# Composal registry Publish and pull organization-scoped container images with the Composal registry. Configure Docker authentication, repository access, and image tags. Composal registry repositories live at `registry.composal.ai//`. Composal-issued authorization supports Docker pulls and pushes and can be used by platform builders that have appropriate organization access. ## Set up Docker For most workflows, configure the Docker credential helper once. It keeps credentials scoped to `registry.composal.ai` and refreshable through Composal. ```sh com docker setup --registry registry.composal.ai com registry login --registry registry.composal.ai ``` ## Repositories and tags Create or list an organization repository, then push an image with an explicit tag. ```sh com registry list --org com registry create --org --slug com registry push --org --repo --tag --registry registry.composal.ai ``` Use `docker push` and `docker pull` after configuring the credential helper when a normal Docker workflow is the better fit. Inspect the image contract for a repository and tag: ```sh com registry contract --org --registry registry.composal.ai --reference ``` Use `--registry registry.composal.ai` explicitly in setup, login, and push commands to select the Composal registry. ## Auth boundary Registry authorization is scoped to the organization and repository access granted to the caller. A registry token is not a replacement for a browser session or a general control-plane token. Use [hosting](/docs/hosting) for deploy workflows that consume those images. See the [Remote builders guide](/docs/remote-builders) for upcoming organization-managed builders with persistent layer caches, native Docker connections, and direct pushes to `registry.composal.ai`. The implementation is in review, the Unix supervisor is implemented, and production gateway deployment is unfinished.