rarecloud
PRIVATE DOCKER AND OCI IMAGESBETA

Container Registry

Your private images, ready for Kubernetes.

A private registry for your account, under your own handle on registry.rarestack.net. Push from your laptop or CI, then link a RareCloud Kubernetes cluster once and every namespace can pull.Free tier with 10 GB · paid tiers from €3.50/month · no transfer fees · engineers on support 24/7

Get StartedEnable the Registry
  • Start Free

    Free

    €0/mo
    • 10 GB included
    • Up to 20 repositories

    Pushes stop at 10 GB.

  • Starter

    Recommended
    €3.50/mo
    • 20 GB included
    • Up to 100 repositories

    Room to grow to 40 GB.

  • Premium

    €7.50/mo
    • 50 GB included
    • Up to 500 repositories

    Room to grow to 100 GB.

  • Enterprise

    €15/mo
    • 1,024 GB included
    • Up to 2,000 repositories

    Room to grow to 2,048 GB.

Beta prices, excluding VAT. Paid tiers are billed by the hour and stop at the monthly price. Storage above the included amount costs €0.02 per GB a month, up to twice the included storage. No transfer fees on pushes or pulls.

From Build to Cluster in Four Steps

Enable the registry in the console, with the rarecloud CLI, with Terraform or through the REST API. After that, Docker and Kubernetes work the way you already use them.

  1. 01

    Choose your handle

    Pick a tier and a handle. The handle is yours for good, and every image you push lives under it.

  2. 02

    Create a credential

    One robot login per CI job, laptop or cluster, with pull or push access. The secret is shown once.

  3. 03

    Push your image

    Log in with Docker or any OCI tool and push. The first push creates the repository.

  4. 04

    Run it

    Pull it anywhere with a credential, or link a RareCloud Kubernetes cluster and use the image name.

# Log in with a registry credential (username <handle>+<name>)
echo "$REGISTRY_SECRET" | docker login registry.rarestack.net \
  -u acme+ci --password-stdin

# Tag and push. The first push creates the repository.
docker tag myapp:latest registry.rarestack.net/acme/myapp:1.0
docker push registry.rarestack.net/acme/myapp:1.0

# Pull it from any machine that has a credential
docker pull registry.rarestack.net/acme/myapp:1.0

Read the registry docsRead the API referenceInstall the CLI

Pull Secrets Without the Chores

Copying a pull secret into every namespace by hand is the part everyone forgets. Link a RareCloud cluster and it is done for you, in the namespaces you have now and the ones you add later.

A cluster you run yourself

  • Get a ready-to-apply Kubernetes Secret for a cluster you run yourself, anywhere.
  • Choose the namespace, pull or push access, and an expiry of 30 days, 90 days, a year or none.
  • Apply it with kubectl and reference it from your pods with imagePullSecrets.
  • Each manifest is its own credential, which you can revoke whenever you like.

A RareCloud Kubernetes cluster

  • Link a cluster in one step, or tick the registry box when you create a new cluster in the console.
  • A small controller keeps a pull secret in every namespace and attaches it to the service accounts, so pods pull by image name.
  • It can read or change only secrets with that one name, and you can keep any namespace out with a label.
  • Rotate the cluster's credential without a gap, or unlink to remove everything it installed.

See Managed Kubernetes

Included in Every Tier

Free or Enterprise, every registry has the same features. The tier only sets how much you store and how many repositories you keep.

Your Own Namespace
Choose a handle once and every image lives under registry.rarestack.net/your-handle, so the names you want are never taken by another customer.
Robot Credentials
Give each CI job, laptop or cluster its own login, pull-only or push. Set an expiry from the CLI, Terraform or the API. Revoke a credential and it stops working at once.
Docker and OCI Tools
Log in, push and pull with Docker, Podman or any other OCI client, from your laptop or from any CI system that can run docker login.
Kubernetes Pull Secrets
Link a RareCloud Kubernetes cluster once and every namespace, including the ones you create later, can pull your images.
Tags and Digests
See your repositories and their tags. Delete one tag, an image by its digest with every tag on it, or a whole repository.
Untagged Images Cleaned Up
An image left without a tag is removed after about 8 days, so old builds stop taking space. Tagged images stay until you delete them.
Usage Every Hour
Stored size and repository count are measured every hour, and the console shows whether a push would be accepted right now, and why not if it would not.
No Transfer Fees
You pay for the storage your images use. Pushes and pulls carry no transfer fee, and the storage limits never block a pull.

  • Stored in the EU

    Your images are stored in the EU, and every invoice comes from an EU company with EU VAT.

  • 7 Days to Change Your Mind

    Close the registry and your images wait 7 days. Reopen it with the same handle and everything is still there.

