Container registry

Kubrain hosts a container registry so you can ship prebuilt images. The headline property: your cluster nodes pull with no imagePullSecrets — a pull-only credential is baked into every node at cluster creation and shared across all your clusters.

Push coordinates

kubrain registry

Returns the registry host, your tenant image namespace, and the login flow. It carries no secret — the docker-login password is the Kubrain API token you already hold. Push with standard tooling:

docker login <host>                       # username any, password = your API token
docker tag myapp:1.4.0 <host>/<tenant>/myapp:1.4.0
docker push <host>/<tenant>/myapp:1.4.0

Images live under <host>/<tenant-lowercase>/<repo>:<tag> — the <tenant>/ namespace is yours.

Use a pushed image

Reference it directly from kubrain.yaml as a prebuilt component, or roll it out straight:

components:
  web:
    image: <host>/<tenant>/myapp:1.4.0    # prebuilt — skips the build
    port: 8080

kubrain deploy ship myapp --image <host>/<tenant>/myapp:1.4.0

No imagePullSecrets, no per-deployment credential wiring — the node already knows how to pull from your namespace.

See also

• Deploy an app — building in the cloud vs. shipping a prebuilt image.