> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Run images from a private registry

By default, the `KubernetesPodOperator` expects to pull container images that are hosted publicly. If your images are hosted on the container registry native to your cloud provider, you can grant access to the images directly. Otherwise, if you are using any other private registry, you need to create a Kubernetes Secret containing credentials to the registry, then specify the Kubernetes Secret in your dag.

## Prerequisites

* An [Astro project](/docs/cli/v1.43/get-started-cli).
* An [Astro Deployment](/docs/astro/deployment-settings).
* Access to a private Docker registry.

## Setup

<Steps>
  <Step title="Create a Kubernetes Secret">
    To run Docker images from a private registry on Astro, a Kubernetes Secret that contains credentials to your registry must be created. Injecting this secret into your Deployment's namespace will give your tasks access to Docker images within your private registry.

    By default, the `KubernetesPodOperator` looks for publicly hosted images. However, you can pull images from a private registry.

    1. Retrieve a `config.json` file that contains your Docker credentials by following the [Docker documentation](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#registry-secret-existing-credentials). The generated file looks similar to the following:

       ```json title="config.json" wrap theme={null}
       {
           "auths": {
               "https://index.docker.io/v1/": {
                   "auth": "c3R...zE2"
               }
           }
       }
       ```

    2. Submit a request to [Astronomer support](https://cloud.astronomer.io/open-support-request) for creating a Kubernetes Secret to enable pulling images from private registries. Astronomer Support can provide you the necessary instructions on how to generate and securely send the credentials.
  </Step>

  <Step title="Specify the Kubernetes Secret in your dag">
    1. Astronomer adds the Kubernetes secret to your Deployment, Astronomer notifies you and provides you with the name of the secret.

    2. After you receive the name of your Kubernetes secret from Astronomer, you can run images from your private registry by importing `models` from `kubernetes.client` and configuring `image_pull_secrets` in your `KubernetesPodOperator` instantiation:

    ```python {1,5} wrap theme={null}
    from kubernetes.client import models as k8s

    KubernetesPodOperator(
        namespace=namespace,
        image_pull_secrets=[k8s.V1LocalObjectReference("<your-secret-name>")],
        image="<your-docker-image>",
        cmds=["<commands-for-image>"],
        arguments=["<arguments-for-image>"],
        labels={"<pod-label>": "<label-name>"},
        name="<pod-name>",
        task_id="<task-name>",
        get_logs=True,
        in_cluster=True,
    )
    ```
  </Step>
</Steps>