dokploy_registry (Resource)

A container registry login (Settings > Registry). Dokploy pulls private images with it, and pushes the images it builds to it when dokploy_application.registry_id references it.

~> Dokploy runs docker login on create and on update. A registry that the Dokploy server cannot reach, or a wrong user or password, fails the apply with Command execution failed. Dokploy stores the record only after the login succeeds.

~> The read endpoint omits the password. The provider cannot detect a password that changed in the Dokploy UI, and terraform import leaves password empty: set it in the configuration and apply once. The password_wo companion keeps the password out of the Terraform state.

Example Usage

# A GitHub Container Registry login. Dokploy pulls private images with it
# and pushes the images it builds when an application references it.
resource "dokploy_registry" "ghcr" {
  name     = "ghcr"
  url      = "ghcr.io"
  username = "my-org-bot"

  # Write-only: Terraform 1.11 or later. Dokploy runs `docker login` on every
  # create and update, so the token must be valid at apply time.
  password_wo         = var.ghcr_token
  password_wo_version = 1

  # Images are pushed as ghcr.io/my-org/<app name>.
  image_prefix = "my-org"
}

# Push the built image of an application to the registry.
resource "dokploy_application" "api" {
  name           = "api"
  environment_id = dokploy_project.app.production_environment_id
  registry_id    = dokploy_registry.ghcr.id

  github = {
    github_id  = data.dokploy_github_provider.main.id
    owner      = "my-org"
    repository = "api"
    branch     = "main"
  }
}

# A self-hosted registry on a custom port.
resource "dokploy_registry" "internal" {
  name     = "internal"
  url      = "registry.internal.example.com:5000"
  username = "deploy"
  password = var.internal_registry_password
}

Schema

Required

• name (String) Display name. Dokploy does not enforce a unique name.
• url (String) Registry host, with an optional port and without a scheme, for example ghcr.io, registry.example.com:5000, or docker.io.
• username (String) Login user.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• image_prefix (String) Path that Dokploy puts in front of each image name it pushes, for example an organization or a project on the registry. If you remove it from the configuration, the provider clears it.
• password (String, Sensitive) Login password or access token. Set this attribute or password_wo.
• password_wo (String, Sensitive, Write-only) Write-only form of password. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of password and password_wo. A new value reaches the server only when password_wo_version changes.
• password_wo_version (Number) Version of password_wo. Change it to send the current password_wo value to the server. It needs password_wo.
• registry_type (String) Registry type. Dokploy v0.30.5 accepts only cloud, which covers every external registry. Defaults to cloud.

Read-Only

• created_at (String) Creation timestamp from the server.
• id (String) Registry id. dokploy_application.registry_id references it.
• organization_id (String) Id of the organization that owns the registry.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The password is not readable through the API: set it in the configuration
# and apply once after the import.
terraform import dokploy_registry.ghcr NMnoMScQ5m2MjGwlsc-gG