TigerGate pulls container images server-side from your registry — you give us a credential, we pull and scan with Trivy. No worker runs in your environment.
RegistryCredentials
Docker HubUsername + password / access token
AWS ECRAccess key ID + secret access key + region + account ID
Google Container Registry (GCR)Service account JSON + project ID
Azure Container Registry (ACR)Service principal (client ID + secret + tenant ID) + registry name
GitLab Container RegistryPersonal access token (optional project / group ID, self-hosted URL)
GitHub Container Registry (GHCR)GitHub token with read:packages + org / username
Quay.ioOAuth token + organization
JFrog ArtifactoryArtifactory URL + Docker repository + access token
Harbor / self-hosted (OCI V2)URL + username + password
Add registries from Integrations → Container Registry → Add Registry, pick the registry type, fill the fields, and Connect Registry. Each row has a Test button that validates the stored credentials with a real authenticated call to the registry.
TigerGate’s scanners pull over the public internet. Registry URLs that resolve to private, loopback, or link-local addresses are rejected. The pull comes from your organization’s region — api.tigergate.dev on us1 — so allow-list that region’s API host on the registry side. If your registry isn’t reachable from it, push to a reachable mirror or contact support.
Match the host in your browser’s address bar, while signed in, against the Dashboard column; allow-list the API host on the same row. Allow-listing the wrong region’s host fails closed — pulls are refused and every image reports as unscanned.

​
Docker Hub

1

Create a Docker Hub access token

Sign in → Account Settings → Security → New Access Token.
  • Description: TigerGate scanner
  • Access permissions: Public Repo Read (private repos: Read)
2

Connect in TigerGate

Add Registry → Docker Hub. Enter your Username and paste the token into Password / Access Token.

​
AWS ECR

TigerGate authenticates to ECR with an IAM access key pair. There is no cross-account role flow — supply a key and secret for an IAM user (or a temporary session) with pull access.
1

Create an IAM user with ECR read permissions

Attach this permissions policy to the IAM user whose access key you will use:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:DescribeImages",
        "ecr:DescribeRepositories",
        "ecr:ListImages"
      ],
      "Resource": "*"
    }
  ]
}
2

Connect in TigerGate

Add Registry → AWS ECR. Enter:
  • AWS Access Key ID and AWS Secret Access Key
  • AWS Region — e.g. us-east-1
  • Registry ID (Account ID) — your 12-digit AWS account ID
The Test call runs a signed DescribeRepositories, so it fails on invalid keys or missing ecr:DescribeRepositories.

​
Google Container Registry (GCR)

1

Create a service account

GCP console → IAM & Admin → Service Accounts → Create.Role: roles/storage.objectViewer (GCR) — TigerGate reads with the devstorage.read_only scope.
2

Generate a JSON key

The service-account detail page → Keys → Add Key → JSON. Download the file.
3

Connect in TigerGate

Add Registry → Google Container Registry. Enter your GCP Project ID and paste the JSON key into Service Account JSON. A bad key fails the OAuth token exchange at Test time.

​
Azure Container Registry (ACR)

1

Create a service principal scoped to ACR

az ad sp create-for-rbac \
  --name "tigergate-scanner" \
  --role "AcrPull" \
  --scopes /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.ContainerRegistry/registries/<acr-name>
Capture appId, password, tenant from the output.
2

Connect in TigerGate

Add Registry → Azure Container Registry. Enter:
  • ACR Registry Name — <acr-name> (TigerGate forms <acr-name>.azurecr.io)
  • Client ID — appId
  • Client Secret — password
  • Tenant ID — tenant
The ACR admin user (username + password) also works if the service principal isn’t available.

​
GitLab Container Registry

1

Create a personal access token

GitLab → Preferences → Access Tokens (or a project/group deploy token). Scope: read_api / read_registry.
2

Connect in TigerGate

Add Registry → GitLab Container Registry. Enter:
  • Personal Access Token
  • GitLab URL — leave blank for gitlab.com; set only for a self-hosted instance
  • Project ID or Group ID — optional. Leave blank to scan every project the token can access.

​
GitHub Container Registry (GHCR)

1

Create a GitHub PAT

GitHub → Settings → Developer settings → Personal access tokens (classic) → Generate new token.Scope: read:packages. (For private packages, also repo for the repos that own those packages.)
2

Connect in TigerGate

Add Registry → GitHub Container Registry. Paste the token into GitHub Token and set Organization / Username to the account that owns the packages. Test verifies the token can list that owner’s container packages.

​
Quay.io

1

Create an OAuth token

Quay → your organization → Applications → create an application → generate an OAuth Access Token with repository read scope.
2

Connect in TigerGate

Add Registry → Quay.io. Enter the OAuth Token and the Organization (namespace) to scan.

​
JFrog Artifactory

1

Generate an access token

Artifactory → User Profile → Identity Tokens → Generate. An API key or username/password also work.
2

Connect in TigerGate

Add Registry → JFrog Artifactory. Enter:
  • Artifactory URL — e.g. https://mycompany.jfrog.io
  • Docker Repository — e.g. docker-local
  • Access Token

​
Harbor / self-hosted (generic OCI V2)

Any registry that speaks the Docker Registry V2 / OCI Distribution Spec — Harbor and other self-hosted registries — connects through the Harbor type with basic auth:
1

Connect in TigerGate

Add Registry → Harbor. Enter:
  • Harbor URL — e.g. https://harbor.example.com
  • Username + Password

​
Scanning connected images

TigerGate scans images without a push webhook. Three paths trigger scans:
  • On connect / Sync — connecting a registry (and the Sync button on each row) discovers repositories and tags. When your org’s auto-scan on connect setting is enabled, the latest tag of each repository is scanned automatically.
  • Auto-scan — the per-registry Enable automatic image scanning toggle marks a registry for automated scanning.
  • Schedules — open a registry (Edit) and use the Schedules section to add cron schedules scoped to the whole registry, a single image, an image:tag, or a repository-name pattern.

​
Rotation

PATs and access tokens expire. To rotate:
  1. Issue a new token at the registry side.
  2. Integrations → Container Registry → Edit → paste the new secret → Update Registry. Blank secret fields keep the stored value, so you only re-enter what changed.
  3. Revoke the old token at the registry side.