Container Registry networking

Public endpoint

Every registry has a public HTTPS endpoint in the form <name>-<id>.upcloudcr.com, shown as Registry endpoint on the registry's Overview tab. The endpoint has a publicly trusted TLS certificate, so no extra client configuration is needed.

The endpoint is reachable over IPv4 on port 443. Right after the registry is created, it may not resolve in DNS yet.

To restrict which addresses can use the public endpoint, use the IP allowlist.

Private networks

On the Pro plan, SDN Private Networks in the locations of the registry's region can be attached so that workloads on those networks reach the registry without traversing the public internet. Attach networks while creating the registry or later from the Networks tab. Up to five private networks can be attached.

The network must be in one of those locations, listed on the Availability page, and have an SDN Router attached. See How to connect private networks using SDN Router.

Attaching a network gives the registry a second, private endpoint with -private added to the name:

my-registry-1b77d021-private.upcloudcr.com

While the private endpoint is set up, the registry's status shows Setting up private access. The endpoint is ready to use when the network shows as Active on the Networks tab and the registry's status is back to Running.

Use the private endpoint in image references on servers and clusters in the attached network. The public endpoint keeps working alongside it, subject to the IP allowlist.

Registry credentials are matched by hostname, so log in or create Kubernetes image pull secrets for the private endpoint separately from the public one. For Managed Kubernetes, see How to use Container Registry with Managed Kubernetes.