Private registries & repos

Registries

aloof registry login ghcr.io -u my-user --password-stdin <<< "$GHCR_TOKEN"
aloof registry login docker.io -u me                       # Docker Hub access token
aloof registry login 123456789012.dkr.ecr.eu-central-1.amazonaws.com -u AKIA... -p SECRET   # AWS keys; a short-lived ECR token is minted per pull
aloof registry login europe-docker.pkg.dev -u _json_key --password-stdin < key.json        # GCR / Artifact Registry
aloof registry login registry.example.com -u ci -a my-app  # per-app override

Credentials are encrypted at rest. They are written only to a private, temporary Docker config for a single pull or build, including the FROM lines in your Dockerfile. Every deploy pulls with the owning account's credentials, so a private image cached on a host can't be used by another account. Images are then mirrored into the platform registry, so edge and self-hosted nodes run them without ever seeing your registry credentials.

Git

aloof git deploy-key github.com -a my-app        # prints an ed25519 public key: add it as a read-only deploy key
aloof deploy my-app --git git@github.com:me/private.git --ref main
aloof git token gitlab.com -a my-app             # read-only token (GitHub: x-access-token, GitLab: oauth2, Bitbucket: x-token-auth)
aloof deploy my-app --git https://gitlab.com/me/private.git

This works with any git host over SSH or HTTPS. Tokens are passed as an HTTP header through the environment, never on a command line or in .git/config. Submodules are fetched with the same credentials. On GitHub you can use the GitHub App instead, which needs no long-lived keys.