registry

The registry domain has 11 actions. On the meta surface they are all reached through arcane_registry; on the individual surface each one is its own tool; on the dynamic surface run them with arcane_execute_action and the canonical ID.

Summary

Action	Title	Kind
registry.create	Create a container registry	write
registry.delete	Delete a container registry	destructive
registry.get	Get a container registry	read
registry.list	List container registries	read
registry.pull_usage	Get container registry pull usage	read
registry.repositories	List registry repositories	read
registry.sync	Sync container registries	destructive
registry.tag_delete	Delete a repository tag	destructive
registry.tags	List repository tags	read
registry.test	Test a container registry	write
registry.update	Update a container registry	write

Actions

registry.create

Create a container registry

Create a new container registry

• Kind: write
• Required parameters: awsAccessKeyId, awsRegion, awsSecretAccessKey, description, enabled, insecure, registryType, repositoryNames, token, url, username
• Meta tool: arcane_registry with "action": "create"
• Individual tool: arcane_registry_create
• Arcane route: POST /api/container-registries
• Operation ID: createContainerRegistry
• Usage: Stores credentials that Arcane uses to pull images from that host while the registry is enabled, and to browse it with registry.repositories/registry.tags (even when disabled). Every field is required: for registryType “generic” pass a non-empty username and token, empty strings for the aws* fields and repositoryNames: [] (a null is dropped and then rejected). For “ecr” pass awsRegion plus awsAccessKeyId and awsSecretAccessKey together, or both empty to use the default AWS credential chain. An ecr url must be the private endpoint <12-digit account>.dkr.ecr.<region>.amazonaws.com with insecure: false. insecure: true lets Arcane browse a plain-HTTP registry. repositoryNames are the namespaces offered as push targets for builds. The new registry is also pushed to remote environments in the background. Check it with registry.test.
• Related actions: registry.test, registry.repositories, registry.list, image.pull

registry.delete

Delete a container registry

Delete a container registry by ID

• Kind: destructive — requires confirm: true
• Required parameters: id
• Meta tool: arcane_registry with "action": "delete"
• Individual tool: arcane_registry_delete
• Arcane route: DELETE /api/container-registries/{id}
• Operation ID: deleteContainerRegistry
• Usage: Deletes stored registry credentials (id from registry.list). Arcane then pulls from that host anonymously unless another stored registry covers it. An unknown id fails with 404. The deletion is propagated to remote environments in the background. To stop using the credentials but keep them, set enabled: false with registry.update instead.
• Related actions: registry.list, registry.update

registry.get

Get a container registry

Get a container registry by ID

• Kind: read
• Required parameters: id
• Meta tool: arcane_registry with "action": "get"
• Individual tool: arcane_registry_get
• Arcane route: GET /api/container-registries/{id}
• Operation ID: getContainerRegistry
• Usage: Returns one registry’s stored settings (url, username, description, insecure, enabled, registryType, repositoryNames, awsAccessKeyId, awsRegion), id from registry.list. The token and AWS secret are never returned. Read it before registry.update, which needs every field sent back.
• Related actions: registry.list, registry.update, registry.test

registry.list

List container registries

Get a paginated list of container registries

• Kind: read
• Required parameters: none
• Meta tool: arcane_registry with "action": "list"
• Individual tool: arcane_registry_list
• Arcane route: GET /api/container-registries
• Operation ID: listContainerRegistries
• Usage: Lists the registry credentials stored in Arcane. They are global to the Arcane instance, not per environment. search matches url, username and description, and start/limit page through the results. Each item’s id is the registry id every other registry.* action takes. Tokens and AWS secrets are never returned.
• Related actions: registry.get, registry.create, registry.repositories, registry.pull_usage

registry.pull_usage

Get container registry pull usage

Get configured registry pull usage and rate limit visibility

• Kind: read
• Required parameters: none
• Meta tool: arcane_registry with "action": "pull_usage"
• Individual tool: arcane_registry_pull_usage
• Arcane route: GET /api/container-registries/pull-usage
• Operation ID: getContainerRegistryPullUsage
• Usage: Takes no parameters and returns one entry per configured registry: observedPulls counts the successful image pulls Arcane made from that host (e.g. image.pull). Live Docker Hub rate-limit figures (limit, remaining, used, windowSeconds) are fetched only for enabled docker.io registries, with their credentials or anonymously, and cached for 30 minutes (see checkedAt). Other registries report authMethod “unknown” and no limits, and a failed check is reported in error.
• Related actions: registry.list, image.pull

