Repository navigation
Feature request: Support 3rd party private container registries + authentication like EKS #432
Description
Problem
Substrate's atelet currently only supports GCP Application Default Credentials for authenticating image pulls (--gcp-auth-for-image-pulls). Users running on other cloud providers — EKS (AWS ECR), AKS (Azure ACR), or self-hosted registries — have no way to pull images from private registries.
Current behavior
- GCP ADC auth is supported via --gcp-auth-for-image-pulls
- Local/localhost registry rewrites are supported via --localhost-registry-replacement
- No support for AWS ECR, Azure ACR, GHCR, or generic Docker credential helpers
Proposed solution
Add pluggable registry authentication so operators can configure credentials for any OCI-compatible private registry. At minimum:
- AWS ECR — IAM Roles for Service Accounts (IRSA) / instance profile token refresh
- Azure ACR — Workload Identity / managed identity
- Generic — static imagePullSecrets-style config (username/password or token) for self-hosted registries (Harbor, Artifactory, GHCR, etc.)
This likely maps to adding new flags or a credentials config file to atelet, and wiring additional authenticators into the go-containerregistry keychain used during image pulls (cmd/atelet/main.go).
Why it matters
Many teams run AI agent workloads on EKS or AKS and store their agent images in ECR/ACR. Without this, Substrate is effectively GCP-only for private image use cases.
Activity
Stevenjin8 commentedon Aug 5, 2026
please assign this to me
yelshall commentedon Aug 18, 2026
Is #917 related here? cc Benjamin Elder (@BenTheElder)
BenTheElder commentedon Aug 24, 2026
Yes, absolutely. #917 opens up semi-automatic support in a standard way.
I would appreciate some tests on EKS, I've been able to test on GKE, on AKS we understand the non-statically linked binary is a minor obstacle.
BenTheElder commentedon Oct 1, 2026
#917
NOTE: on AKS you will need to build atelet with a base image containing libc for now since their credential helper is not a static binary. TBD how we follow-up on that but there's an immediate solution for now.
BenTheElder commentedon Oct 2, 2026
#2104 small fix
After that, I think we should just ship a stable boring old glibc by default in atelet.
It's mildly annoying to need to patch this but not that big of a deal and it will unblock azure etc by default.
I think I also hit this on GKE ubuntu nodes while doing some follow-up patching (#2104).
Iterating on that. Then I think this is really "done" for now.
atelet: use a glibc base image to support credential providers (agent…