-verify on up registry add:

up registry add registry.example.com --no-verify

Removing a registry with up registry remove is refused while services still reference it:

up registry remove old-registry --force

--force detaches the referencing services first.