Private container images
A Container can run an image you build in your own pipeline and keep in a private registry, such as GitHub Container Registry, Amazon ECR or Docker Hub. Alien copies the image into the release when you run alien release. Deployments pull it from your manager with their deployment token, so the customer never needs credentials for your registry.
How it works
alien releaserunsdocker pull --platform linux/<arch>for each target architecture. The pull uses the Docker login on the machine that runs the release.- The CLI pushes the image to your manager's registry with the rest of the release.
- Each deployment pulls the image from your manager, never from your registry:
- AWS, GCP and Azure. Machines pull through your manager with the deployment's token.
- Kubernetes. Pods pull through your manager. Alien creates the image pull secret from the deployment's token.
- Air-gapped. The image travels in the sync folder and is pushed to the site's own registry.
The customer's environment only needs outbound HTTPS to your manager. No registry credentials go into alien.ts, the CloudFormation template, the Terraform module, the deploy CLI or the Helm values.
Use a private image
Reference the image
const api = new alien.Container("api")
.code({ type: "image", image: "ghcr.io/acme/api:1.4.2" })
.cpu(1)
.memory("1Gi")
.publicEndpoint("api", 8080, "http")
.build()Alien copies whatever the tag points to when the release runs. Pin the tested image by digest (ghcr.io/acme/api@sha256:...) so a release contains the same image. A version tag such as 1.4.2 can still change unless your registry enforces tag immutability.
Log in to your registry
Log in on the machine that runs alien release, whether that is your laptop or a CI runner:
Use a token with the read:packages scope:
echo "$GHCR_TOKEN" | docker login ghcr.io --username <github-user> --password-stdinCheck that the pull works for each architecture you release. AWS deployments use linux/arm64 by default; GCP and Azure use linux/amd64; Kubernetes uses both:
docker pull --platform linux/arm64 ghcr.io/acme/api:1.4.2If the image exists for only one architecture, publish a multi-architecture image, for example with docker buildx build --platform linux/amd64,linux/arm64 --push.
Release
alien releaseIf the pull fails, the release stops with docker pull failed for image '...' and Docker's output. Nothing is published.
alien release also has --registry-username and --registry-password flags. Those set the registry the release is pushed to when you bypass the manager. They are not used to pull your image.
Deploy
The customer's setup does not change. Whichever setup method they pick, they don't provide anything for your images:
| Setup method | What the customer provides for your images |
|---|---|
| CloudFormation, Terraform or the deploy CLI | Nothing. Machines pull through your manager with the deployment's token. |
| Helm | Nothing. Alien creates the pull secret from the deployment's token. |
Air-gapped (alien-deploy sync) | Credentials for the site's own registry, with --registry-username and --registry-password. See Air-gapped deployments. |
Existing deployments receive the image with the next release, like any other change.
Check the running image
alien deployments get acme-corpThe output lists the image each container last reported. It is the copy in the release, not the ghcr.io reference.