Skip to main content

Private Container Registries & OCI Credentials

Deploying proprietary robotics code, physical AI perception models, and enterprise software to edge machines requires pulling container images from authenticated OCI registries.

Admiral provides native credential management for private container registries, ensuring edge devices securely authenticate without embedding secrets into image specs or filesystem configs.

Supported OCI Registries​

Admiral seamlessly authenticates with all standard OCI container registries:

  • GitHub Packages (GHCR): ghcr.io
  • Amazon Web Services (AWS ECR): {account}.dkr.ecr.{region}.amazonaws.com
  • Google Cloud Artifact Registry (GCR / GAR): {region}-docker.pkg.dev
  • Docker Hub: docker.io
  • Azure Container Registry (ACR): {registry}.azurecr.io
  • Self-Hosted Registries: Harbor, Quay, Nexus, or internal distribution registries.

Adding Registry Credentials​

Registry credentials are created via the web dashboard under Settings > Registry Credentials or via the REST API:

POST /v1/registry-credentials
Content-Type: application/json
X-Organization-ID: {orgId}

{
  "name": "Production GitHub Container Registry",
  "registry": "ghcr.io",
  "auth_type": "token",
  "username": "admiral-deploy-bot",
  "secret": "ghp_xxxxxxxxxxxxxxxxxxxx"
}

Security & Secret Isolation​

  • Encrypted at Rest: All credential secrets and personal access tokens (PATs) are encrypted at rest using AES-256-GCM.
  • Ephemeral Device Token Minting: Devices pulling images receive short-lived, cryptographically scoped pull tokens directly from Admiral Cloud over The Admiral Mesh. Long-term registry secrets are never stored on the edge device's persistent storage.
  • Zero Secret Leakage: Registry credentials never appear in plain text in logs, configuration specifications, or edge filesystem dumps.

Attaching Credentials to Workloads​

Once registered, attach the credential to your container workload specification in your configuration:

schemaVersion: 1
workloads:
  - name: autonomous-navigation
    image: ghcr.io/org/robotics/autonomy:v2.14.0
    registryCredentialId: "cred_88f9a12c-production-ghcr"
    restartPolicy: always
    hostNetwork: true

When the device receives the workload configuration, the Admiral init supervisor requests a temporary pull grant, authenticates with ghcr.io, pulls and verifies the image layers, and executes the container.