Skip to main content
Servers or Helm Charts that are hosted on your own container registry can be deployed by connecting your registry to Ryvn. Ryvn supports Docker Hub, GitHub Container Registry, Harbor and Amazon Elastic Container Registry.

​
Prerequisites

Before you begin, ensure you have:

​
Connect private registry

1

Navigate to Settings

Go to the Settings tab in the Ryvn Dashboard and select the Private Registries tab.
2

Add registry

Select AWS ECR or Generic OCI (Harbor, GitHub Container Registry, etc.)
3

Choose registry

We support the following container registries:
  • Amazon Elastic Container Registry
  • Docker Hub
  • GitHub Container Registry
  • Harbor
4

Add registry details

  • Add registry name (eg: my-github-registry)
  • Add registry host (GitHub - ghcr.io, Docker - docker.io, Harbor - my-harbor.example.com)
5

Add registry credentials

For private registries, add your credentials through Settings in the Ryvn Dashboard.
  • Generic OCI (Docker Hub, GitHub, Harbor, etc.): Add username and password
    • For Harbor, this is typically a read-only robot account’s name and secret
    • For GitHub, this is typically GitHub username and personal access token (access to read:packages scope; write:packages if Ryvn should publish built images to this registry)
  • AWS ECR: Configure AWS Role using cloudformation template
By default, your organization has access to Ryvn Registry. This is a multi-tenant registry backed by AWS ECR with isolated repositories for your organization.

​
Authenticating with private registry

​
Server

Once you have added your private registry, you can pick the registry during server creation (or edit this in service settings).
1

Open dashboard

Open the Ryvn Dashboard and go to the Services tab
2

Start creation

Click Create Service in the top-right corner
3

Choose service type

Select your service type:
4

Select registry

Choose Container Registry and select your registry from the dropdown
5

Select image

Select your image from the dropdown
6

Create

Click Create

​
Helm charts

Once you have connected a private registry, Ryvn automatically creates image pull secrets in environments where your Helm Charts are deployed. To use these image pull secrets, you can:
  • Use the image pull secret reference: In values.yaml on Ryvn, you can get the image pull secret for a registry named my-registry as follows:
  • If your helm chart does not create a service account, you do not need to supply any image pull secret since Ryvn attaches the image pull secret to the default service account automatically. This is a Kubernetes feature, see Kubernetes Documentation

​
Publishing built images to your registry

When a service builds from GitHub (Buildpacks or Dockerfile), the default destination for built images is the Ryvn Registry. To push them to your own registry instead, bind the service to a connected registry and set the image destination:
Requirements:
  • Pre-create the repository. Ryvn does not create repositories in your registry — the image’s repository path must already exist.
  • The image host must match the bound registry (e.g. ghcr.io image with a ghcr.io registry), and the reference must be tag-less: Ryvn assigns the version tag at push time.
  • Credentials need push scope. A read-only pull credential is not enough — for GHCR the token needs write:packages, for Harbor a robot account with push permission, and for ECR an IAM role with PutImage/UploadLayerPart (use the publish-role CloudFormation template linked from the registry form’s publish section).
  • Optional separate publish credentials. If pull and push use different credentials, add a dedicated publish credential on the registry in Settings; otherwise Ryvn reuses the pull credential.
The same applies to Helm charts built from a GitHub repo: with a bound registry, built charts are stored in that registry instead of the Ryvn Registry.

​
Troubleshooting

​
Image pull errors

If you encounter image pull errors, ensure that:
  • Your container registry is correctly connected and configured
  • The image tag exists and is pushed to the registry
  • The credentials used for the connected registry are not expired
latest tags are not supported for servers as they make versioning and rollbacks unpredictable.