dokploy_registry (Resource)

A container registry login (Settings > Registry). Dokploy pulls private images with it, and pushes the images it builds to it when dokploy_application.registry_id references it.

~> Dokploy runs docker login on create and on update. A registry that the Dokploy server cannot reach, or a wrong user or password, fails the apply with Command execution failed. Dokploy stores the record only after the login succeeds.

~> The read endpoint omits the password. The provider cannot detect a password that changed in the Dokploy UI, and terraform import leaves password empty: set it in the configuration and apply once. The password_wo companion keeps the password out of the Terraform state.

Example Usage

# A GitHub Container Registry login. Dokploy pulls private images with it
# and pushes the images it builds when an application references it.
resource "dokploy_registry" "ghcr" {
  name     = "ghcr"
  url      = "ghcr.io"
  username = "my-org-bot"

  # Write-only: Terraform 1.11 or later. Dokploy runs `docker login` on every
  # create and update, so the token must be valid at apply time.
  password_wo         = var.ghcr_token
  password_wo_version = 1

  # Images are pushed as ghcr.io/my-org/<app name>.
  image_prefix = "my-org"

  # Test the login before the provider writes the record.
  verify_connection = true
}

# Push the built image of an application to the registry.
resource "dokploy_application" "api" {
  name           = "api"
  environment_id = dokploy_project.app.production_environment_id
  registry_id    = dokploy_registry.ghcr.id

  github = {
    github_id  = data.dokploy_github_provider.main.id
    owner      = "my-org"
    repository = "api"
    branch     = "main"
  }
}

# A self-hosted registry on a custom port.
resource "dokploy_registry" "internal" {
  name     = "internal"
  url      = "registry.internal.example.com:5000"
  username = "deploy"
  password = var.internal_registry_password
}

# Test the login before the provider writes the record. If the test fails,
# the apply fails and the provider writes nothing. The token is write-only:
# Terraform does not write it to the plan or to the state.
resource "dokploy_registry" "checked" {
  name     = "ghcr-checked"
  url      = "ghcr.io"
  username = "my-org-bot"

  password_wo         = var.ghcr_token
  password_wo_version = 1

  verify_connection = true
}

Schema

Required

• name (String) Display name. Dokploy does not enforce a unique name.
• url (String) Registry host, with an optional port and without a scheme, for example ghcr.io, registry.example.com:5000, or docker.io.
• username (String) Login user.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• image_prefix (String) Path that Dokploy puts in front of each image name it pushes, for example an organization or a project on the registry. If you remove it from the configuration, the provider clears it.
• password (String, Sensitive) Login password or access token. Set this attribute or password_wo.
• password_wo (String, Sensitive, Write-only) Write-only form of password. Terraform keeps it out of the plan and the state. It needs Terraform 1.11 or later. Set exactly one of password and password_wo. A new value reaches the server only when password_wo_version changes.
• password_wo_version (Number) Version of password_wo. Change it to send the current password_wo value to the server. It needs password_wo.
• registry_type (String) Registry type. Dokploy v0.30.5 accepts only cloud, which covers every external registry. Defaults to cloud.
• verify_connection (Boolean) Test the connection with registry.testRegistry before the provider creates or updates the record. If the test fails, the apply fails with the server message, and the provider writes nothing. The default is no check: null and false both skip the test. Dokploy stores no value for this attribute, so terraform import leaves it null. Dokploy already runs docker login on create and on update, so this attribute adds an early check only.

Read-Only

• created_at (String) Creation timestamp from the server.
• id (String) Registry id. dokploy_application.registry_id references it.
• organization_id (String) Id of the organization that owns the registry.

Import

Import is supported using the following syntax:

In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:

# The password is not readable through the API: set it in the configuration
# and apply once after the import.
import {
  to = dokploy_registry.ghcr
  id = "NMnoMScQ5m2MjGwlsc-gG"
}

The terraform import command can be used, for example:

terraform import dokploy_registry.ghcr NMnoMScQ5m2MjGwlsc-gG