About Docker Registry
What a registry namespace is, why you need one, how access keys work and how the registry is billed.
NoVPS Registry is a private Docker registry built into Granite. It stores the images your applications run, right next to the platform that runs them, so you do not depend on Docker Hub or another third-party registry being up and fast. Nothing you push is published or listed anywhere: every push and pull requires an access key that you issued.
The registry speaks the standard Docker registry protocol. docker login, docker push and docker pull work as with any other registry, and so do your existing CI jobs and build tools. No special client is needed.
What is a namespace
A namespace is the top-level container for your images in the registry, similar to an organization or a user on Docker Hub. Every image lives in a repository inside a namespace, and the full image name is made of three parts:
nl.registry.novps.app/<namespace>/<repository>:<tag>- Registry host —
nl.registry.novps.appfor the EU (Netherlands) region. It is shown on the namespace Settings page. - Namespace — the name you choose when you create it, for example
my-super-project. - Repository — usually one per service, for example
apiorworker. Repositories are created automatically on the first push; you do not have to create them in advance. - Tag — the version of the image, for example
1.4.2orlatest.
A namespace belongs to a project. Any member of the project can see its namespaces, and what they can create or delete is defined by their role in the project.
Why you need one
You need at least one namespace to push an image into the registry. Beyond that, namespaces are the unit of access control: an access key is granted permissions per namespace, so you can, for example, keep production images in one namespace and give the CI pipeline push access only to it. Namespaces are also the unit of usage accounting: the namespace list shows how much storage each one uses and how many repositories it has.
There is no limit on the number of repositories in a namespace or on the number of images in a repository.
Access keys
Access keys are how clients authenticate against the registry. A key has a name, a Key ID that is used as the username for docker login, and a secret key that is used as the password. The secret is shown only once, when the key is created.
Each key is granted one of three permission levels per namespace:
| Permission | Allows | Typical use |
|---|---|---|
| Pull-only | Download images | Deploy tokens, teammates who only run images locally |
| Push-only | Upload images | Build pipelines that must not be able to pull or delete |
| Full access | Pull, push and delete images | CI pipelines that build images and clean up old ones |
A key can cover several namespaces with a different permission level in each. Keys are independent of each other, so a leaked key is easy to deal with: regenerate its secret or remove it, and update the one place that used it. Keys are managed on the Access Keys tab of the Registry page.
Billing
The registry is included with your project. Only the storage occupied by your images is billed, from the same monthly usage credits as the rest of the project. There is no per-namespace or per-repository fee. Image storage costs $0.035 per GiB per month; see Registry pricing.
Usage beyond the project’s included credits requires extra credits at $1 per credit. Extra credits recur with the subscription until you reduce or remove them. See project pricing and billing examples.