registry create
Store a login for a private registry.
Stores a login for a private registry.
Prefer --password-stdin, which keeps the password out of the process list and out
of shell history. A credential added now is used by the next deployment; an
application already running keeps pulling with whatever it had.
Usage
outplane registry create <NAME> [flags]Arguments
| Argument | Type | Description |
|---|---|---|
NAME | string | What to call this credential here. Required. |
Flags
| Flag | Type | Description |
|---|---|---|
--server | string | The registry's host, such as ghcr.io. Required. |
--username | string | The login. Required. |
--password-stdin | bool | Read the password from standard input, which keeps it out of the process list. |
--password | string | The password as an argument. Discouraged: argv is visible in process lists and ci logs. prefer --password-stdin. |
The global flags apply as well.
Output
| Field | Type | Description |
|---|---|---|
id | string | |
name | string | What this credential is called here. |
server | string | The registry's host, such as ghcr.io. Not a URL and not an image reference. |
username | string | |
createdAt | string | null | RFC 3339, UTC. |
changed | bool | False for a dry run. |
Examples
Store one, reading the password from standard input
echo "$GITHUB_TOKEN" | outplane registry create ghcr --server ghcr.io --username acme --password-stdinCheck the request without sending a password anywhere
outplane registry create ghcr --server ghcr.io --username acme --password x --dry-run --json{
"changed": false,
"name": "ghcr",
"server": "ghcr.io",
"username": "acme"
}Store one from a file, and read back what was stored
cat token.txt | outplane registry create ghcr --server ghcr.io --username acme --password-stdin --json --fields name,server,changedWhat to Know
- --password-stdin reads everything on standard input and strips one trailing newline, which is what
echoadds. Nothing else is trimmed, because a password may legitimately begin or end with a space. - Giving both --password and --password-stdin is refused rather than one of them winning, since there is no rule saying which should.
- The password is never printed back, by this command or any other. Nothing in the result carries it.
- An application already deployed keeps pulling with whatever it had. A new credential is used by the next deployment.
- There is no update endpoint. Rotating a password is
registry deletefollowed by this command, and the gap between them is a window where a deployment would fail.
Errors
Beyond 0 for success, this command exits with:
| Exit | Kind | Meaning |
|---|---|---|
2 | usage | Invalid arguments, unknown flag, or client-side validation failure. |
3 | auth | Not authenticated, token revoked or expired, or forbidden for this team. |
6 | conflict | The resource already exists, or a concurrent change won. |
8 | upstream | The Out Plane API returned a server error. |
The code on the error object is one of registry.name_required, registry.server_required, registry.server_invalid, registry.username_required, registry.password_required, registry.password_unreadable, usage.conflicting_flags, usage.missing_argument, context.no_team. Branch on that, or on the exit status. The message is prose and changes.