# How to Log In to a Container Registry with Apple Container > Log in to a container registry with Apple Container using the container registry login command. Securely store credentials in your macOS Keychain for easy access. - Repository: [Apple/container](https://github.com/apple/container) - Tags: how-to-guide - Published: 2026-06-28 --- **Use the `container registry login` command to authenticate against an OCI registry and securely store credentials in the macOS Keychain for subsequent operations.** Apple Container is Apple's open-source container tooling designed for macOS. Before you can pull or push images, you must first log in to a container registry with Apple Container using the dedicated CLI command that handles authentication flow and credential persistence automatically. ## Prerequisites - macOS with Apple Container installed - Access to an OCI-compatible container registry - Valid registry credentials (username and password) ## Basic Login Command Syntax The primary command follows this pattern: ```bash container registry login [OPTIONS] ``` Where `` is the registry hostname (e.g., `myregistry.example.com`). ## Authentication Methods Apple Container supports multiple authentication flows to accommodate interactive use and automation scenarios. ### Interactive Login For manual authentication, run the command without providing a password: ```bash container registry login myregistry.example.com ``` The CLI prompts for your username and password via secure input methods, then validates the credentials against the registry. ### Command Line Credentials Supply the username directly with the `-u` flag: ```bash container registry login -u alice myregistry.example.com ``` The tool prompts for the password interactively while masking input. ### Stdin Password Input (CI/CD) For automation and scripts, pass the password via stdin using `--password-stdin`: ```bash echo "s3cr3t" | container registry login --password-stdin -u alice myregistry.example.com ``` This method prevents passwords from appearing in shell history or process lists. ## How the Login Flow Works According to the Apple Container source code, the login process implemented in [`Sources/ContainerCommands/Registry/RegistryLogin.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Registry/RegistryLogin.swift) follows a strict six-step validation pipeline. ### Option Parsing and Scheme Selection First, the command parses CLI arguments including `--username`, `--password-stdin`, and `--scheme`. The scheme flag accepts `http`, `https`, or `auto` (default), determining the transport protocol for registry communication. *Source:* [`Sources/ContainerCommands/Registry/RegistryLogin.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Registry/RegistryLogin.swift) (lines 34-42) ### Configuration Loading The tool loads `ContainerSystemConfig` to obtain the default DNS domain, which assists in resolving the registry host during URL normalization. *Source:* [`Sources/ContainerCommands/Registry/RegistryLogin.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Registry/RegistryLogin.swift) (line 50) ### Credential Collection and Keychain Storage If `--password-stdin` is provided, the password is read from standard input. Otherwise, the `KeychainHelper` prompts for missing credentials. Upon successful authentication, the helper persists the credentials to the macOS Keychain for future use. *Source:* [`Sources/ContainerCommands/Registry/RegistryLogin.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Registry/RegistryLogin.swift) (lines 53-71) ### Registry Resolution The supplied server name is normalized using `Reference.resolveDomain`, and the appropriate scheme is selected via `RequestScheme` (defaulting to `https` for external registries). *Source:* [`Sources/ContainerCommands/Registry/RegistryLogin.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Registry/RegistryLogin.swift) (lines 72-78) ### Client Initialization and Validation The system creates a `RegistryClient` (implemented in [`Sources/ContainerAPIClient/RegistryClient.swift`](https://github.com/apple/container/blob/main/Sources/ContainerAPIClient/RegistryClient.swift)) configured with basic authentication and retry logic (up to 10 attempts with exponential back-off). The `client.ping()` method validates credentials against the registry's authentication endpoint before storing them. *Source:* [`Sources/ContainerCommands/Registry/RegistryLogin.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Registry/RegistryLogin.swift) (lines 82-98) ## Working with Insecure Registries For local development or internal networks without TLS, force HTTP using the `--scheme` flag: ```bash container registry login --scheme http mylocal.registry ``` This bypasses HTTPS requirements suitable for internal or test registries. ## Summary - **Command**: Use `container registry login ` to authenticate to OCI registries - **Storage**: Credentials are securely stored in the macOS Keychain via `KeychainHelper` - **Methods**: Support for interactive, command-line, and stdin-based password input - **Implementation**: Login logic resides in [`Sources/ContainerCommands/Registry/RegistryLogin.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Registry/RegistryLogin.swift) - **Validation**: Uses `RegistryClient.ping()` with automatic retry logic to verify credentials - **Insecure registries**: Use `--scheme http` for non-TLS connections ## Frequently Asked Questions ### Where does Apple Container store registry credentials? Apple Container stores credentials in the macOS Keychain using the `KeychainHelper` utility. This provides secure, encrypted storage that persists across terminal sessions and integrates with macOS system security, as implemented in [`Sources/ContainerCommands/Registry/RegistryLogin.swift`](https://github.com/apple/container/blob/main/Sources/ContainerCommands/Registry/RegistryLogin.swift). ### How do I log in to a local registry without HTTPS? Use the `--scheme http` flag to force HTTP connections: `container registry login --scheme http localhost:5000`. This is useful for local registries during development, though production registries should always use HTTPS. ### Can I use Apple Container in CI/CD pipelines? Yes. Use the `--password-stdin` flag to pass credentials securely from environment variables or secrets managers: `echo "$PASSWORD" | container registry login --password-stdin -u $USER $REGISTRY`. This avoids exposing passwords in process lists or command history. ### How do I verify my login was successful? The CLI outputs a success message after `client.ping()` validates the credentials against the registry. If authentication fails, the command exits with an error before storing credentials in the Keychain. You can verify stored credentials by attempting to pull an image from the registry.