Registry Backend Operations

This page is for platform operators maintaining Rise registry integrations.

Overview

Rise supports multiple registry provider modes through backend configuration.
Operators are responsible for provider selection, IAM/credentials setup, and production hardening.

Supported providers:

• AWS ECR
• GitLab Container Registry
• JFrog Artifactory
• Docker/OCI Registry

Backend Configuration

Registry configuration is loaded from backend config files under config/.

Typical precedence:

1. {RISE_CONFIG_RUN_MODE}.{toml,yaml,yml} (required)
2. local.{toml,yaml,yml} (optional local overrides)

Use environment variable substitution for secrets and environment-specific values.

Registry Credentials API

Operator reference endpoint:

GET /api/v1/projects/<project-name>/deployments/<deployment-id>/registry-credentials

Credentials are scoped to a specific deployment and are only available while the deployment is in a pre-push state (Pending, Building, or Pushing). The endpoint returns 409 Conflict if the deployment has already progressed past the Pushing state.

Returned credentials are provider-specific and intended for authenticated clients.

Security Recommendations

1. Use least-privilege IAM/policy scope per project.
2. Prefer short-lived credentials and role-based access.
3. Enforce TLS for registry traffic in production.
4. Monitor credential issuance and image push activity.
5. Rotate long-lived/static credentials on a regular cadence.

Troubleshooting

Docker registry connectivity failures

• Verify registry endpoint reachability from both backend and client environments.
• Verify auth state (docker login) and namespace/repo permissions.

Extending Registry Providers

To add a provider:

1. Implement the registry provider trait in backend registry provider modules.
2. Add provider configuration to registry settings.
3. Register provider selection in provider factory/bootstrap logic.