Registries

Store one credential per registry host, per project. At build and sandbox-create time, an image ref whose host matches a stored credential is pulled with that credential automatically — no per-request configuration. Passwords are write-only: encrypted at rest and never returned by any endpoint. See the Registries guide.

Hosts are normalized before storage and lookup: lowercased, Docker Hub aliases (docker.io, registry-1.docker.io, registry.hub.docker.com) collapse to index.docker.io, and schemes/paths are rejected — supply a bare host[:port].

PUT /registries/:host

Create or replace the credential for a host. Returns 204 No Content. Alternatively, PUT /registries accepts the same body plus a "host" field.

Request

Field	Type	Required / default	Description
`kind`	string	`"basic"`	`"basic"`, `"ghcr"`, `"gcr"`, or `"ecr"`. Kind-specific hosts are validated: `ghcr` requires `ghcr.io`; `gcr` requires a `gcr.io` / `-docker.pkg.dev` host; `ecr` requires an `.dkr.ecr.<region>.amazonaws.com` host.
`username`	string	required	Registry username (e.g. a GitHub username for `ghcr`, `AWS` for `ecr`).
`password`	string	required	Password or token, ≤ 64 KiB. Write-only.
`description`	string	none	Free-form note.

cURL

curl -X PUT https://api.rl.trydaytona.com/registries/ghcr.io \
  -H "Authorization: Bearer $RLP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "ghcr",
    "username": "octocat",
    "password": "ghp_xxxxxxxxxxxxxxxxxxxx",
    "description": "CI pull token"
  }'

Response: 204 No Content.

Errors

400 — invalid host (scheme/path/whitespace), unknown kind, kind/host mismatch, empty username or password, or password > 64 KiB.
503 — credential encryption temporarily unavailable; retry.

GET /registries

List the project's registry credentials — metadata only, never passwords.

cURL

curl https://api.rl.trydaytona.com/registries \
  -H "Authorization: Bearer $RLP_API_KEY"

{
  "registries": [
    {
      "host": "ghcr.io",
      "kind": "ghcr",
      "username": "octocat",
      "description": "CI pull token",
      "updated_at": "2026-07-31T10:15:00Z"
    }
  ]
}

GET /registries/:host

Metadata for one host (never the password). The host is normalized first, so GET /registries/docker.io finds an index.docker.io credential.

cURL

curl https://api.rl.trydaytona.com/registries/ghcr.io \
  -H "Authorization: Bearer $RLP_API_KEY"

{
  "host": "ghcr.io",
  "kind": "ghcr",
  "username": "octocat",
  "description": "CI pull token",
  "updated_at": "2026-07-31T10:15:00Z"
}

Errors

400 — invalid host.
404 — no credential for this host.

DELETE /registries/:host

Delete the credential for a host. Idempotent — deleting a nonexistent credential still returns 204 No Content.

cURL

curl -X DELETE https://api.rl.trydaytona.com/registries/ghcr.io \
  -H "Authorization: Bearer $RLP_API_KEY"

Response: 204 No Content.

Usage

No opt-in is needed on individual requests. When a build (POST /images) or sandbox create (POST /vms) references a registry image, Daytona derives the ref's host the same way Docker does:

node:20 → index.docker.io (implicit Docker Hub)
ghcr.io/org/app:tag → ghcr.io
localhost:5000/app → localhost:5000

If the project has a credential for that host, the pull authenticates with it; otherwise the pull is anonymous. Updating a credential takes effect on the next pull.

On this page