Registry keys

Early access. Registry is rolling out behind an organization flag.

A registry key is a long-lived credential — a keyId (the docker-login username) and a secret (the password) — for a service or CI system that can hold a secret safely. For a person at a workstation, prefer lbr registry login; for CI that supports OIDC, prefer keyless access rules.

Minting a key

lbr registry key mint ci-pusher --mode readwrite -r acme-prod

The secret is shown once — store it immediately. The command prints a ready-to-run docker login. Two knobs shape a key:

• --mode — pull (read-only) or readwrite (push and pull).
• --repo-prefix — narrow the key to repositories under a prefix (repeatable). Omit it for the whole registry.

lbr registry key mint deployer --mode pull --repo-prefix web/ --repo-prefix api/ -r acme-prod

Using a key

docker login registry.lngbrdg.com -u <key-id> -p <secret>

The registry never grants anonymous access — even a pull needs a credential.

Listing and revoking

lbr registry key list -r acme-prod
lbr registry key revoke <key-id> -r acme-prod

Revocation is immediate. Keys are metadata-only on read — the secret is never retrievable after minting, so rotate by minting a new key and revoking the old.

Important: a registry key is a standing secret. Scope it to the narrowest mode and prefixes that work, rotate it regularly, and reach for a short-lived or keyless credential whenever the caller supports one.

Where to next

• Access rules — keyless push from CI.
• Registry with Terraform — declare keys as code.