Registry access

bifrost can generate SBOMs from the container images that run in your environments. For images in private registries, bifrost needs read access. With access, bifrost creates image SBOMs for your services and continuously tracks CVEs for what is running. See SBOM for how CVE tracking works.

How registry access works

Add credentials under Organization settings → Image registries. Each credential has:

• Registry endpoint: the registry host, optionally followed by a repository path, for example harbor.example.com or harbor.example.com/payments. When several endpoints match an image, the most specific one is used, so harbor.example.com/payments takes precedence over harbor.example.com for harbor.example.com/payments/api:1.0.
• Username and Password: basic authentication credentials with pull access.

Keep these in mind:

• Use read-only credentials. bifrost only pulls images.
• The registry must be reachable from the internet, since bifrost pulls images from its own infrastructure.

Harbor

Create a robot account with pull access:

1. Open the project and go to Robot Accounts → New Robot Account.
2. Grant the Pull permission for repositories.
3. Copy the robot account name and secret.

Field	Value
Endpoint	harbor.example.com/<project>
Username	The robot account name, for example robot$payments+bifrost
Password	The robot account secret

Docker Hub

Create a personal access token:

1. Go to Account settings → Personal access tokens → Generate new token.
2. Select the Read-only access permission.

Field	Value
Endpoint	docker.io/<namespace>
Username	Your Docker ID
Password	The personal access token

On Docker Team and Business plans, you can use an organization access token instead, with the organization name as the Username.

Google Artifact Registry

Use a service account key:

1. Create a service account and grant it the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository or project.
2. Create a JSON key for the service account.

Field	Value
Endpoint	<region>-docker.pkg.dev/<project>, for example europe-west1-docker.pkg.dev/my-project
Username	_json_key
Password	The JSON key

Not supported yet

• Amazon ECR only issues short-lived passwords, which cannot be stored as static credentials.
• Cloud identities, such as GCP workload identity or Azure managed identities, are not supported.