Pushing and pulling

Early access. Registry is rolling out behind an organization flag.

Logging in

lbr registry login is the recommended path for a workstation. It configures Docker’s credential helper so every pull and push fetches a fresh, short-lived credential — nothing long-lived is written to ~/.docker/config.json. One login authorizes every registry your organization can reach.

lbr registry login                       # every registry, push + pull
lbr registry login --registry acme-prod  # narrow to one registry
lbr registry login --pull                # read-only

Under the hood this points the credHelpers entry for registry.lngbrdg.com at lbr and installs a docker-credential-lbr helper on your PATH. Because Docker keys credential helpers by host, one login serves one organization at a time — if you belong to several, switch your active organization and log in again. To undo it:

lbr registry logout

For a service or CI runner that can hold a secret, log in with a registry key instead:

docker login registry.lngbrdg.com -u <key-id> -p <secret>

Pushing

Tag under your registry’s path — registry.lngbrdg.com/<registry>/<repository> — and push. The repository is created on first push.

docker tag my-app:latest registry.lngbrdg.com/acme-prod/my-app:1.4.0
docker push registry.lngbrdg.com/acme-prod/my-app:1.4.0

Multi-arch images work as-is: push a manifest list built with docker buildx and the registry stores the index and each platform manifest together. Deleting the tagged index reclaims its per-architecture children too.

Pulling

docker pull registry.lngbrdg.com/acme-prod/my-app:1.4.0

Any OCI client works. With oras you can push and pull arbitrary artifacts the same way:

oras push registry.lngbrdg.com/acme-prod/config:v1 ./config.yaml

Browsing and cleaning up

Browse and prune from the CLI (or the Console):

lbr registry repo list -r acme-prod
lbr registry repo tags my-app -r acme-prod
lbr registry repo manifests my-app -r acme-prod        # tagged AND untagged

lbr registry repo delete-tag my-app old --purge -r acme-prod   # tag + its image
lbr registry repo delete-image my-app sha256:… -r acme-prod    # one image by digest
lbr registry repo delete my-app -r acme-prod                   # the whole repository

Deleting a tag without --purge removes only the pointer — the image stays, untagged, until you delete it. Reclaimed layers leave storage after a short grace period (the garbage collector verifies nothing else references them first).

Where to next

• Registry keys — for CI and services.
• Access rules — keyless CI with OIDC.
• Pricing — how storage and egress are measured.