Skip to content
Hyperfluid 2.0 is live console.hyperfluid.cloud/signup
Private container registry

Your container images stay inside your cluster.

Your container images, private and sovereign

Host your container images in a private registry, inside your own cluster and backed by your sovereign object storage. Projects with quotas, a dedicated TLS endpoint per organization, role-based access control and on-demand vulnerability scanning: all from the console, with the standard docker tool.

Request your access
Your container images stay inside your cluster.

Specifications

Compatibility
Standard docker tool
Access control
Service accounts, 3 roles
Security
On-demand CVE scanning
Projects
Quotas and size tracking

Use cases

Host your private images

Push and pull your container images to a private registry hosted inside your own cluster, backed by your sovereign object storage and exposed on a dedicated TLS endpoint, on a subdomain of your own organization. Your images stay with you, with no reliance on an external public registry.

No external network egress

Control access

Organize your images into projects, with a storage quota and size tracking per project, and grant each service account limited rights: read-only, read/write or administration. Credentials can be rotated at any time.

Three roles per project

Watch for vulnerabilities

Each image can be scanned on demand for known vulnerabilities (CVE). Review the results directly in the console, alongside the overview, projects and usage tracking.

CVE scanning in the console

In action

A team hosting its images

An application team wants to push its container images without going through an external public registry

  1. Start the environment's container registry from the console
  2. Authenticate with docker login on your organization's TLS endpoint, with your user account or a service account
  3. Tag and push the image with docker push, on the project path shown in the console
  4. The image is stored on your object storage, inside your cluster

Private images hosted on your side, with no reliance on an external public registry

A platform team framing access

Several teams share the registry and each one needs the right level of access

  1. Organize repositories into projects from the Projects tab in the console
  2. Create service accounts in IAM and grant them registry permissions at project level: read-only, or read, write and delete
  3. Distribute the credentials and rotate the service account secret from the console when needed
  4. Run a vulnerability scan on an image and review the CVE report, with its severity breakdown

Access scoped per project, usage and vulnerabilities visible in the console

Key benefits

  • Private registry hosted inside your cluster, with a dedicated TLS endpoint per organization and no reliance on an external public registry
  • Compatible with the standard docker tool, with no specific tooling to learn
  • Per-project, role-based access control with limited-rights service accounts and rotatable credentials
  • On-demand image vulnerability scanning and usage tracking from the console

Ready to host your images with full sovereignty?

See how the container registry keeps your images on your side, under your control.

Request your access Catalog overview →