sincecutoff.com
/v1/json /v1/md llms.txt
← all changes

wrangler containers registries configure supports Google Artifact Registry credentials

Introduced 2026-06-25 · score 0.98

HOW TO USE IT

For a Google Artifact Registry host matching `*-docker.pkg.dev`, configure access with the service account email and key. The email must match the key’s `client_email`; if reusing an existing Secrets Store secret, omit the key and Wrangler validates it when images are pulled.

cat <PATH_TO_KEY.json> | npx wrangler containers registries configure <REGION>-docker.pkg.dev --gar-email=<SERVICE_ACCOUNT_EMAIL> --secret-name=<SECRET_NAME> --skip-confirmation
npx wrangler containers registries configure <REGION>-docker.pkg.dev --gar-email=<SERVICE_ACCOUNT_EMAIL> --secret-name=<EXISTING_SECRET_NAME> --skip-confirmation

WHY THIS HELPS

Configure a repository’s container registry access for images hosted in Google Artifact Registry.

REQUIREMENTS AND LIMITATIONS

  • Version: 4.105.0
  • DOMAIN (required): Registry domain; for Google Artifact Registry, use a `*-docker.pkg.dev` host.
  • --gar-email: Google service account email for the registry; must match `client_email` in the service account key.
  • stdin secret: Service account JSON key as a file path, raw JSON, or base64; not needed when reusing an existing secret.
  • --secret-store-id: ID of the Secrets Store for registry credentials.
  • --secret-name: Name under which Wrangler stores the registry credentials, or the name of the existing secret to reuse.
  • credential flags: Registry credential flags are mutually exclusive; use the one matching the registry provider.
  • Prerequisite: Create a Google service account and grant it the Artifact Registry Reader role; obtain its JSON key.
  • Prerequisite: Supported Google registry hosts match `*-docker.pkg.dev`; `gcr.io` and `*.gcr.io` are unsupported.
  • The `--gar-email` value must match `client_email` in the service account key.
  • The service account JSON key is provided via stdin (a file path, raw JSON, or base64) or an interactive prompt (a file path or base64); it is never a CLI flag.
  • When the target Secrets Store secret already exists, it is reused by reference and the key is not required.
  • When reusing an existing secret, the email cannot be verified locally; it is validated against the key when images are pulled.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card