# Registries

> Connect Amazon ECR or build straight from a GitHub repository so Ownkube has an image to deploy.

A **registry** is where Ownkube pulls container images from when you deploy. Registries are connected at the organization level. Connect once, use across every cluster and deployment. Manage them under [**Settings**](https://app.ownkube.io/dashboard/settings).

You have three ways to give Ownkube an image:

### Amazon ECR

**Available now.** Role-based: Ownkube uses the IAM role you connected during onboarding to pull from your private ECR repositories. No access keys to store or rotate.

### GitHub repository

**Available now.** Connect the GitHub App so Ownkube can build an image from your source and push it to your ECR, then redeploy on every push.

### Public image

**Available now.** Any publicly pullable image reference works with no connection at all.

**More registries are coming.** Docker Hub, GitHub Container Registry, Google Artifact Registry, and Azure Container Registry are on the roadmap. Track progress on the [changelog](https://ownkube.io/changelog). Until then, ECR and GitHub-built images cover the common cases.

## Amazon ECR

ECR is the private registry wired today. It reuses the same IAM role you set up during [AWS onboarding](/docs/guides/connect-aws), so there are no registry credentials to manage separately.

1. **Connect AWS**

   If you haven't already, finish [AWS onboarding](/docs/guides/connect-aws). The least-privilege role Ownkube assumes includes scoped pull access to ECR.

2. **Open Settings**

   Go to [**Settings**](https://app.ownkube.io/dashboard/settings) and open the registries section. Your connected AWS account's ECR is available to every cluster in the organization.

3. **Pick a repository and tag at deploy time**

   When you create a deployment, Ownkube autocompletes your ECR repositories and their tags. Pick the image, pick the tag, deploy.

## Build from a GitHub repository

If your code is on GitHub, you don't need to build and push images yourself. Connect the GitHub App and Ownkube builds the image for you and pushes it to your ECR.

The GitHub App install gives Ownkube scoped access to the repositories you choose. Benefits:

- **No expiring tokens**: rotation happens automatically
- **Scoped per repository**: revoke access to individual repos without touching anything else
- **Repository picker at deploy time**: Ownkube can list your installed repos when you create a deployment
- **Auto-generated build workflows**: Ownkube can open a PR adding a build-and-push workflow to your repo so each push ships a new image

You can connect more than one GitHub App installation per organization, for example your personal account plus one or more GitHub organizations. Each deployment remembers which connection it builds from.

### How to connect

1. **Open Settings**

   Go to [**Settings**](https://app.ownkube.io/dashboard/settings) and open the registries section.

2. **Start the GitHub App install**

   Click **Connect GitHub App**.

3. **Pick your target**

   GitHub asks whether to install on a personal account or an organization. Pick the owner of the repositories you want to deploy.

4. **Choose repositories**

   Either **All repositories** or **Select repositories**. You can change this later on GitHub at any time.

5. **Finish**

   You're redirected back to Ownkube with the connection in the **active** state.

## Using an image in a deployment

When you create a deployment, pick where the image comes from: an ECR repository, a GitHub repository to build, or a public image reference. Ownkube autocompletes repositories and tags from whatever you've connected.

Pin image tags explicitly. `latest` is accepted, but a specific tag (like `v1.4.2` or a short git SHA) makes every deploy traceable to a known image.

## Verifying a connection

If a GitHub App install is removed or revoked, Ownkube marks the connection as **failed**. Click **Verify** on the connection card to re-test it without deleting anything. Re-verification checks the install is still present and hasn't been revoked.

If verification fails, reinstall the GitHub App.

## Removing a connection

The **Remove** action is a soft-delete. The row stays in the database but is marked revoked, and any stored credentials are cleared. Existing deployments keep running from cached images, but new pulls or builds will fail. Reconnect to restore access.

- [Deploy your first app](/docs/guides/deploy-first-app)
- [Environment variables](/docs/guides/environment-variables)

---

**Don't see a feature you need?** Email [support@ownkube.io](mailto:support@ownkube.io?subject=Feature%20request). Ownkube is shaped by the teams using it and we ship what our users ask for.