Install Pando

OCI registry

oci A registry that signs in with a username and password, or not at all: Distribution, Harbor, GitHub Container Registry, Artifact Registry, Zot. Each app gets a repository of its own.

Setup

  1. Enter the registry address

    Settings url

  2. Create a credential to push with

    1. Create a credential that can push, pull and delete images:
      RegistryCredentialPermissionsUsernamePassword
      GitHub Container RegistryPersonal access token (classic)write:packages, delete:packagesYour GitHub usernameThe token
      HarborRobot account in the projectPush Repository, Pull Repository, Delete ArtifactThe robot's full name, such as robot$project+pandoThe secret
      Artifact RegistryService account keyArtifact Registry Repository Administrator_json_key_base64The key file, base64-encoded
      Distribution, ZotA user in its htpasswd fileThe userThe user's password

    Open GitHub tokens (classic)Open Google Cloud service accounts

    Settings username, password

Settings (6)
urlRegistry addressRequired

The registry and the path to push under: ghcr.io/OWNER, a Harbor project, or an Artifact Registry repository.

string · For example https://registry.internal:5000

usernameUsername

Empty for a registry Pando reaches anonymously.

string

passwordPasswordCredential

Stored encrypted, and never shown again.

string

layoutWhere images goAdvanced
  • per_app A repository per app — Each app has its own, so a deleted app's images are found and removed together.
  • single One repository for everything — For a registry where a repository has to exist before anything is pushed to it.

one of the values above · Default per_app

insecureAllow plain HTTPAdvanced

Only for a registry on a private network. Every host that pulls must also list it as an insecure registry.

bool · Default false

alwaysSend every build through the registryAdvanced

Even on a runtime that can take a built image directly, such as Docker on one host.

bool · Default false