Container Registries

Why Connect a Registry?

By default, you deploy to Staxa by linking a GitHub repository. But if you already have pre-built container images in a private registry, you can deploy those directly without rebuilding.

Supported registry providers:

• Docker Hub: username + access token
• GitHub Container Registry (GHCR): username + personal access token (PAT)
• AWS Elastic Container Registry (ECR): access key ID + secret access key + region
• Google Container Registry / Artifact Registry (GCR/GAR): service account JSON key

Private registries are included on paid plans: 1 on Starter, 3 on Growth, and unlimited on Scale. On Free you can deploy public images and GitHub repositories.

Adding Registry Credentials

1. Navigate to Settings → Container Registries
2. Click Add Registry
3. Step 1: Choose a provider and enter a display name
4. Step 2: Enter your credentials (varies by provider)
5. Click Save

After saving, Staxa verifies the credentials by attempting to authenticate with the registry. A green checkmark indicates successful verification.

Using Registry Images

When creating a tenant, choose "Container Image" as the source type for your service, then:

1. Select the registry from the dropdown (shows all verified registries)
2. Browse available repositories. Staxa proxies the repository list through the Go API
3. Select a repository and tag
4. The image URL is automatically populated

Credential Security

• Registry credentials (passwords, tokens, service account keys) are encrypted with AES-256-GCM at rest
• When a deployment pulls from your registry, Staxa creates a Kubernetes docker-registry Secret in the tenant namespace
• These Secrets persist in the namespace because Kubernetes needs them for Pod restarts and image re-pulls
• You can update or delete credentials at any time from the registries settings page

ECR Token Refresh

AWS ECR uses temporary auth tokens that expire after 12 hours. Staxa handles this automatically: the platform refreshes ECR tokens before they expire, using the access key and secret you provided. The token TTL is configurable at the platform level.