Getting started

Getting started with Container Registry

This guide walks you through creating your first container registry namespace, authenticating with Docker, and pushing an image.

Prerequisites

Requirement	Notes
`containerRegistry` feature gate	Must be enabled on your organisation; contact your account team if not
IAM or credential access	Permissions to create namespaces and push images, or an access credential with registry scopes
Docker or OCI client	Docker, Podman, or crane installed locally

Step 1: Create a namespace

Create a namespace in the cloud region closest to your workloads. Use the console or the API at /v1/container-registries.

Field	Notes
Region	Required — determines registry hostname and data locality
Namespace	Required — lowercase ASCII, no spaces, max 255 characters (for example `acme-platform`)
Description	Optional

The namespace name cannot be changed after creation. Note the registry hostname shown on the namespace detail page — you need it for tagging and pushing images.

For organisation vs project scoping, see Concepts.

Step 2: Authenticate

Log in with Docker (or any OCI client) using an access credential or service account token that includes container registry scopes.

docker login registry.nl-01.thalassa.cloud \
  -u <access-credential-key> \
  -p <access-credential-secret>

Replace registry.nl-01.thalassa.cloud with the hostname for your namespace’s region.

Authentication uses the platform’s Docker Registry token endpoint. Credentials must include one of:

Scope	Access
`containerRegistry`	Push and pull
`containerRegistry:all`	Push and pull
`containerRegistry:pull`	Pull only

User sessions and IAM policies can also grant push and pull permissions — see Access control.

For CI/CD credential patterns, see CI/CD.

Step 3: Tag and push an image

Tag your local image with the full registry path:

docker tag my-app:local \
  registry.nl-01.thalassa.cloud/acme-platform/my-app:v1.0.0

Push the image:

docker push registry.nl-01.thalassa.cloud/acme-platform/my-app:v1.0.0

The repository my-app is created automatically on first push. Verify the image in the console or via the API.

Image address format

{registry-host}/{namespace}/{repository}:{tag}

Step 4: Pull the image

Confirm you can pull the image you pushed:

docker pull registry.nl-01.thalassa.cloud/acme-platform/my-app:v1.0.0

What’s next

Kubernetes — Deploy images with imagePullSecrets
Namespace configuration — Set visibility and retention policies
CI/CD — Automate push and pull in pipelines
Repositories — Inspect and manage repositories via the API

Namespace configuration