Source and image access
Connect repositories and authorize container images, with credentials scoped to one application.
Sources Runtime accepts
| Source | Description |
|---|---|
| Git repository | Runtime fetches the repository you connect, including submodules, and verifies host keys for SSH. |
| Archive | A source archive you provide. |
| Container image | An image you authorize, pulled with this application's credentials. |
Credentials
- Repository and registry credentials belong to one application. Runtime never falls back to another application's credentials or to id0n's own.
- Registry credentials are pull-only. They are used to fetch images, not to publish them.
- Each fetch is checked against the application that requested it, and bound to the exact content that was accepted.
Images that include cache metadata
An image you authorize may already contain build cache metadata. Runtime accepts the image, but the metadata does not give it access to any other cached content.
Security
- Use a credential with read-only access to just the repository or registry the application needs.
- Remove a credential from the application when you rotate it at the source.