> ## Documentation Index
> Fetch the complete documentation index at: https://enterprise-docs.crewai.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Internal Container Registry Configuration
> Optional Docker registry v2 deployment for container image storage and distribution. Particularly useful for air-gapped environments or when building and deploying custom crew images.
The internal registry is **not recommended** as a primary
registry. It's recommended to use an external container registry (AWS ECR,
Azure ACR, Google Artifact Registry, Harbor, etc.) for production deployments.
Enable or disable the internal container registry deployment.
**Use Cases:**
* Air-gapped deployments without external registry access
* Development/testing environments
* Pull-through cache for external registries
* Storing custom crew container images
Number of registry replicas to deploy.
**High Availability:** For production-like environments, deploy 2+ replicas with shared storage (S3 backend).
### `internalRegistry.image.*`
Registry container image configuration.
Container registry hosting the registry image.
**Default:** `""` (empty) - Automatically uses `global.imageRegistry` value
**Fallback Behavior:**
When `internalRegistry.image.host` is empty or not set, the chart uses `global.imageRegistry` via the `crewai-platform.internalRegistryImageRegistry` template helper.
**When imageNamePrefixOverride is Set:**
The image name is automatically simplified:
* Original: `proxy/crewai/dockerhub/library/registry`
* With `imageNamePrefixOverride: "crewai/"` becomes: `crewai/registry`
See [global.imageNamePrefixOverride](/reference/chart-values/global#param-global-image-name-prefix-override) for details.
**Example:**
```yaml theme={null}
global:
imageRegistry: "registry.company.com"
internalRegistry:
enabled: true
image:
host: "" # Automatically uses registry.company.com
name: "proxy/crewai/dockerhub/library/registry"
tag: "2"
```
Registry container image name.
**Default:** `"proxy/crewai/dockerhub/library/registry"` - Matches Replicated proxy path structure
**Path Transformation:**
When `global.imageNamePrefixOverride` is set, only the final component (`registry`) is used with the override prefix.
Registry image version tag.
Image pull policy for registry container.
Image pull secret for registry image. If empty, uses the global `image.pullSecret`.
Backend storage type for registry images.
**Valid Values:**
* `"s3"` - Use S3-compatible object storage (recommended)
* `"filesystem"` - Use persistent volume storage
**Recommendation:** Use `"s3"` for production-like deployments to enable multiple registry replicas and better reliability.
### `internalRegistry.storage.s3.*`
S3 backend configuration (when `storage.type: "s3"`).
S3 bucket name for storing registry images.
**Example:** `"crewai-registry-images"`
**Required:** When using S3 storage
S3 endpoint URL. Leave empty for AWS S3, or specify for S3-compatible services.
**Examples:**
* MinIO: `"http://crewai-minio:9000"`
* Wasabi: `"https://s3.wasabisys.com"`
* DigitalOcean Spaces: `"https://nyc3.digitaloceanspaces.com"`
Enable path-style S3 URLs (`endpoint/bucket/key` vs `bucket.endpoint/key`).
**Values:**
* `true` - Required for MinIO and most S3-compatible services
* `false` - AWS S3 virtual-hosted style
Enable server-side encryption for stored objects.
**Production Recommendation:** Enable for compliance and security.
Use HTTPS for S3 endpoint connections.
**Values:**
* `true` - HTTPS (recommended)
* `false` - HTTP (only for internal/development MinIO)
Root directory prefix for all registry blobs in the S3 bucket.
### `internalRegistry.persistence.*`
Filesystem storage configuration (when `storage.type: "filesystem"`).
Enable persistent volume for filesystem storage.
Size of persistent volume.
**Sizing Guidelines:**
* Consider container image sizes (typically 500MB - 2GB per image)
* Account for multiple image versions
* Add buffer for growth
**Example Calculation:**
* 50 different images × 1GB each = 50Gi
* 5 versions per image = 250Gi
* Add 50% buffer = 375Gi
StorageClass for registry volume.
Volume reclaim policy.
### `internalRegistry.service.*`
Service configuration for the registry.
Kubernetes service type.
**Valid Values:**
* `"ClusterIP"` - Internal cluster access only (default)
* `"NodePort"` - Expose on node ports
* `"LoadBalancer"` - Expose via cloud load balancer
Service port for registry API.
Specific NodePort to use (when `type: NodePort`).
### `internalRegistry.ingress.*`
Ingress configuration for external registry access.
Enable ingress for the registry.
**Recommendation:** Enable for external access, especially in air-gapped scenarios where clients need to push images.
Ingress class name (`nginx`, `alb`, etc.).
Ingress annotations.
**Important for Registry:**
```yaml theme={null}
internalRegistry:
ingress:
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: "0" # Disable body size limit
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
```
Hostname for registry ingress.
**Example:** `"registry.company.com"`
Ingress path prefix.
Path matching type (`Prefix`, `Exact`, `ImplementationSpecific`).
TLS configuration for ingress.
**Example:**
```yaml theme={null}
internalRegistry:
ingress:
tls:
- secretName: registry-tls
hosts:
- registry.company.com
```
### `internalRegistry.auth.*`
Authentication configuration for the registry.
Enable HTTP Basic Auth for registry access.
**Production Recommendation:** Always enable authentication for registries with external access.
Htpasswd-formatted credential string.
**Generate htpasswd:**
```bash theme={null}
htpasswd -Bbn username password
```
**Example Output:**
```text theme={null}
admin:$2y$05$T4qhOlL.l4eJkELzvnqbNuPxjGqkj6lA9Y12345
```
### `internalRegistry.tls.*`
TLS configuration for registry connections.
Enable TLS for registry connections.
Name of Kubernetes secret containing TLS certificate and key.
**Secret Format:**
```yaml theme={null}
apiVersion: v1
kind: Secret
type: kubernetes.io/tls
data:
tls.crt:
tls.key:
```
### `internalRegistry.proxy.*`
Pull-through cache configuration.
Enable pull-through proxy/cache functionality.
**Use Case:** Cache images from remote registries to reduce external bandwidth and improve pull performance.
Remote registry URL to proxy.
**Examples:**
* `"https://registry-1.docker.io"`
* `"https://ghcr.io"`
* `"https://quay.io"`
Username for remote registry authentication.
Password for remote registry authentication.
### `internalRegistry.healthcheck.*`
Health check configuration for registry pods.
Enable liveness and readiness probes.
Seconds to wait before first probe.
Seconds between health checks.
Probe timeout.
Consecutive successes required.
Consecutive failures before restart.
### `internalRegistry.resources.*`
Resource limits and requests for registry container.
CPU limit for registry pod.
**Sizing Guidelines:** Increase for high-throughput environments.
Memory limit for registry pod.
Guaranteed CPU allocation for registry pod.
**Tuning:** Conservative for registry with S3 backend.
Guaranteed memory allocation for registry pod.
Node selector for registry pod placement.
**Example:**
```yaml theme={null}
internalRegistry:
nodeSelector:
node-role.kubernetes.io/worker: "true"
```
**Use Cases:**
* Ensure registry runs on nodes with specific capabilities
* Separate registry workload from application workload
***