Allowed images

Every inline run: step and every services: entry names a container image. Loha checks that image against an allowlist when the build is triggered. If the image is not on the list, the build fails before it starts with:

Image 'acme/tool:1.0.0' is not on the allowed image list.

The allowlist is a guardrail, not a security boundary. It keeps builds on images that are well known and maintained. It does not limit what a step can install once it is running.

If your image is rejected

Go through these in order:

1. Is it a Docker Hub official image? That is an image with no / in its name, such as maven:3.9 or gradle:8. Spell it in full: docker.io/library/maven:3.9. Every official image is allowed in that form. The error message gives you the exact spelling to paste.
2. Is there an allowed image that does the same job? For example, if you need an S3-compatible service, both minio/minio and rustfs/rustfs are allowed. Check the list below.
3. Is it in your own registry? Add the registry in Settings → Registries (see below). Otherwise, ask your Loha administrator. An administrator can allow more images for the whole installation. Tell them the repository the error names, such as acme/tool. Allowing a repository allows every tag of it.

If your administrator has allowed extra images, the error message lists them on the line This installation also allows: ….

How to spell an image

• Tags and digests both work. node:20, node:20-alpine and node@sha256:… all match node.
• A name with no registry must be on the list exactly. node:20 is allowed. someorg/node:20 is not, because someorg is a different Docker Hub account.
• An entry with a / also covers what is under it. mcr.microsoft.com/playwright allows mcr.microsoft.com/playwright/python:v1.49.0-noble.
• A job with no image: uses alpine:3.

Your own registry

Every registry you add in Settings → Registries also allows its images in builds, as run: step images and services: images. Loha pulls them with the credential you saved there.

Registry you added	Images your builds can use
Your own host, such as harbor.example.com or registry.example.com:5000	Everything on that host
Docker Hub, with username acme	acme/… (also spelled docker.io/acme/…)
ghcr.io, quay.io or registry.gitlab.com, with username acme	<host>/acme/…

On a registry many accounts share, a credential proves access to one account, so it allows only that account's images. To use another organization's images:

• On Docker Hub, add a credential for that organization.
• On Quay, a robot account org+name allows quay.io/org/….
• On ghcr.io, an organization's images (ghcr.io/<org>/…) and, on registry.gitlab.com, group projects are not allowed through a personal credential yet. Ask your Loha administrator.

The Registries page shows what each registry allows. If the image is allowed but the pull fails, the build page names the image and the registry. Check that the credential is still valid.

The list

Docker Hub official images

• docker.io/library/: every official image, by its full name.

These short names also work without the docker.io/library/ prefix:

Use	Images
Base OS	alpine, ubuntu, debian, busybox
Languages	node, python, golang, rust, ruby, php
Web server	nginx
Databases and services	postgres, mysql, mariadb, redis, valkey, mongo, rabbitmq, memcached, cassandra, nats, clickhouse

Other runtimes and tools

Use	Images
JavaScript runtimes	oven/bun, denoland/deno
Browser testing	mcr.microsoft.com/playwright, cypress/included
.NET	mcr.microsoft.com/dotnet
Infrastructure	hashicorp/terraform
Python tooling	ghcr.io/astral-sh/uv
Git and Helm	alpine/git, alpine/helm
Security scanning	aquasec/trivy

Other services

Use	Images
S3-compatible storage	minio/minio, rustfs/rustfs
Search	docker.elastic.co/elasticsearch/, opensearchproject/opensearch

Build tooling

These are the images Loha's own build steps use. You can use them too.

• gcr.io/tekton-releases/
• quay.io/buildah/
• gcr.io/kaniko-project/

For administrators

To allow more images on an installation, set LOHA_EXTRA_IMAGE_PREFIXES on the pipeline controller. It takes a comma-separated list of entries in the same form as the list above, for example rustfs/rustfs,ghcr.io/acme. Restart the controller after you change it.