# Container Registry Integrations — Docker Hub, GHCR, GitLab, GAR, ECR, ACR

> Authenticate image pulls and pushes with Docker Hub, GitHub and GitLab registries, or your cloud-native registry with zero extra credentials.

Source: https://zop.dev/integrations/container-registries
Updated: 2026-08-20

---

## Common questions

### Do I need a credential for ECR?

No, and adding one is the most common piece of unnecessary setup here. Google Artifact Registry, AWS ECR and Azure ACR are covered by the cloud account you already connected; zop.dev mints registry auth per request using STS on AWS, Entra ID on Azure and the service identity on GCP.

### What scope should my Docker Hub token have?

Read packages only. Docker Hub, GHCR and GitLab Container Registry sit outside the cloud account's trust boundary so each takes an explicit credential, and deployment never needs push access.

zop.dev deployments authenticate to your container registry automatically. Bring credentials for Docker Hub, GitHub Container Registry or GitLab Container Registry. For Google Artifact Registry, AWS ECR and Azure ACR, connect nothing at all: the platform mints registry auth on demand from the cloud account you already connected.

## Docker credentials minted per request at deploy time

Registry integrations produce Docker credentials at deploy time. For cloud-native registries the integration stores only a reference to your cloud account; access tokens are minted per request (STS on AWS, Entra ID on Azure, service identity on GCP), so nothing long-lived is stored and rotation is automatic.

## Username and token, or just the cloud account

Docker Hub / GHCR / GitLab: Settings > Integrations > Registries; add username/token. GAR / ECR / ACR: select the connected cloud account. Done.

## The six registries covered, and idempotent auth

Docker Hub, GitHub Container Registry (ghcr.io), GitLab Container Registry, Google Artifact Registry, AWS ECR, Azure ACR. On-demand credential minting for cloud registries. Idempotent per registry and account.

## The three that need no credential

If your registry is Artifact Registry, ECR or ACR, the cloud account you connected for cost and
scheduling already carries enough to pull images. zop.dev mints registry auth on demand rather
than storing a second credential, so there is nothing extra to rotate and nothing extra to leak.

This is the single most common source of unnecessary setup work: teams add a registry
credential for ECR that was never needed.

## The three that do

Docker Hub, GHCR and GitLab Container Registry are outside the cloud account's trust boundary, so
they take an explicit credential. Use a token scoped to read packages only; deployment never
needs push access.