# Publishing a container image somewhere this cluster can pull it

**Every service here runs from an image, and nothing says where our own images
come from.**

*The images currently running are all somebody else's, pulled from public
registries. **There is no path for an image we build.***

## Where we looked

**This repository** — the rebuild steps, the manifests, and every published
document. **Nothing describes publishing.**

## What exists and is not finished

**The git host has a container registry.** *It is there. **Access to it is not
worked out** — not the credentials, not who holds them, not how a workload
presents them at pull time.*

## What we are doing instead

**Nothing yet.** *No service here is built from an image we produce, so the gap
has not blocked anything.* **It blocks the first one that is.**

## Whose job

**Probably ours**, since the registry is on this cluster — *but the credential
question is the same one as [any other secret a workload needs](#), and that has
no answer here either.* **Not asserted.**