The Rest of the Cloud

Clusters, servers, buckets and load balancers are in the same account and console, and on the same monthly invoice as your registry, paid from your account credit by card, PayPal, Alipay, crypto or bank transfer.

Kubernetes

Managed clusters

Managed Kubernetes with the control plane included. Worker nodes cost the same as Cloud VMs.

Workers from €7.99/mo

See Kubernetes

Cloud VM

Hourly cloud servers

Servers with NVMe storage and a public IPv4, billed by the hour up to the monthly price.

From €3.99/mo

See Cloud VM

Object Storage

S3-compatible

Buckets for backups, media and build artifacts, used with the S3 tools you already know.

€10/mo with 1 TB

See Object Storage

Load Balancers

L4, one stable IP

One public address in front of several servers, sending traffic only to the ones that pass health checks.

€9/mo with its public IP

See Load Balancers

Questions Before You Push

What does the registry cost?
Free is €0 a month with 10 GB of storage. Starter is €3.50 a month with 20 GB, Premium €7.50 with 50 GB and Enterprise €15 with 1,024 GB. On a paid tier you can store up to twice the included amount, and the storage above it costs €0.02 per GB a month. Pushes and pulls have no transfer fee. These are beta prices, excluding VAT.
How is storage counted?
By the size of your images, in GB of 1,000,000,000 bytes, measured every hour. A layer shared by two repositories counts in each of them. Deleting a tag leaves the image in place, and an image left without tags is removed after about 8 days. To remove an image at once, delete it by its digest.
What happens when I reach my limit?
On the Free tier, pushes stop at 10 GB until you delete images or move to a paid tier. On a paid tier, pushes keep working up to twice the included storage, and the extra is billed at €0.02 per GB a month. A push is also refused when you reach your tier's repository count, or when your balance does not cover 72 hours of the registry's cost. None of these ever blocks a pull.
How is it billed?
A paid tier's fee is billed by the hour and stops at the monthly price, and a tier change applies from the hour you make it. Storage above the included amount is billed by the hour as well. Everything goes on your monthly cloud invoice, next to your servers, and is paid from your account credit. Top up by card, PayPal, Alipay, crypto or bank transfer, in EUR or USD.
Which tools can push and pull?
Docker, Podman and any other client that speaks the OCI registry protocol. In CI, store a push credential as a secret and run docker login registry.rarestack.net with it before you build and push.
How do credentials work?
Each credential has a name, and its username is your handle plus that name, for example acme+ci. It can pull, or push and pull, across all your repositories, and from the CLI, Terraform or the API you can give it an expiry date. The secret is shown once, when you create it. An account can have up to 20 active credentials, and a revoked one stops working at once.
How does the Kubernetes link work?
Linking a RareCloud Kubernetes cluster creates a pull-only credential for it and installs a small controller in the cluster. The controller keeps a secret named rarecloud-registry-credentials in every namespace, present and future, and adds it to each service account, so your pods pull by image name. It may read or change only secrets with that exact name. It skips kube-* namespaces, monitoring and the platform's own namespaces, and you can keep any namespace or service account out with the label rarecloud.io/registry-secret=disabled. Rotating replaces the credential without a gap, and unlinking removes everything it installed.
Can I use it with a cluster outside RareCloud?
Yes. Ask the console, the CLI or the API for a pull-secret manifest: a ready Kubernetes Secret for the namespace you choose, with pull or push access and an expiry of 30 days, 90 days, a year or none. Apply it with kubectl and reference it from your pods. Each manifest is a new credential, and you can revoke it whenever you like.
Can I make an image public?
Not today. Every pull needs one of your credentials.
Does it scan images for vulnerabilities?
Not today. Run your scanner in your CI pipeline before you push.
What do I need to start?
A RareCloud account and a handle you want in your image names. Enabling the registry runs the same balance check as any cloud order, the Free tier included: a newer account needs a balance that covers what it already runs. The handle can never be changed, and some words are reserved.
What happens if I close the registry?
Your images are not deleted right away. For 7 days you can reopen the registry with the same handle and everything is still there. After that, the stored images are deleted for good.
Can I manage it from the CLI, Terraform or an AI agent?
Yes. The rarecloud CLI has registry commands for the account, credentials, repositories, tags and cluster links, and the Terraform provider has rarecloud_registry, rarecloud_registry_credential, rarecloud_registry_cluster_link and rarecloud_registry_kubernetes_manifest. All of them use the same REST API as the console. The RareCloud MCP server has no registry tools yet, so an agent can use the CLI or the API.
Where are my images stored?
In the EU. Invoices come from Rare Mood Agency SRL (RareCloud), registered in Romania, with EU VAT, in EUR or USD. Businesses in another EU country with a valid VAT ID are invoiced without VAT, under the reverse charge.

Your Private Registry, 10 GB Free

Pick a handle, create a credential and push your first image.

Enable the Registry