Skip to main content
If your container image is public, skip this page — Xano pulls it anonymously and nothing needs configuring. For a private image, switch on the private image toggle in the Add Microservice panel. A compact Authentication method picker appears with three flows.

​
How credentials are handled

Whichever method you choose, the panel assembles a Kubernetes .dockerconfigjson in your browser and sends it once, on create, as part of the request. From then on:
  • The backend masks it. It is never returned to the UI.
  • Only a sanitized descriptor comes back — the registry server, the credential type, and an expiry timestamp where one applies — so the UI can show “credentials configured for this registry” without ever holding the secret.
  • Xano provisions a microservice-owned pull secret named after the service, in the form <identifier>-pull. For a microservice named echo-docker that is echo_docker-pull, and it appears in the Summary pane and in the generated XanoScript.
Because credentials are masked, they cannot be edited back out of the UI. To change them, re-enter them.

​
Authentication methods

Use for: Docker Hub, GHCR, GitLab, Quay, or any Docker v2 registry.Provide a username and a password or access token. Prefer an access token over an account password wherever the registry offers one.The registry host is derived from the image automatically — index.docker.io when the image has no host prefix. It stays editable, and auto-derivation stops as soon as you edit it by hand, so a later change to the image won’t overwrite a host you set deliberately.

​
Testing image access

Test image access probes the registry from the backend and reports the result inline, before you create anything. The same verdict appears as a chip in the Summary pane. It works with or without credentials — an anonymous probe is exactly how you confirm a public image is reachable.
Running this before your first deploy turns the most common failure — a container stuck in ImagePullBackOff — into an answer you get in a second, rather than something you diagnose from pod status after a failed rollout.

​
Helm charts from private registries

Charts use the same credential flows and have their own probe. Test chart access returns the same five verdicts, worded for charts: Chart found & pullable, Chart or version not found, Couldn’t reach the chart registry, and so on.