Connecting a registry

A registry connection holds the credential Interopt pulls your images with. Add one from Settings → Integrations → Container registries. Connecting a registry needs the owner or admin role.

Every connection only needs to read images. A credential is checked the first time Interopt lists or pulls an image with it, and the connection then shows Connected or the registry's refusal.

Docker Hub

Create a personal access token with Read-only access in Docker Hub's account settings, and enter it with your Docker Hub username.

Public images can be pulled without a connection, but anonymous pulls share Docker Hub's rate limit with every other anonymous pull from Interopt's address, so connect an account for the images you track.

GitHub Container Registry

Create a classic personal access token with only the read:packages scope, and enter it with the GitHub username that owns it. The account needs read access to the packages.

GitHub Container Registry does not accept fine-grained tokens or GitHub App tokens for pulls, so the GitHub code host connection can't be used here.

GitLab

Either:

• A deploy token with the read_registry scope, created on the project or group. Enter its username and token. This is the narrowest credential.
• The workspace's GitLab connection. It pulls as the connected account, from every project that account can read.

For a self-managed GitLab, enter your instance's registry host.

Quay

Create a robot account with Read permission on the repositories to scan, and enter the robot's name and token.

Other OCI registries

Harbor, Nexus, JFrog Artifactory, a self-hosted Distribution registry, or any other registry that speaks the OCI distribution API. Enter the registry host and either a username and password or token, or a bearer token.

The registry must be reachable over the internet. Private network addresses are refused. If the registry only accepts listed addresses, allow the address shown on the Container registries page.

Amazon ECR

ECR images are pulled through a connected AWS account. Pulling reads image contents, which the read-only posture role never does, so it is a separate permission you add on purpose:

• CloudFormation: update the Interopt stack to the latest template and set ContainerImagePull to true. To allow only some repositories, list their ARNs in ImagePullRepositoryArns; by default every repository in the account can be pulled.
• Terraform: set image_pull = true, and optionally image_pull_repository_arns.
• A role you made by hand: add the policy in manual-image-pull-policy.json, published with the Interopt templates, to the InteroptScan role.

The permission adds ecr:GetAuthorizationToken, which AWS only grants account-wide, and ecr:BatchGetImage, ecr:GetDownloadUrlForLayer, ecr:BatchCheckLayerAvailability and ecr:ListImages on the chosen repositories. Then add a connection of type Amazon ECR, choose the account, and enter the registry host, such as 123456789012.dkr.ecr.eu-west-1.amazonaws.com.

Google Artifact Registry

Images in Artifact Registry, and Container Registry hosts such as gcr.io, are pulled through a connected Google Cloud project. Grant roles/artifactregistry.reader to the workspace's Interopt service account, on the project or only on the repositories to scan. Then add a connection of type Artifact Registry, choose the project, and enter the registry host, such as europe-west4-docker.pkg.dev.

Azure Container Registry

ACR images are pulled through a connected Azure tenant. Assign the AcrPull role on the registry to the app registration you connected Azure with. Then add a connection of type Azure Container Registry, choose the subscription, and enter the registry host, such as acmeprod.azurecr.io.

How credentials are used

Credentials are stored encrypted. The job that pulls an image receives a credential for that one registry, only while it runs, and refuses to send it to any other host. For ECR, Artifact Registry and ACR, Interopt mints a short-lived registry token from your cloud connection each time; the cloud credential itself never reaches the job.