---
title: Registry commands
sidebarTitle: "Registries"
description: Manage credentials for local image pulls
icon: "key"
---

Manage credentials for local image pulls. These commands update the local credential store; cloud credentials are managed separately.

## msb registry login

Store a registry username and password. Without `--password-stdin`, the CLI prompts for the password.

```bash
msb registry login ghcr.io --username octocat
```

| Argument / flag | Description |
| --- | --- |
| `REGISTRY` | Registry hostname, such as `ghcr.io` |
| `-u`, `--username USER` | Required registry username |
| `--password-stdin` | Read the password or token from stdin |

<Accordion title="Read a token from stdin">

```bash
printf '%s\n' "$GHCR_TOKEN" | \
  msb registry login ghcr.io --username octocat --password-stdin
```

</Accordion>

Passwords go in the OS credential store. Only metadata is written to the local configuration.

## msb registry logout

Remove stored credentials for a registry.

```bash
msb registry logout ghcr.io
```

## msb registry list

List configured registries without printing passwords. Aliases: `msb registry ls`, `msb registries`, and `msb regs`.

```bash
msb registries
```

## Headless authentication

For CI, configure `registries.hosts.<host>.auth.password_env` in `~/.microsandbox/config.json`. Advanced setups can use `secret_name` to reference a file under `~/.microsandbox/secrets/registries/`.

Credentials are resolved in this order: explicit SDK auth, OS credential store, registry auth configuration, Docker configuration, then anonymous access.