> ## Documentation Index
> Fetch the complete documentation index at: https://docs.microsandbox.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Registry commands

> Manage credentials for local image pulls

Manage credentials for local image pulls. These commands update the local credential store; cloud credentials are managed separately.

## msb registry login

Store a registry username and password. Without `--password-stdin`, the CLI prompts for the password.

```bash theme={null}
msb registry login ghcr.io --username octocat
```

| Argument / flag         | Description                           |
| ----------------------- | ------------------------------------- |
| `REGISTRY`              | Registry hostname, such as `ghcr.io`  |
| `-u`, `--username USER` | Required registry username            |
| `--password-stdin`      | Read the password or token from stdin |

<Accordion title="Read a token from stdin">
  ```bash theme={null}
  printf '%s\n' "$GHCR_TOKEN" | \
    msb registry login ghcr.io --username octocat --password-stdin
  ```
</Accordion>

Passwords go in the OS credential store. Only metadata is written to the local configuration.

## msb registry logout

Remove stored credentials for a registry.

```bash theme={null}
msb registry logout ghcr.io
```

## msb registry list

List configured registries without printing passwords. Aliases: `msb registry ls`, `msb registries`, and `msb regs`.

```bash theme={null}
msb registries
```

## Headless authentication

For CI, configure `registries.hosts.<host>.auth.password_env` in `~/.microsandbox/config.json`. Advanced setups can use `secret_name` to reference a file under `~/.microsandbox/secrets/registries/`.

Credentials are resolved in this order: explicit SDK auth, OS credential store, registry auth configuration, Docker configuration, then anonymous access.