Towbar uses one installation-wide OCI Registry V2 identity. It can authenticate
private prebuilt-image deployments and transfer an image from a dedicated build
server to a runtime server without changing the image digest.
Configure the control-plane environment:
TOWBAR_REGISTRY_HOST is the registry hostname, optionally followed by a port.
Leave private-network access disabled for an internet registry. Enable it only
when the registry intentionally resolves to an internal address reachable from
the Towbar control plane.
Run sudo towbar config validate, then sudo towbar restart. OCI registry
appears under Manage → Integrations → Container registries only after the
enabled configuration passes startup validation. The dashboard shows the
hostname and username, but never returns the password or token.
Use it for a private image
Reference the integration slug registry from an image deployment:
Towbar contacts the Registry V2 API, follows supported bearer challenges,
resolves the tag to an immutable digest, and records both references. A changed
digest at execution time fails the deployment instead of silently running a
different image. Private registry endpoints must use HTTPS.
Use it for build transfer
A dedicated build server can push the verified image through the same registry:
Grant only the pull and push permissions needed for the intended repositories.
After rotating the token, validate and restart Towbar, deploy one private image,
and revoke the previous credential only after both resolution and pull succeed.
See Prebuilt images and build servers
and the environment variable guide. Last modified on September 22, 2026
