Image registry

Included from Basic tier

An image registry is one catalog record for an image store — where a built image is pushed: any OCI registry, GitHub Container Registry, ECR, ACR, Artifact Registry, an Azure compute gallery, or an AWS account and region as the AMI store. One record per credential: the record is the unit of custody and binding, repository the prefix beneath which a step names the image. Actions reference it as image-registry://<code>; dispatch mints a short-lived login where the kind defines one and writes a docker-style config for the step's lifetime. Served by the v2 ImageRegistryService: ListImageRegistries, GetImageRegistry, CreateImageRegistry, UpdateImageRegistry, DeleteImageRegistry, TestImageRegistry, BindImageRegistry and UnbindImageRegistry (admin-only; every write is audited). Bindings use the shared ImageProviderBinding record (opschain docs resources/image_build_provider).

ImageRegistry

ImageRegistry is one registered image store. The credential is never a field: reads carry credential_set and credential_ref only.

Field	Type	Meaning
bound_paths	array of string	The estate subtrees the registry is bound to, sorted; empty means it is usable nowhere until bound.
code	string	The estate code actions reference as image-registry://<code>.
created_at	timestamp	When the record was created.
credential_kind	string	What the reference holds, per kind: basic / token (oci), github_connection / token (ghcr), assume_role / access_key (ecr, ami), service_principal / service_principal_cert (acr, gallery), service_account_key / workload_identity (gar).
credential_ref	string	The secret-vault:// reference the credential lives at — an address, never a value. Empty when the credential is held encrypted at rest on the record and for a ghcr record on a GitHub connection.
credential_set	boolean	Whether a credential is held — a pinned reference or an inline value encrypted at rest (the value is write-only).
description	string	Free-text description.
display_name	string	Human-readable display name.
enabled	boolean	Disabled registries refuse at dispatch by name.
github_connection	string	The GitHub connection code a ghcr record on the github_connection form pushes through; the installation token is minted at dispatch. Empty otherwise.
host	string	The registry host (fixed to ghcr.io for ghcr), or the gallery / account identifier for the machine-image kinds.
id	string	The record's identity.
kind	string	oci, ghcr, ecr, acr, gar, gallery or ami.
last_test_at	timestamp	When the probe last ran; unset until the first test.
last_test_error	string	Why the last probe failed; empty on success. Never credential material.
last_test_success	boolean	Whether the last probe succeeded.
repository	string	The repository path prefix inside the registry (payments, platform/web); the step names only the image name and tag beneath it.
ssl_ca_cert	string	A CA trust anchor for a private registry: a PEM block inline or a certificate file path on the server host; empty uses the system roots.
ssl_verify	boolean	Whether the registry's TLS certificate is verified (default true).
updated_at	timestamp	When the record was last updated.

Write fields

CreateImageRegistryRequest and UpdateImageRegistryRequest carry the record's fields plus:

Field	Type	Meaning
bind_path	string	On create: the first binding, declared in the same call — / or a node path.
credential	string	The credential value, write-only: held encrypted at rest on the record (clearing any reference) and never echoed. Exactly one of credential or credential_ref carries it, except for the github_connection form (the connection is named instead) and workload_identity (no secret).
scope_path	string	On bind and unbind: the subtree the binding covers.

TestImageRegistryResponse carries success and failure_reason (empty on success; never credential material).

Related pages

• opschain docs image-builds — the component page.
• opschain docs resources/image_build_provider — the build-provider record and the shared binding record.
• opschain docs cli/admin-image-registries — the CLI manual.
• opschain docs resources/github_connection — the connection a ghcr registry pushes through.