> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slipway.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Private registries

> Pull private container images by storing credentials once per organization.

If your spec references a private image, either as `image:` or as a base image in a
Dockerfile, slipway needs credentials to pull it. Configure them once at the organization
level. No per-service configuration is needed.

## Adding a registry

Open **Settings → Registries**, select **Add registry**, and enter the host, username and
password or token. slipway stores the credentials encrypted, alongside the organization's
other secrets.

## How they are used

At deploy time slipway wires every registry you have configured into both the build and the
running container, so private base images and prebuilt private images both pull.

The deploy records a `registries_resolved` event listing the hosts wired up for that run.

You do not reference a registry from the spec. Matching is by host.

## Common registries

| Registry | Hostname | Username | Password |
| - | - | - | - |
| Docker Hub | `index.docker.io` | Your Docker Hub username | A Docker Hub access token |
| GitHub Container Registry | `ghcr.io` | Your GitHub username | A personal access token with `read:packages` |
| Amazon ECR | `<acct>.dkr.ecr.<region>.amazonaws.com` | `AWS` | The output of `aws ecr get-login-password` |
| Google Artifact Registry | `<region>-docker.pkg.dev` | `_json_key` | The full JSON of a service-account key |
| Azure Container Registry | `<name>.azurecr.io` | Your service principal ID or admin user | The matching password |

> [!WARNING]
>
> Amazon ECR tokens expire every 12 hours, so a stored `get-login-password` value needs
> rotating twice a day. GHCR and Docker Hub issue long-lived credentials instead.

## Permissions

| Role | View hosts | View passwords | Create, update, delete |
| - | - | - | - |
| Viewer | Yes | No | No |
| Developer | Yes | No | No |
| Admin | Yes | No | Yes |
| Owner | Yes | No | Yes |

## Troubleshooting

If a pull fails, check the host in the credential matches the host in the image reference
exactly. `docker.io/acme/api` needs a credential for `index.docker.io`.

See [Troubleshooting a deploy](/deploys/troubleshooting#the-image-cannot-be-pulled).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.