DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

Private registry authentication

Two separate mechanisms: infrastructure-owned pull secrets and NopsAI-owned runner credential assignments.

ReferenceAdministratorSecurity

Key points

  • Infrastructure-owned platform pull secrets (imagePullSecrets, KUBERNETES_IMAGE_PULL_SECRETS) and NopsAI-owned runner credential assignments (runner_registry_credentials, registry_credential_ref) are distinct and should not be conflated.
  • Docker runners use bootstrap-delivered NOPSAI_REGISTRY_DOCKER_CONFIG_B64 to build local per-image RegistryAuth.
  • The legacy /v1/internal/registry-auth/docker broker route has been removed.
  • Kubernetes step and agent pods continue to pull through explicit imagePullSecrets.

Examples

Generate a runner install that carries registry credentialsbash
curl -s -H "Authorization: Bearer $NOPSAI_TOKEN" \
  "$NOPSAI_URL/v1/system/dispatcher/runner-bootstrap-command?runner_id=runner-prod-1&registry_credential_ref=platform/registry" \
  | jq '{runner_image, registry_credentials, registry_hosts}'
Result

The response names the credentials the install will deliver. The runner receives them as NOPSAI_REGISTRY_DOCKER_CONFIG_B64 and builds per-image RegistryAuth locally.

Replace before running
  • registry_credential_ref names a credential that already exists in the credential store.

How it works

Assigning a registry credential to a runner is a NopsAI-side operation recorded with audit and metrics. Attaching a pull secret to a pod is a cluster-side operation owned by whoever manages the namespace.

Keep the two boundaries separate when debugging a pull failure: a Kubernetes ImagePullBackOff is almost always a missing or wrong imagePullSecret, while a Docker runner pull failure points at the delivered docker config.

Implementation evidence

  • doc/runner-registry-auth.md

    Credential assignment, image pulls, GitOps, audit, and metrics behavior.

  • pkg/registryauth

    RegistryAuth construction for Docker image pulls.