> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-container/kubernetes-integration/install-the-snyk-controller/authenticate-to-private-container-registries.md). # Authenticate to private container registries If you are using private container registries, you must create a `dockercfg.json` file that contains the credentials to the registry. Then you must create a secret, which must be called `snyk-monitor`. The `dockercfg.json` file is necessary to allow the monitor to look up images in private registries. Usually, your credentials are in `$HOME/.docker/config.json`. However, the credentials must also be added to the `dockercfg.json` file. The Snyk Controller is not able to access these registries if the credentials are only stored in `$HOME/.docker/config.json` The steps below explain how to authenticate to private container registries. ## Configure the dockercfg.json file Create a file named `dockercfg.json`. Store your credentials in this file. {% hint style="info" %} Ensure the file containing your credentials is named `dockercfg.json`. This filename is required by the `snyk-monitor`. {% endhint %} {% hint style="info" %} Ensure the formatting is correct, including new line characters and whitespace in the `dockercfg.json` file. Malformed files will result in authentication failures. {% endhint %} The locations where your cluster runs and where your registries run determine the combination of entries in your `dockercfg.json` file. The file can contain credentials for multiple registries. If your credentials are already in `$HOME/.docker/config.json`, copy this information to the `dockercfg.json` file. If the `auth` entry is empty in the `$HOME/.docker/config.json`, run the following command and paste the output to `auth` entry in `dockercfg.json`: ``` echo -n 'username:password' | base64 ``` ### Examples of dockercfg.json file configuration #### For private registries other than Nexus If your cluster does not run on `GKE`, or it runs on `GKE` and pulls images from other private registries, your`dockercfg.json` file must contain: ```json { "auths": { "gcr.io": { "auth": "BASE64-ENCODED-AUTH-DETAILS" }, // Add other registries as necessary, for example: ".azurecr.io": { "auth": "BASE64-ENCODED-AUTH-DETAILS" } } } ``` #### For Nexus Repository If you are using Nexus Repository\*\*,\*\* your `dockercfg.json` file must contain: ```json { "auths": { "": { "auth": "BASE64-ENCODED-AUTH-DETAILS" }, } } ``` #### For Artifactory Container Registry If you are using Artifactory Container Registry to host multiple private repositories\*\*,\*\* your `dockercfg.json` file must contain: ```json { "auths": { "": { "auth": "BASE64-ENCODED-AUTH-DETAILS" }, "": { "auth": "BASE64-ENCODED-AUTH-DETAILS" } } } ``` #### For GKE using GCR If your cluster runs on `GKE` and you are using `GCR`, your`dockercfg.json` file must contain: ```json { "credHelpers": { "us.gcr.io": "gcloud", "asia.gcr.io": "gcloud", "marketplace.gcr.io": "gcloud", "gcr.io": "gcloud", "eu.gcr.io": "gcloud", "staging-k8s.gcr.io": "gcloud" } } ``` #### For GKE using Google Artifact Registry (GAR) If your cluster runs on `GKE` and you are using `GAR`, your`dockercfg.json` file must contain: ```json { "auths": { "northamerica-northeast2-docker.pkg.dev": { "auth": ")" | base64"} } } ``` This method relies on creating a service account. See [Google Cloud service account key](https://cloud.google.com/artifact-registry/docs/docker/authentication#json-key). Ensure you have the raw key saved to a file. #### For EKS using ECR If your cluster runs on `EKS` and you are using `ECR`, add the following: ```json { "credsStore": "ecr-login" } ``` To use this credential helper for a specific `ECR` registry, create a credHelpers section with the URI of your ECR registry: ```json { "credHelpers": { "public.ecr.aws": "ecr-login", ".dkr.ecr..amazonaws.com": "ecr-login" } } ``` #### For AKS using ACR If your cluster runs on `AKS` and you're using `ACR`, add the following: ```json { "credHelpers": { "myregistry.azurecr.io": "acr-env" } } ``` {% hint style="info" %} In addition, for clusters running on AKS and using ACR, see [Entra ID Workload Identity service account](https://azure.github.io/azure-workload-identity/docs/topics/service-account-labels-and-annotations.html#service-account). It is possible that you are required to configure labels and annotations on the `snyk-monitor` ServiceAccount. {% endhint %} You can configure different credential helpers for different registries. ## Create the Kubernetes secret Create the secret in Kubernetes by running the following command: {% code overflow="wrap" %} ```sh kubectl create secret generic snyk-monitor -n snyk-monitor \ --from-file=./dockercfg.json \ --from-literal=integrationId=abcd1234-abcd-1234-abcd-1234abcd1234 \ --from-literal=serviceAccountApiToken=aabb1212-abab-1212-dcba-4321abcd4321 ``` {% endcode %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-container/kubernetes-integration/install-the-snyk-controller/authenticate-to-private-container-registries.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.