Container Registry Integrations — Docker Hub, GHCR, GitLab, GAR, ECR, ACR
What does the Container Registries integration do?
zop.dev authenticates to your container registry automatically at deploy time. Docker Hub, GitHub Container Registry and GitLab Container Registry take explicit credentials. Google Artifact Registry, AWS ECR and Azure ACR need nothing at all; auth is minted on demand from the cloud account you already connected.
Coverage by category
zop.dev deployments authenticate to your container registry automatically. Bring credentials for Docker Hub, GitHub Container Registry or GitLab Container Registry. For Google Artifact Registry, AWS ECR and Azure ACR, connect nothing at all: the platform mints registry auth on demand from the cloud account you already connected.
Docker credentials minted per request at deploy time
Registry integrations produce Docker credentials at deploy time. For cloud-native registries the integration stores only a reference to your cloud account; access tokens are minted per request (STS on AWS, Entra ID on Azure, service identity on GCP), so nothing long-lived is stored and rotation is automatic.
Username and token, or just the cloud account
Docker Hub / GHCR / GitLab: Settings > Integrations > Registries; add username/token. GAR / ECR / ACR: select the connected cloud account. Done.
The six registries covered, and idempotent auth
Docker Hub, GitHub Container Registry (ghcr.io), GitLab Container Registry, Google Artifact Registry, AWS ECR, Azure ACR. On-demand credential minting for cloud registries. Idempotent per registry and account.
The three that need no credential
If your registry is Artifact Registry, ECR or ACR, the cloud account you connected for cost and scheduling already carries enough to pull images. zop.dev mints registry auth on demand rather than storing a second credential, so there is nothing extra to rotate and nothing extra to leak.
This is the single most common source of unnecessary setup work: teams add a registry credential for ECR that was never needed.
The three that do
Docker Hub, GHCR and GitLab Container Registry are outside the cloud account’s trust boundary, so they take an explicit credential. Use a token scoped to read packages only; deployment never needs push access.
Container Registries integration: common questions
Do I need a credential for ECR?
No, and adding one is the most common piece of unnecessary setup here. Google Artifact Registry, AWS ECR and Azure ACR are covered by the cloud account you already connected; zop.dev mints registry auth per request using STS on AWS, Entra ID on Azure and the service identity on GCP.
What scope should my Docker Hub token have?
Read packages only. Docker Hub, GHCR and GitLab Container Registry sit outside the cloud account's trust boundary so each takes an explicit credential, and deployment never needs push access.
No active rule family targets Container Registry Integrations — Docker Hub, GHCR, GitLab, GAR, ECR, ACR today. Rules that used to are retired, and retired rules publish no pages and fire no findings. Scheduling and permissions coverage are unaffected.