> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xano.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Private Registries

> Supply pull credentials for private images and verify access before you deploy.

If your container image is public, skip this page — Xano pulls it anonymously and nothing needs configuring.

For a private image, switch on the **private image** toggle in the Add Microservice panel. A compact **Authentication method** picker appears with three flows.

## How credentials are handled

Whichever method you choose, the panel assembles a Kubernetes `.dockerconfigjson` **in your browser** and sends it once, on create, as part of the request.

From then on:

* The backend **masks** it. It is never returned to the UI.
* Only a sanitized descriptor comes back — the registry `server`, the credential `type`, and an expiry timestamp where one applies — so the UI can show "credentials configured for this registry" without ever holding the secret.
* Xano provisions a microservice-owned pull secret named after the service, in the form `<identifier>-pull`. For a microservice named `echo-docker` that is `echo_docker-pull`, and it appears in the Summary pane and in the generated XanoScript.

<Warning>
  Because credentials are masked, they cannot be edited back out of the UI. To change them, re-enter them.
</Warning>

## Authentication methods

<Tabs>
  <Tab title="Docker / v2">
    **Use for:** Docker Hub, GHCR, GitLab, Quay, or any Docker v2 registry.

    Provide a **username** and a **password or access token**. Prefer an access token over an account password wherever the registry offers one.

    The **registry host** is derived from the image automatically — `index.docker.io` when the image has no host prefix. It stays editable, and auto-derivation stops as soon as you edit it by hand, so a later change to the image won't overwrite a host you set deliberately.
  </Tab>

  <Tab title="Google Artifact Registry">
    **Use for:** Google Artifact Registry and the older Google Container Registry.

    Paste a **service-account JSON key** with read access to the repository. The panel encodes it as the `_json_key` user the registry expects.

    As with the Docker flow, the **registry host** is derived from the image (defaulting to `us-docker.pkg.dev`) and remains editable.

    <Tip>
      Grant the service account the narrowest role that works — Artifact Registry Reader is enough to pull.
    </Tip>
  </Tab>

  <Tab title="AWS ECR">
    **Use for:** Amazon Elastic Container Registry.

    Paste the contents of your `~/.docker/config.json`, as produced by `aws ecr get-login-password` piped into `docker login`. The panel keeps **only** the ECR entries — hosts containing `ecr.aws` or `amazonaws.com` — and discards everything else, so an unrelated Docker Hub login sitting in the same file is not sent to Xano.

    The registry host comes from the pasted file rather than being derived from the image, so the host field does not auto-sync for this method.

    <Warning>
      **ECR tokens are short-lived.** An ECR login is valid for roughly 12 hours. Once it expires, Xano can no longer pull the image, and a redeploy or a pod restart will fail with an image-pull error. The panel surfaces this warning when you pick the method.

      For long-running services, plan on re-entering credentials, or use a registry with long-lived credentials.
    </Warning>
  </Tab>
</Tabs>

## Testing image access

**Test image access** probes the registry from the backend and reports the result inline, before you create anything. The same verdict appears as a chip in the Summary pane.

It works with or without credentials — an anonymous probe is exactly how you confirm a public image is reachable.

| Verdict           | What it means                                                                         | What to do                                                                       |
| ----------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| **Pullable**      | The image was found and can be pulled with the credentials supplied (or anonymously). | Proceed.                                                                         |
| **Auth required** | The registry answered, but rejected or demanded credentials.                          | Add credentials, or check the ones you entered — then re-test.                   |
| **Not found**     | The registry answered, but has no such image or tag.                                  | Check the repository path and the tag. A missing tag is the usual cause.         |
| **Unreachable**   | The registry could not be contacted at all.                                           | Check the host, and whether the registry is reachable from outside your network. |
| **Blocked**       | The registry host is not permitted.                                                   | Use an allowed registry, or talk to your Xano representative.                    |

<Tip>
  Running this before your first deploy turns the most common failure — a container stuck in `ImagePullBackOff` — into an answer you get in a second, rather than something you diagnose from pod status after a failed rollout.
</Tip>

## Helm charts from private registries

Charts use the same credential flows and have their own probe. **Test chart access** returns the same five verdicts, worded for charts: *Chart found & pullable*, *Chart or version not found*, *Couldn't reach the chart registry*, and so on.


## Related topics

- [Creating a Microservice](/enterprise/enterprise-features/microservices/workspace-microservices/creating-a-microservice.md)
- [Microservices in the Workspace](/enterprise/enterprise-features/microservices/workspace-microservices.md)
- [Microservices](/enterprise/enterprise-features/microservices.md)