Push and pull

kupe registry login signs Docker in to your tenant’s registry with your Kupe account. The credential lasts 12 hours. Members with the admin role can push and pull; readonly members can pull. Each member can hold up to 5 login sessions at a time, and a new login revokes their oldest.

A login session belongs to a person, so sign in with kupe auth login first. If the CLI is using an API key, the registry refuses the login with session_requires_user. For automation, use an access token instead.

Docker

kupe registry login
docker build -t registry.kupe.cloud/acme/api:1.0.0 .
docker push registry.kupe.cloud/acme/api:1.0.0

Replace acme with your tenant name. Your first push to api creates the repository; a name with slashes, such as team-a/api, works the same way.

The CLI stores the credential the way docker login would: through the credential helper your Docker configuration names for the registry (credHelpers, then credsStore), or, when there is none, in the configuration file itself, with a warning. The file is $DOCKER_CONFIG/config.json, or ~/.docker/config.json; --docker-config DIR uses DIR/config.json.

When the session expires, Docker reports unauthorized. Run kupe registry login again.

To sign out, run kupe registry logout. It removes the credential from Docker and revokes your own live login sessions on every machine you signed in on. Access tokens are not touched.

Podman and other clients

--no-store -o json prints the server, username, password and expiry, and stores nothing. Pass them to any client that reads a password on standard input:

creds=$(kupe registry login --no-store -o json)
jq -r .password <<<"$creds" | podman login registry.kupe.cloud \
  --username "$(jq -r .username <<<"$creds")" --password-stdin
podman push registry.kupe.cloud/acme/api:1.0.0

Helm charts

Helm keeps its own registry credentials, so sign Helm in with the same credential, then push the packaged chart:

creds=$(kupe registry login --no-store -o json)
jq -r .password <<<"$creds" | helm registry login registry.kupe.cloud \
  --username "$(jq -r .username <<<"$creds")" --password-stdin
helm package ./chart
helm push mychart-0.1.0.tgz oci://registry.kupe.cloud/acme/charts

The chart is stored in the repository charts/mychart, and the registry lists it as type chart. Install it from there:

helm install mychart oci://registry.kupe.cloud/acme/charts/mychart --version 0.1.0

Multi-platform images

Kupe’s nodes are x86 (linux/amd64). An image built on an Apple silicon Mac is linux/arm64 unless you ask for another platform, so build for the nodes, or for both:

docker buildx build --platform linux/amd64,linux/arm64 \
  -t registry.kupe.cloud/acme/api:1.0.0 --push .

A multi-platform image is stored as one index that points to one image per platform, and the image list shows it as one item of type index with its platforms. See Managing images.

Pull by digest

A tag can be moved by the next push to it. Pull by digest to get exactly the image you tested:

kupe registry image get api:1.0.0
docker pull registry.kupe.cloud/acme/api@sha256:<digest>

kupe registry image get prints the image’s digest and its pull references by digest and by tag. The console shows the same on the image’s page.

Pull from a cluster

Pods in your clusters pull without signing in: connect the cluster once and every pod in it can pull from the registry, with no imagePullSecrets. See Connect a cluster.

Use an access token instead

A CI pipeline or a tool that runs without a person signed in uses an access token. It signs in with a username and secret:

printf '%s' "$KUPE_REGISTRY_TOKEN" | docker login registry.kupe.cloud \
  --username "$KUPE_REGISTRY_USERNAME" --password-stdin

See Access tokens and CI.