> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thoras.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Private Container Registry

> Pull Thoras container images from your own private registry instead of the public Thoras registry.

If you need to pull Thoras container images from your own private registry
instead of the public Thoras registry, you can override the default registry
location using the `$.Values.imageCredentials.registry` value.

## Prerequisites

1. Access to download Thoras container images (email
   [support@thoras.ai](mailto:support@thoras.ai) for assistance)
2. A private container registry accessible from your Kubernetes cluster
3. Container images pushed to your private registry

## Configuration

Set the private registry hostname value in your Helm `values.yaml`:

```yaml theme={null}
imageCredentials:
  registry: "your-private-registry.example.com/thoras"
```

## Copying Multi-Platform Images

Thoras container images are built for multiple platforms (`linux/amd64` and
`linux/arm64`) to support multiple CPU architectures. When copying images from
the Thoras registry to your private registry, it's a good idea to preserve the
multi-platform manifest to ensure compatibility across different CPU
architectures.

### Generate a list of images to copy

```sh theme={null}
helm repo add thoras https://thoras-ai.github.io/helm-charts
helm template testit thoras/thoras \
  --set featureFlags.enableLegacySecretSeeding=false \
  | awk '/image:/ {print $NF}' | sort -u
```

The list will include Thoras images (`services`, `thoras-dashboard-v2`,
`thoras-forecast`, `nginx`, `timescaledb`) as well as `oauth2-proxy` and `httpd`
(the dashboard auth sidecar and its init container) and `kube-webhook-certgen`
(webhook TLS, unless you use cert-manager). All are hosted on the Thoras
registry, so air-gapped installs only need to mirror from the Thoras registry.
No separate upstream mirror step is needed.

<Note>
  If you deploy with `helm template` rather than `helm install`, set
  `featureFlags.enableLegacySecretSeeding: false` in your values (see [Legacy
  secret seeding](/installation/credentials#legacy-secret-seeding)) and consider
  [cert-manager for webhook
  TLS](/installation/advanced-setup#webhook-tls-with-cert-manager) so no Helm
  hook Jobs are involved.
</Note>

### Using Docker Buildx

The recommended approach is to use `docker buildx imagetools create`, which
preserves the multi-platform manifest. Substitute `<VERSION>` with the tag that
`helm template` shows for the release you're deploying:

```sh theme={null}
# Authenticate to both registries
docker login us-east4-docker.pkg.dev/thoras-registry/platform
docker login your-private-registry.example.com

# Copy the image with all platforms preserved
docker buildx imagetools create \
  --tag your-private-registry.example.com/thoras/services:<VERSION> \
  us-east4-docker.pkg.dev/thoras-registry/platform/services:<VERSION>
```

### Verifying Multi-Platform Support

After copying, verify that both platforms are available:

```sh theme={null}
docker buildx imagetools inspect your-private-registry.example.com/thoras/services:<VERSION>
```

You should see both `linux/amd64` and `linux/arm64` in the output.

## Questions?

For help downloading container images or configuring your private registry,
email [support@thoras.ai](mailto:support@thoras.ai).