Container Registries
Registry credentials allow Outcron to pull private container images when running container-type jobs.
Supported Registries
Any Docker-compatible registry is supported:
- Docker Hub (
docker.io) - GitHub Container Registry (
ghcr.io) - AWS ECR (
*.dkr.ecr.*.amazonaws.com) - Google Artifact Registry (
*-docker.pkg.dev) - Azure Container Registry (
*.azurecr.io) - Self-hosted registries
Creating a Credential
Navigate to Jobs > Registries and provide:
| Field | Description |
|---|---|
| Name | A label to identify this credential |
| Registry | The registry hostname (e.g., ghcr.io) |
| Username | Registry username |
| Password | Registry password or access token |
Passwords are encrypted at rest using AES-256-GCM.
Using with Jobs
When creating or editing a container job, select a registry credential from the dropdown. The executor will authenticate with the registry before pulling the image.
If no credential is configured, the executor pulls anonymously (suitable for public images). When a private registry credential is selected, the executor logs in before checking whether a cached image can be reused, so private images do not run from a stale unauthenticated cache.
Best Practices
- Use access tokens or service account credentials instead of personal passwords.
- Create separate credentials per registry or per team for easy rotation.
- Rotate credentials regularly — create or update the replacement in Outcron, move jobs to the new credential, verify a pull, then revoke the old credential.