Kellnr

Why the cloudimg image

Kellnr's upstream defaults include a published administrator password and a registry that answers anonymous callers, and the credential is fixed the moment the registry database is created, so an image that ships one is stuck with it. The cloudimg image ships no registry database at all: on the first boot of every instance a unique administrator password, a unique cargo API token and a unique session signing key are generated into a root only file, and the registry is held closed until that has finished, so the well known default never exists on a running instance and no two deployments share a credential. Authentication is required on every registry operation, so the index, downloads and publishing all demand a token rather than being merely unadvertised. The registry itself never leaves the loopback interface; only SSH and HTTPS are reachable, behind a certificate minted for your instance. The address the registry advertises to cargo is resolved per instance, so cargo works from a developer machine immediately instead of being told to fetch from the registry host's own loopback. Crates live on a durable path owned by a dedicated service account, the image carries no compiler toolchain, and an on instance self test publishes a crate, reads it back byte for byte and removes it again. Paired deployment guide and 24/7 cloudimg support.