Registry credentials

To scan a private image, Image Scan needs a registry login. It only pulls the image: it never pushes, changes or deletes anything. So the credential should allow only that.

Leavory can’t see the credential’s scope

When saving, Leavory tests whether the login works, but it has no way to know what else the credential allows. An admin password passes the test exactly like a read-only token. Limiting the scope is the responsibility of whoever creates the credential. Follow the rules below.

Rules

Rule	Why
Read-only (pull). No push, delete or admin	If the credential leaks, nobody can publish a tampered image to your registry
Only the repositories that will be scanned, when the registry allows it	Limits exposure to what Leavory actually needs
A credential dedicated to Leavory, with a name like leavory-image-scan	You can revoke it without affecting anything else, and tell where each access came from in the registry logs
Never your personal password, the registry admin user or the token your pipeline uses to push	Those credentials allow much more than pulling images
With an expiration date, when the registry allows it	A forgotten credential stops working on its own
Revoke it when you remove the registry from Image Scan	An unused credential is only risk

What Leavory does with the credential

• Tests the login before saving. If the registry refuses it, nothing is stored.
• Stores the password or token encrypted. The screen never shows the value again.
• Uses the credential only to pull the images you added, in the first scan, the daily scan and Rescan.

Minimum scope per registry

Registry	Credential	Minimum scope	Can it be limited to repositories?
Docker Hub	Personal access token	Read-only	Not with a personal token; yes with an organization access token (Team and Business plans)
GitHub (ghcr.io)	Personal access token (classic)	only read:packages	No: it reads every package the user can see. Use a machine user
Quay	Robot account	Read	Yes, per repository
GitLab	Deploy token	only read_registry	Yes: create it on the project, not the group
Azure Container Registry	Token	content/read + metadata/read	Yes, with a custom scope map
Google Artifact Registry / GCR	Service account JSON key	Artifact Registry Reader role	Yes: grant the role on the repository, not the project

Step by step

Docker Hub

1. Account settings → Personal access tokens → Generate new token.
2. Access permissions: Read-only. Don’t use Read & Write or Read, Write, Delete.
3. Set an expiration date and generate the token.
4. In Image Scan: Username = your Docker Hub user; Access token = the token.

If your company has Docker Team or Business, prefer an organization access token with read access only to the repositories that will be scanned.

GitHub Container Registry (ghcr.io)

1. Settings → Developer settings → Personal access tokens → Tokens (classic) → Generate new token (classic).
2. Check only read:packages. Don’t check write:packages, delete:packages or repo.
3. Set an expiration and generate the token.
4. In Image Scan: Username = the GitHub user; Access token = the token.

Caution

GHCR doesn’t accept fine-grained tokens yet, so the token reads every package the user can see. Create the token on a machine user that only has access to the packages that will be scanned, not on your personal account.

Quay

1. In the organization: Robot Accounts → Create Robot Account, named leavory_image_scan.
2. Grant Read permission only on the repositories that will be scanned.
3. In Image Scan: Username = the robot’s full name (<organization>+leavory_image_scan); Access token = the robot token.

GitLab

1. In the project that holds the images: Settings → Repository → Deploy tokens → Add token.
2. Check only read_registry and set an expiration date.
3. In Image Scan: Username = the deploy token’s generated user; Access token = the token.

Prefer the project deploy token. A group deploy token reads the registry of every project in the group.

Azure Container Registry

Don’t use the ACR Admin user: it has full access to the registry.

1. In the ACR: Repository permissions → Scope maps → Add.
2. Choose only the repositories that will be scanned and check content/read and metadata/read on each.
3. Repository permissions → Tokens → Add, named leavory-image-scan, with the scope map you created.
4. Generate a token password with an expiration date.
5. In Image Scan: Username = the token name; Access token = the generated password.

The built-in _repositories_pull scope map is also read-only, but it covers every repository in the registry. Use it only if all of them should be scanned.

Google Artifact Registry and GCR

1. Create a dedicated service account, such as leavory-image-scan.
2. On the Artifact Registry repository (not the whole project), grant it the Artifact Registry Reader role (roles/artifactregistry.reader).
3. On the service account: Keys → Add key → JSON.
4. In Image Scan: Username = _json_key; Password = the entire content of the JSON file.

The JSON key doesn’t expire on its own. Note the date and rotate the key periodically.

Rotate or revoke a credential

1. Create the new credential in the registry.
2. In Image Scan, save the login again for the same registry: the new one replaces the old only after it passes the test.
3. Revoke the old credential in the registry.

To stop scanning images from a registry, remove the login in Image Scan and revoke the credential in the registry.