Private registries
Give every sandbox your registry credentials with account variables and secret files. Both are encrypted at rest on froog and written into each sandbox at every start (secret files with mode 600), so changes reach a running sandbox on its next start. A sandbox created with --no-environment gets none of them, and per-sandbox variables (-e KEY=VALUE) reach one sandbox only.
| Registry | Set up |
|---|---|
| npm, pnpm (npmjs, GitHub Packages, Artifactory…) | A .npmrc secret file that reads the token from a variable: @you:registry=https://npm.pkg.github.com and //npm.pkg.github.com/:_authToken=${NPM_TOKEN}, then froog env set NPM_TOKEN. |
| pip, uv | froog env set PIP_INDEX_URL (or PIP_EXTRA_INDEX_URL) and UV_DEFAULT_INDEX, with the credentials in the URL (https://user:token@pypi.example.com/simple). Or a .config/pip/pip.conf secret file. |
| Docker (GHCR, Docker Hub, ECR…) | Log in from the setup script, which runs at every start with your variables: echo "$GHCR_TOKEN" | docker login ghcr.io -u you --password-stdin. A .docker/config.json secret file works too, if its auths hold the credentials (Docker Desktop on a Mac keeps them in the keychain instead). |
| Cargo | The registry in a .cargo/config.toml secret file, and its token as froog env set CARGO_REGISTRIES_NAME_TOKEN. |
| Go modules | froog env set GOPRIVATE (e.g. github.com/you/*) plus GH_TOKEN: setup runs gh auth setup-git, so go get fetches private GitHub repos. Other hosts: a .git-credentials secret file. |
| Maven, Gradle | A .m2/settings.xml or .gradle/gradle.properties secret file. |
Variables are loaded by login shells, froog exec, background commands, the setup script and agent prompts. A service you run with systemd doesn't load ~/.froog/env on its own. The registry must be reachable at a public address: sandboxes can't reach private networks (see Network), and their outbound address is neither fixed nor theirs alone, so authenticate with tokens rather than an IP allowlist.