Your images, one field away from deployed.
A managed private registry in the region your apps run in. Push with a Cosmoner API key — no cloud credentials to create, store, or rotate — and deploy from Apps by picking the repository from a list.
- 9 regions
- $1 / registry / month
- 10 GB egress included
- $0 to push
# one credential, and it is the one you already have$ docker login registry.cosmoner.com -u _token -p $COSMONER_API_KEYLogin Succeeded$ docker push registry.cosmoner.com/acme-labs/api:1.4.21.4.2: digest: sha256:9f21c0… pushed
- acme-labs/api12 images · 840 MB
- acme-labs/worker8 images · 410 MB
- acme-labs/base-nodepublic · cap 50 GB
STORAGE
$0.25/ GB · mo
Measured daily, across the organization
EGRESS
10 GBfree
Then $0.15/GB pulled
RETENTION
Keep last 10
Per-repository override
DEFAULT
Private
Scan on push, AES-256
Push once, deploy anywhere in the project
The pull secret you never have to create
Deploying from Docker Hub or GitHub Container Registry costs you a connected integration, a token to store, and a token to rotate before it expires. A registry you create here removes all three.
- 01
Push with your API key
The same docker push from your laptop or CI. There is no separate key id and secret, and nothing cloud-specific to configure first.
- 02
The repository appears in Apps
It shows up at the top of an app's container image step under Your registries, with no integration to connect beforehand.
- 03
Pick it and deploy
The image path fills itself in. Nothing to re-enter when the same image goes to a second app, and no pull secret to rotate.
A real registry underneath
Managed, not simplified
Cosmoner handles the infrastructure and the credentials. Everything you expect from a production registry is still there.
API-key authentication
Any organization member with a valid API key can push and pull. For the common path there are no cloud credentials to mint, store, or rotate.
docker login registry.cosmoner.com
Wired into Apps
Your repositories are offered directly in the deploy form. The platform already knows they belong to your project and pulls them for you.
No pull secret
Retention that runs itself
Keep a set number of recent images, expire untagged ones after a number of days, and override either setting per repository.
keepLastN · untaggedAfterDays
Scanning and encryption
Every push is scanned against known vulnerabilities. Images are encrypted at rest with AES-256, or with your own KMS key, and tags can be made immutable.
scanOnPush · IMMUTABLE · KMS
Public repositories, capped
Publish a base image or CLI for anonymous pulls, with a monthly egress cap so a popular — or scraped — repository cannot run up your bill.
visibility: PUBLIC
See what is actually stored
Every image with its tags, size, digest, push time, and last pull — including the untagged layers left behind by a moved tag, because they still cost storage.
Delete by digest
For everything that speaks ECR natively
Credentials scoped to one repository
When a Kubernetes cluster, a CI runner, or a partner needs native access, issue AWS credentials from IAM — scoped as tightly as the job allows.
- Push and pull for the one place images are built. Pull only for everything that merely runs them.
- Scope to a single repository, so a leaked key exposes one image instead of every image the project owns.
- Each repository shows how many credentials can reach it, and links to IAM filtered to that repository.
- Pulls made with them go straight from AWS to the client, so they are not metered as egress.
{ "label": "ci-pipeline", "access": "push", // "pull" for read-only "repositoryId": "cmsh95uld0000ce9kkchanq4y"}
# the secret is returned once and never stored$ aws ecr get-login-password --region eu-north-1 \$ | docker login --username AWS --password-stdin …Login Succeeded
Billed with the rest of the project
A dollar, plus what you keep and pull
Repositories are free — you are billed for the registry, what it stores, and what your clients download. All three appear as separate line items on the project's subscription.
- Registry fee
- $1 / month
- Per registry, prorated from the day you create it.
- Storage
- $0.25 / GB · mo
- Measured once a day at 02:00 UTC, totalled across every repository in your organization.
- Egress
- First 10 GB free, then $0.15 / GB
- Only the compressed layers a client actually downloads. The allowance covers your whole organization each billing period.
- Pushes
- $0
- Uploading images is never charged.
Preview the prorated registry fee, tax, and any credit applied before you create a registry. Storage and egress are metered after the fact.
One project
What it plugs into
The registry is most useful next to the things that pull from it, which live in the same project and on the same invoice.
Questions worth answering up front
The full details, including every endpoint and region, are in the Container Registry guide.
- How is storage measured?
- Once a day at 02:00 UTC, totalled across every repository in your organization. Your invoice reflects the most recent measurement in the period, so deleting large images — or letting retention expire them — lowers the next one.
- What counts as egress?
- Only the layers a client actually downloads. Layers the machine already holds, requests that just check whether an image exists, and pushes are never counted.
- Can I use it outside Cosmoner?
- Yes. It is a normal registry underneath: docker push and docker pull from any machine with a Cosmoner API key, and native AWS credentials on request for tooling that insists on speaking to ECR directly.
- Can I change the region later?
- No — the region is fixed when the registry is created, so pick one close to where your apps run. Tag mutability and scanning can be changed at any time and are re-applied to every existing repository.
- What happens when a public repository hits its cap?
- It becomes private again. Anonymous pulls stop, while your own project keeps pulling with an API key. The counter resets at the start of each billing period, and raising the cap starts a fresh allowance.
- What does deleting a registry remove?
- Every repository under it and all their images, permanently, and it stops all three charges. Metered usage already recorded in the current period is still invoiced.
Nine regions
Store images where your apps run
Pick a region close to your workloads so deployments pull over the shortest path. The region is fixed once the registry exists.
- us-east-1US East — N. Virginia
- us-east-2US East — Ohio
- us-west-2US West — Oregon
- eu-west-1Europe — Ireland
- eu-central-1Europe — Frankfurt
- eu-north-1Europe — Stockholm
- ap-southeast-1Asia Pacific — Singapore
- ap-southeast-2Asia Pacific — Sydney
- ap-northeast-1Asia Pacific — Tokyo
Not every region is open in every environment — the regions endpoint is the source of truth.