ITSH Documentation

English

Deutsch

English

Deutsch

Appearance

Container registry ​

registry.itsh.dev is a private OCI registry that comes with your account. Any client that speaks the registry API works: Docker, Podman, Buildah, Kaniko, and the build steps of the common CI systems.

Nothing in it is public, and there is no anonymous read. A pull without credentials fails immediately:

Error response from daemon: unauthorized: authentication required

Enabling it ​

In the portal, go to Container Registry. If it is not enabled yet the page shows Enable Registry and a two-step dialog: Registry Namespace first, then Region.

The account needs a payment method on file before the registry can be enabled. Without one the dialog fails on the last step.

If you claimed a free Kubernetes namespace, none of this applies: the registry was enabled for you at that moment, and unless you had already chosen a Registry Namespace it was given one of the form free-<number>. A registry created that way runs on the free tier's hard storage cap. See Storage and cleanup.

The Registry Namespace ​

It is not your Kubernetes namespace

The portal labels this field Registry Namespace, and it is the segment that appears in every image path: registry.itsh.dev/<your-slug>/<image>:<tag>. Despite the label it has nothing to do with your Kubernetes namespace. Substituting tenant-<number> gives you an ImagePullBackOff.

What the field accepts:

  • Lowercase letters, digits and hyphens only
  • 3 to 40 characters
  • Must start and end with a letter or digit

A handful of names are held back and are reported as already taken: admin, api, registry, system, root, itsh, support, www, mail, ftp, ssh and test.

The namespace freezes on your first push

Once any image is stored under it, the Registry Namespace can no longer be changed, and the portal answers with The namespace can no longer be changed because images are already stored under it. This is deliberate: images are addressed by that prefix, so a rename would leave every existing image unreachable under both the old name and the new one, and would break the pull secrets that reference it. Pick the name you want to keep before you push.

Choosing a region ​

The region field does not place your images

The second step offers three regions. The value is recorded on your registry and cannot be changed afterwards, but registry storage is not split by region today: images are stored in Germany whichever option you pick.

Your first push ​

Create an access token first, under the Access Tokens tab. The username is your Registry Namespace and the password is the token:

bash
echo '<token>' | docker login registry.itsh.dev -u <your-slug> --password-stdin
docker tag my-image:latest registry.itsh.dev/<your-slug>/my-image:1.0.0
docker push registry.itsh.dev/<your-slug>/my-image:1.0.0

Repositories are not created in advance. The first push to a name creates it, and it then appears under Repositories on the Overview tab with its size and pull count. Open it to list its tags. The portal lists repositories without the <your-slug>/ prefix, so a repository pushed as registry.itsh.dev/<your-slug>/my-image is listed as my-image.

Pushes and pulls only ever work under your own prefix. A path that starts with someone else's Registry Namespace is rejected as unauthorized even while you are logged in, because the credentials never carry access to anything outside your own.

What's next ​