registry.repositories

List registry repositories

List the repositories stored in a container registry through its catalog API

• Kind: read
• Required parameters: id
• Meta tool: arcane_registry with "action": "repositories"
• Individual tool: arcane_registry_repositories
• Arcane route: GET /api/container-registries/{id}/repositories
• Operation ID: listContainerRegistryRepositories
• Since: Arcane v2.15.0
• Usage: Lists repository names through the registry’s catalog API (/v2/_catalog) with the stored credentials, or anonymously without them. id from registry.list. Only repositories under the namespace path of the registry URL are returned, and registries without a catalog API (Docker Hub, for one) fail. Pass a returned name as repository to registry.tags or registry.tag_delete.
• Related actions: registry.list, registry.tags

registry.sync

Sync container registries

Sync container registries from a remote source

• Kind: destructive — requires confirm: true
• Required parameters: registries
• Meta tool: arcane_registry with "action": "sync"
• Individual tool: arcane_registry_sync
• Arcane route: POST /api/container-registries/sync
• Operation ID: syncContainerRegistries
• Usage: Agent-side endpoint a manager uses to push its registries: the given list REPLACES this instance’s registries, matched by id, and every registry not in it is deleted (an empty list deletes them all). Each item needs id, url, username, the plain-text token (an empty token clears the stored one), insecure, enabled, registryType, repositoryNames, createdAt and updatedAt. To push registries to an environment use environment.sync instead. registry.create/update/delete already propagate in the background.
• Related actions: environment.sync, registry.list

registry.tag_delete

Delete a repository tag

Delete the manifest a tag points to, which also removes every tag sharing its digest

• Kind: destructive — requires confirm: true
• Required parameters: id, repository, tag
• Meta tool: arcane_registry with "action": "tag_delete"
• Individual tool: arcane_registry_tag_delete
• Arcane route: DELETE /api/container-registries/{id}/tags
• Operation ID: deleteContainerRegistryTag
• Since: Arcane v2.15.0
• Usage: Deletes the manifest by digest in the remote registry, so every other tag of the same image disappears too. Irreversible. repository from registry.repositories, tag from registry.tags. The registry must allow deletes and the stored credentials need delete rights. Returns the deleted digest. It does not touch images on any Docker host: use image.delete for those.
• Related actions: registry.tags, registry.repositories, image.delete

registry.tags

List repository tags

List the tags of a registry repository with their manifest details

• Kind: read
• Required parameters: id, repository
• Meta tool: arcane_registry with "action": "tags"
• Individual tool: arcane_registry_tags
• Arcane route: GET /api/container-registries/{id}/tags
• Operation ID: listContainerRegistryTags
• Since: Arcane v2.15.0
• Usage: Lists the tags of one repository (a full name from registry.repositories, including any namespace of the registry URL, id from registry.list) with digest, mediaType, total size, per-platform os/architecture/size, and created for single-platform images. Manifest details are fetched only for the current page (limit, default 20). A tag whose manifest cannot be read carries error instead of failing the list. Tags with the same digest are one manifest, which registry.tag_delete removes together.
• Related actions: registry.repositories, registry.tag_delete

registry.test

Test a container registry

Test connectivity and authentication to a container registry

• Kind: write
• Required parameters: id
• Meta tool: arcane_registry with "action": "test"
• Individual tool: arcane_registry_test
• Arcane route: POST /api/container-registries/{id}/test
• Operation ID: testContainerRegistry
• Usage: Logs in through the Arcane instance’s local Docker daemon (not a remote environment’s) with the stored credentials (id from registry.list), so the registry must be reachable from the daemon, over TLS the daemon trusts (Docker uses plain HTTP only for 127.0.0.0/8 and configured insecure registries). ECR registries first obtain a token from AWS. Success returns “Authentication succeeded” (“ECR authentication succeeded” for ECR). A registry without credentials is reported as saved, not tested, and a bad login fails with “login failed”.
• Related actions: registry.list, registry.update, registry.create

registry.update

Update a container registry

Update an existing container registry

• Kind: write
• Required parameters: id, awsAccessKeyId, awsRegion, awsSecretAccessKey, description, enabled, insecure, registryType, repositoryNames, token, url, username
• Meta tool: arcane_registry with "action": "update"
• Individual tool: arcane_registry_update
• Arcane route: PUT /api/container-registries/{id}
• Operation ID: updateContainerRegistry
• Usage: Rewrites a registry (id from registry.list) and every field is required, so start from registry.get and send all of them back. token: "" keeps the stored token, but moving url to another host requires the token again. registryType cannot change. description and repositoryNames are replaced by what you send. enabled: false stops Arcane using the credentials without deleting them. The change is pushed to remote environments in the background. Failures there are only logged, so use environment.sync to retry one.
• Related actions: registry.get, registry.test, registry.list, environment.sync