Use a different container registry

This guide covers pulling every image the Helm-installed Arcade platform needs from a registry you run, instead of Docker Hub.

When you need it

• Your cluster can’t reach Docker Hub, or your policy requires images from an approved registry.
• You run an air-gapped install.
• You mirror images to avoid Docker Hub rate limits.

Values overlay

There’s no single registry prefix for the whole chart: set each image’s repository to its path in your registry. Copy the images at the tags your chart version uses (see the values reference on Artifact Hub ).

dockerRegistry:
  enabled: true
  existingSecret: arcade-registry-pull # a kubernetes.io/dockerconfigjson Secret
 
engine:
  image:
    repository: registry.example.com/arcadedev/engine
coordinator:
  image:
    repository: registry.example.com/arcadedev/coordinator
dashboard:
  image:
    repository: registry.example.com/arcadedev/dashboard
experienceApi:
  image:
    repository: registry.example.com/arcadedev/experience-api
workerDefaults:
  image:
    repository: registry.example.com/arcadedev/worker
rbac:
  openfga:
    image:
      repository: registry.example.com/arcadedev/openfga
redis:
  image:
    repository: registry.example.com/redis
postgres:
  image: registry.example.com/postgres:17-alpine
 
supportImages:
  busybox:
    repository: registry.example.com/busybox
  curl:
    repository: registry.example.com/curlimages/curl
  postgres:
    repository: registry.example.com/postgres
    tag: 17-alpine
 
# Only if Arcade Deploy is enabled
deployments:
  image:
    repository: arcadedev/runner
  registry:
    server: registry.example.com
    imagePullSecrets: [arcade-registry-pull]

Pull credentials

dockerRegistry controls the pull Secret on the Arcade pods:

• dockerRegistry.enabled (default true) adds an imagePullSecrets entry to the Arcade component pods (Arcade Engine, coordinator, dashboard, Experience API, OpenFGA, workers, and the chart’s Jobs). Leave it on for the private arcadedev/* images or a registry that needs credentials.
• dockerRegistry.existingSecret names a Secret you create in the release namespace, of type kubernetes.io/dockerconfigjson. This is the usual choice for a mirror.
• Without existingSecret, the chart generates a Secret named dockerRegistry.secretName from dockerRegistry.server, dockerRegistry.username, and dockerRegistry.token (a Docker Hub access token).

Support images

The init containers use supportImages.busybox (generate-env-file), supportImages.curl (wait-for-workers, which must be a real curl image), and supportImages.postgres (wait-for-db, which needs the psql client). Each has repository, tag, and pullPolicy. An empty supportImages.postgres.repository falls back to postgres.image, so a mirrored postgres.image already covers it.

The Arcade Deploy runner image

If you enable Arcade Deploy, the Arcade Engine starts every deployed server from the runner image in the workers namespace:

• The image is deployments.registry.server joined with deployments.image.repository (default arcadedev/runner). With deployments.registry.server empty, the repository is used as-is. Its tag is deployments.image.tag, or the chart’s app version when that’s empty.
• Deployed server pods use the Secrets listed in deployments.registry.imagePullSecrets. These Secrets must exist in the workers namespace (deployments.namespace), not the release namespace.
• When dockerRegistry.enabled is on and dockerRegistry.existingSecret is empty, the chart also adds dockerRegistry.secretName to that list. A Secret you name in dockerRegistry.existingSecret isn’t added, so list it in deployments.registry.imagePullSecrets and create a copy in the workers namespace.

Air-gapped installs

1. Copy every image above, at your chart version’s tags, into your registry. Include the Arcade Deploy runner image if you use Arcade Deploy, and any images your workers list overrides.
2. Copy the chart itself (oci://public.ecr.aws/s5i6x9d1/charts/arcade) into an OCI registry you can reach, and install from there.
3. Create the pull Secret in the release namespace, and in the workers namespace for Arcade Deploy.
4. Install with the overlay above.

Image pulls are only part of an air-gapped install: the identity provider, OAuth providers, and any MCP server dependencies also need to be reachable from inside your network.

Verify it

# Every image comes from your registry
kubectl -n arcade get pods -o jsonpath='{range .items[*]}{range .spec.initContainers[*]}{.image}{"\n"}{end}{range .spec.containers[*]}{.image}{"\n"}{end}{end}' | sort -u
 
# Pods pulled successfully
kubectl -n arcade get pods
kubectl -n arcade get events --field-selector reason=Failed

For Arcade Deploy, deploy a test server and run the same image check in the workers namespace (arcade-workers by default).

Common failures

What you own and what the chart handles