Core concepts

Early access. Registry is rolling out behind an organization flag.

Registry and repository

A registry is the top-level container you create, named by a globally unique slug. It’s the first path segment of every image: registry.lngbrdg.com/<slug>/<repository>. An organization can have several registries — one per environment, per team, whatever suits you.

A repository is a named collection of images inside a registry (acme-prod/api, acme-prod/worker). Repositories are created implicitly on first push; you don’t declare them ahead of time.

Authentication

Three ways in, for three situations:

• lbr registry login — for a person at a workstation. Docker fetches a fresh, short-lived credential per pull through the lbr credential helper; nothing long-lived lands on disk. See Pushing and pulling.
• Registry keys — long-lived keyId / secret pairs for a service or a CI system that can hold a secret. Scoped to pull or readwrite, optionally narrowed to repository prefixes.
• OIDC access rules — keyless CI. A build presenting a trusted OIDC token (GitHub Actions, a cloud workload identity) trades it for a short-lived key — no stored secret at all.

The pull-through cache

Every registry has a reserved cache/ namespace that mirrors the platform upstream catalog (Docker Hub, GHCR, Quay, and more). Pull <registry>/cache/<host>/<repo>:<tag> and the first request fetches from the upstream and caches it; later requests serve from the EU. For private upstream images, attach a BYO upstream credential so the cache pulls under your own account and rate limits.

Storage and garbage collection

Storage is content-addressed and deduplicated — identical layers are stored once, across every repository and the cache. Your registry’s usage is its logical bytes (the distinct layers it references); deduplication is the platform’s margin, not your bill.

Deleting a tag removes only the pointer; the image lingers until you delete it (or its last tag with a purge). Unreferenced layers are reclaimed by a verify-then-delete garbage collector. See Pushing and pulling for the cleanup commands.

Where to next

• Quickstart — if you haven’t pushed yet.
• Registry keys and access rules — pick the credential that fits.