opschain admin image-registries create

Included from Basic tier

Registers an image registry. The code (the estate identifier actions reference as image-registry://<code>) and the kind are immutable after create; everything else can change through the update verb. Supply the credential as a secret-vault:// reference to pin (--credential-ref, resolved at write time — an unresolvable reference refuses by name), or inline through --credential-env (the name of an environment variable holding it) or --credential-prompt (a no-echo prompt), never on the command line: an inline value is held encrypted at rest on the record itself (never written into a vault), and credential_ref stays empty.

opschain admin image-registries create acr-payments \
  --kind acr --host limebankpayments.azurecr.io --repository payments \
  --credential-kind service_principal \
  --credential-ref secret-vault://payments/acr/push-sp \
  --bind /projects/payments
Created image registry acr-payments (kind acr, limebankpayments.azurecr.io)
Bound to /projects/payments

A record is usable nowhere until it is bound: --bind <path> declares the first binding in the same call — / for estate-wide, or a node path such as /projects/web — and the verb says so when none was declared.

One record per credential: a registry whose one credential covers many repositories is one record with --repository as the prefix. The ghcr kind's host is fixed to ghcr.io and its repository is the GitHub owner or organisation; with --credential-kind github_connection the record names an existing GitHub connection instead of a stored token, so pushes get the same just-in-time installation token github-app:// references do (requires the integrations:github entitlement at dispatch) — a token form (a personal access token) stays available. The stored forms: basic is user:password; token a bearer token; assume_role JSON with role_arn, access_key_id, secret_access_key and optionally external_id; access_key JSON with access_key_id, secret_access_key; service_principal JSON with client_id, client_secret, tenant_id; service_principal_cert JSON with client_id, tenant_id, certificate; service_account_key the service-account key file's JSON. workload_identity holds no secret.

Flags

Flag	Meaning
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
--kind <kind>	Registry kind: oci, ghcr, ecr, acr, gar, gallery or ami. Immutable after create.
--bind <path>	Declare the first binding in the same call: / (estate-wide) or a node path.
--display-name <name>	Human-readable registry name.
--description <text>	What this registry holds.
--host <host>	The registry host (fixed to ghcr.io for ghcr — leave it empty; the gallery or account identifier for gallery and ami). Required otherwise.
--repository <prefix>	The repository path prefix inside the registry (payments, platform/web); the step names only the image name and tag beneath it.
--credential-kind <form>	What the credential holds: basic / token (oci), github_connection / token (ghcr), assume_role / access_key (ecr, ami), service_principal / service_principal_cert (acr, gallery), service_account_key / workload_identity (gar). Validated against the kind.
--credential-ref <ref>	secret-vault:// reference to pin as the credential (mutually exclusive with the inline channel).
--github-connection <code>	The GitHub connection a ghcr registry pushes through (--credential-kind github_connection): the connection's App must hold the packages write permission; the installation token is minted at dispatch.
--ssl-verify	Verify the registry's TLS certificate (default true; --ssl-verify=false is an explicit opt-out).
--ssl-ca-cert <path-or-pem>	CA trust anchor for a private registry: a PEM block inline or a certificate file path on the server host.
--enabled	Whether dispatch may resolve this registry (default true).
--credential-env <name>	Environment variable holding the credential value (never the value itself on argv).
--credential-prompt	Prompt for the credential value without echo.

See also

• opschain docs cli/admin-image-registries-update — rotation and enable/disable.
• opschain docs cli/admin-image-registries-bind — further bindings.