Deploying app workloads from images in a private registry

Deploy your app with Code Engine that uses an image in a private registry such as private Docker Hub. You can create an app from the console or with the CLI.

Before you begin

To pull images from a private registry, you must first create a private registry. For example, to create a private Docker Hub registry, see Docker Hub documentation.
After you create a private registry, push an image to it.
You can also set up an access token. By using an access token, you can more easily grant and revoke access to your Docker Hub account without requiring a password change. For more information about access tokens and Docker Hub, see Managing access tokens.

Deploying an app that references an image in a private registry with the console

Deploy an application that uses an image in a private registry with the Code Engine console.

Before you can work with a Code Engine application that references an image in a private registry, you must first add access to the registry, pull the image, and then deploy it.

Open the Code Engine console.
Select Let's go.
Select Application.
Enter a name for the application; for example, helloapp. Use a name for your application that is unique within the project.
Select a project from the list of available projects. You can also create a new one. You must have a selected project to deploy an app.
Select Container image and click Configure image.
Enter docker.io for Registry server.
For Registry secret, select Create registry secret.
From the Create registry secret page, choose your registry source. For example, Docker Hub.
Enter a username. For Docker Hub, it is your Docker ID.
Enter the password. For Docker Hub, you can use your Docker Hub password or an access token. For more information about access tokens and Docker Hub, see Managing access tokens.
Click Create to add a registry secret for Code Engine.
From the Configure image page, the registry secret that was added is listed. Select the registry secret for your image.
Select the namespace and name of the image in Docker Hub for the Code Engine app to reference. For example, select mynamespace and select the image hello_repo in that namespace.
Select a value for Tag; for example, latest.
Click Done. You selected your image in the registry to reference from your app.
Modify any runtime settings or environment variables for your app. For more information about these options, see Options for endpoint visibility of apps and Options for deploying an app.
From the Create application page, click Create.
After the application status changes to Ready, you can test the application. Click Test application and then click Send request in the Test application pane. To open the application in a web page, click Application URL.

Now that you have deployed your application, you can view information about application revisions and any running instances, and configuration details.

If you want to add registry access before you create an app, see Adding access to a private container registry.

Deploying an app with an image from a private registry with CLI

Deploy an application that uses an image in a container registry with the CLI with the ibmcloud ce app create command.

Before you begin

Set up your Code Engine CLI environment.
Create and work with a project.

Before you can work with a Code Engine application that references an image in a private registry, you must first add access to the registry, pull the image, and then deploy it.

To pull images from a private registry, you must first create a private registry. For example, to create a private Docker Hub registry, see Docker Hub documentation. After you create a private registry, push an image to it. You can also set up an access token. By using an access token, you can more easily grant and revoke access to your Docker Hub account without requiring a password change. For more information about access tokens and Docker Hub, see Managing access tokens.
Add access to your private registry to pull images. To add access to a private registry with the CLI, use the ibmcloud ce secret create --format registry command to create a registry secret. For example, the following command creates registry access to a Docker Hub registry called privatedocker that is at 'https://index.docker.io/v1/' and uses your username and password.
```
ibmcloud ce secret create --format registry --name privatedocker --server 'https://index.docker.io/v1/' --username <Docker_User_Name> --password <Password>
```
Example output
```
Creating registry secret 'privatedocker'...
OK
```
Create your app and reference the image in your private Docker Hub registry. For example, create the myhelloapp app to reference the docker.io/privaterepo/helloworld by using the privatedocker access information.
```
ibmcloud ce app create --name myhelloapp --image docker.io/privaterepo/helloworld --registry-secret privatedocker
```
The format of the name of the image for this application is REGISTRY/NAMESPACE/REPOSITORY:TAG where REGISTRY and TAG are optional. If REGISTRY is not specified, the default is docker.io. If TAG is not specified, the default is latest.
After your app deploys, you can access the app. To obtain the URL of your app, run ibmcloud ce app get --name myhelloapp --output url. When you curl the myhelloapp app, Hello World is returned.
```
curl https://myhelloapp.abcdabcdhye.us-south.codeengine.appdomain.cloud
```

Next steps

After your app deploys, access your app through a URL.
You can create a custom domain mapping and assign it to your app. For more information about deploying apps across multiple regions with a custom domain name, see Configuring a highly available application.
Now that your app is deployed, consider making your apps event-driven. By using event subscriptions, you can trigger your apps by periodic schedules or set your app to react to events such as file uploads or Kafka messages.

After your app is deployed, you can update your deployed app and its referenced code by using any of the following ways, independent of how you created or previously updated your app:

If you have a container image, per the Open Container Initiative (OCI) standard, then you need to provide only a reference to the image, which points to the location of your container registry when you deploy your app. You can deploy your app with an image in a public registry or private registry.

If you created your app by using the app create command and you specified the --build-source option to build the container image from local or repository source, and you want to change your app to point to a different container image, you must first remove the association of the build from your app. For example, run ibmcloud ce application update -n APP_NAME --build-clear. After you remove the association of the build from your app, you can update the app to reference a different image.
If you are starting with source code that resides in a Git repository, you can choose to let Code Engine take care of building the image from your source and deploying the app with a single operation. In this scenario, Code Engine uploads your image to IBM Cloud® Container Registry. To learn more, see Deploying your app from repository source code. If you want more control over the build of your image, then you can choose to build the image with Code Engine before you deploy your app.
If you are starting with source code that resides on a local workstation, you can choose to let Code Engine take care of building the image from your source and deploying the app with a single CLI command. In this scenario, Code Engine uploads your image to IBM Cloud® Container Registry. To learn more, see Deploying your app from local source code with the CLI. If you want more control over the build of your image, then you can choose to build the image with Code Engine before you deploy your app.

For example, you might choose to let Code Engine handle the build of your local source while you evolve the development of your source for the app. Then, after the image is matured, you can update the deployed app to reference the specific image that you want. You can repeat this process as needed.

When you deploy your updated app, the latest version of your referenced container image is downloaded and deployed, unless a tag is specified for the image. If a tag is specified for the image, then the tagged image is used for the deployment.

Looking for more code examples? Check out the Samples for IBM Cloud Code Engine GitHub repo.