Registries
WUD inspects remote container registries to discover image tags, digest hashes, and semver updates for your monitored containers.
To check matching images immediately after a push, configure Registry Webhooks on a supported registry instance. Scheduled polling remains available as fallback.
When WUD monitors a container (e.g. redis:7-alpine or ghcr.io/owner/app:1.2.0), it parses the image name to detect the target registry domain automatically.
Request Throttling
WUD limits requests independently for each configured registry instance. Requests above the limit wait in FIFO order, so one registry cannot consume the capacity of another.
Maximum number of active requests for this registry instance. An invalid value prevents the registry from registering.
Maximum number of image pulls the Docker trigger runs at once against this registry instance. Pulls are queued in FIFO order. An invalid value prevents the registry from registering.
When a registry returns HTTP 429, WUD retries twice. It honors Retry-After values up to 60 seconds; otherwise it waits for a jittered 1–2 seconds before the first retry and 2–4 seconds before the second. Request slots are released during these delays. Longer retry windows are deferred to the next normal scan, and non-429 failures are not retried.
Image pulls made by the Docker trigger go through the Docker daemon rather than these requests, so they have their own limit (PULLCONCURRENCY). When a pull is rate limited (HTTP 429 or toomanyrequests), WUD holds back every queued pull from that registry and retries up to three times, waiting a jittered 1–2, 2–4 and 4–8 seconds (or the registry's retry-after, when longer and no more than 60 seconds). The pull runs before the container is stopped, so a retry causes no downtime. Other pull failures are not retried.
Retry timing is fixed and is not separately configurable.
Proxy Support
When running in an environment behind a corporate or forward HTTP proxy, WUD automatically routes outgoing registry requests through the proxy using standard environment variables:
HTTP_PROXY/http_proxy: Proxy URL for HTTP requests (e.g.http://proxy.corp.example.com:3128). Also used as fallback for HTTPS requests via HTTPCONNECTtunneling whenHTTPS_PROXYis not set.HTTPS_PROXY/https_proxy: Proxy URL for HTTPS requests (e.g.http://proxy.corp.example.com:3128orsocks5://proxy.corp.example.com:1080).NO_PROXY/no_proxy: Comma-separated list of domain suffixes or IP addresses to bypass the proxy (e.g.localhost,127.0.0.1,.internal.company.com).NODE_EXTRA_CA_CERTS: Absolute path to a file containing additional trusted root/intermediate certificates (in PEM format) when connecting through TLS-intercepting corporate proxies or private registries.
HTTPS requests through HTTP proxies are established via CONNECT tunneling.
You can also configure a dedicated proxy on a specific registry instance:
Dedicated proxy URL to route requests for this registry instance.
⚡ Active by Default (Zero-Config for Public Images)
These registries work out of the box with zero configuration for public images.
You only need to configure environment variables if you want to:
- Access private repositories
- Increase API rate limits (e.g. Docker Hub authenticated tier)
- Connect to a self-hosted instance (e.g. on-premise Forgejo or Quay)
Alibaba Cloud (ACR)
Monitors public images on Alibaba Cloud Container Registry (*.aliyuncs.com) anonymously.
AWS ECR Public
Monitors public images hosted on Amazon ECR Public Gallery anonymously without AWS credentials.
Codeberg
Public Codeberg images supported anonymously. Configure access tokens for private packages.
DigitalOcean (DOCR)
Monitors public repositories on DigitalOcean Container Registry anonymously out of the box.
Docker Hub
Monitors public images anonymously by default. Configure username and PAT/password for private repos or increased rate limits.
Elastic Container Registry
Monitors public images on Elastic Container Registry (docker.elastic.co) anonymously out of the box.
Forgejo
Public images on code.forgejo.org supported anonymously. Configure instance URL and tokens for self-hosted Forgejo.
GitHub Container Registry (GHCR)
Monitors public packages anonymously out of the box. Configure a GitHub Personal Access Token (PAT) for private packages.
GitLab
Monitors public images anonymously on registry.gitlab.com by default. Configure a GitLab Personal Access Token for private repositories or self-hosted instances.
Google Container Registry (GCR)
Public images supported anonymously. Configure a Google Service Account JSON key for private images and Artifact Registry.
IBM Cloud (ICR)
Monitors public namespaces on IBM Cloud Container Registry (*.icr.io) anonymously.
JFrog Artifactory
Monitors public images hosted on JFrog Cloud (*.jfrog.io) anonymously.
LinuxServer (LSCR)
Seamless tag and update monitoring for the entire LinuxServer.io container ecosystem.
Oracle Cloud (OCIR)
Monitors public images on Oracle Cloud Infrastructure Registry (*.ocir.io) anonymously.
Quay
Red Hat Quay public images supported anonymously. Supports custom tokens for private repos and on-prem Quay clusters.
Scaleway
Monitors public namespaces on Scaleway Container Registry (rg.<region>.scw.cloud) anonymously.
TrueForge
Public TrueForge OCI image registry support out of the box.
🔐 Dedicated Setup Required
These registries host private images or custom infrastructure and require explicit credentials or endpoint configuration before WUD can monitor your containers.
AWS ECR (Private)
Requires AWS Access Key ID, Secret Access Key, or IAM role credentials to authenticate with private Amazon ECR repositories.
Azure Container Registry (ACR)
Requires an Azure Service Principal Client ID and Client Secret to authenticate against private Azure ACR registries.
Custom / Self-Hosted OCI
Generic provider for standalone Docker Registry v2 instances.
Docker Hardened Images (DHI)
Requires Docker Hub credentials (username and Personal Access Token) to authenticate with dhi.io.
Gitea
Requires your Gitea instance URL and an access token to inspect private or self-hosted Gitea package registries.
Harbor
Requires your CNCF Harbor instance URL and optional robot account or user credentials.
Inedo ProGet
Requires your Inedo ProGet feed URL and API key or user credentials.
Linode (Akamai)
Requires your Linode / LKE private registry URL and access credentials.
Sonatype Nexus
Requires your Sonatype Nexus Repository Docker connector URL and credentials.