Docker registry

The Docker tool gives a workbench agent read-only access to a Docker or OCI container registry, such as Docker Hub, GitHub Container Registry, Amazon ECR Public, or a private registry. The agent can list and search the tags in a repository, find the latest released versions of an image, and fetch an image manifest. Use it to answer questions such as which version of an image is newest, whether a tag exists, or which platforms a multi-architecture image supports.

In Console, this integration appears as the Docker / OCI registry card. For the complete list of integrations and general tool behavior, see Workbench tools.

Prerequisites

Before you begin, make sure you have:

• A registry that Plural Console can reach over HTTPS on the standard port and that implements the OCI Distribution API, the same API that docker pull uses.
• Read credentials for the registry, unless the repositories you want to inspect allow anonymous reads.
• Permission in Plural Console to create a configured tool and edit the target workbench.
• An existing workbench, or permission to create one. See Setting up a workbench.

Prepare credentials

Public repositories on Docker Hub, GitHub Container Registry, Amazon ECR Public, and similar registries need no credentials. For private repositories, create a dedicated credential with read-only access to only the repositories the workbench needs:

• Docker Hub — create a Docker Hub access token with read-only repository access. Use it as the password together with your Docker Hub username in Basic auth. An organization access token can be limited to specific repositories.
• GitHub Container Registry — create a personal access token (classic) with the read:packages scope. GitHub Packages accepts only classic tokens. Use it as the password together with your GitHub username in Basic auth.
• Other registries — use a username and password or token that the registry accepts for docker login, or a pre-issued bearer token with read access.

Capabilities

The Docker tool is read-only. It cannot push, retag, or delete images. Each configured tool gives the agent three operations. The agent sees each one as docker_<tool name>_<operation>, where <tool name> is the configured tool's name: