Skip to main content
Connect Docker Hub so CloudThinker agents can list the repositories in your namespaces, compare visibility, pulls, and last-push age, and inspect each repository’s tags. The connection uses your Docker Hub username and a personal access token (PAT), and it ships read-only.

Prerequisites

  • A Docker account with access to the personal and organization repositories you want agents to inspect.
  • Your Docker Hub username: the account name, not your email address or an organization name.
  • For organization repositories: a Docker account that’s a member of the organization. A dedicated account for CloudThinker keeps the token separate from a person’s login.

Setup

1

Create a personal access token

In Docker Home, select your avatar, then Account settings → Personal access tokens (app.docker.com/settings/personal-access-tokens), and click Generate new token. Set:
  • Access token description: cloudthinker
  • Expiration date: a lifetime that matches your rotation policy
  • Access permissions: Repo Read-only. Pick Repo Read, Write, Delete only if you want agents to update repository descriptions (see Write access).
Don’t keep the default, Repo Public Read-only. It can’t read private repositories, so agents miss every private repository in your namespaces.Click Generate and copy the token. Docker shows it only once.
2

Add the connection

Open More → Workspace settings → Connections, stay on the Builtin Connections tab, and select Docker Hub. Fill in:
  • Docker Hub username: the account that created the PAT, such as myuser.
  • Personal access token: the PAT. Not your Docker Hub password.
Click Connect. CloudThinker signs in and reads your personal namespace.Success state: the connection shows Connected, with a message such as Connected to Docker Hub namespace myuser (12 repositories).

Connection details

There’s no namespace field. Your personal namespace is your username, and agents discover organization namespaces from the token.

Required permissions

Docker Hub refuses description updates from a Repo Read & Write PAT, so that level gives agents nothing extra.
Start with a Repo Read-only PAT. Switch to Repo Read, Write, Delete only for a workspace that needs agents to edit repository text.

Write access

The connection is read-only when you add it. To let agents update repository descriptions:
  1. Reconnect with a Repo Read, Write, Delete PAT.
  2. In More → Workspace settings → Connections, select Docker Hub and turn on the Allow writes switch on its detail panel.
Each update then goes through your Rules and Approval mode. The agent shows the current text and the exact new text before it asks. Even with writes on, agents can only change a repository’s short description and overview. They can’t push, pull, delete, or rename images, change visibility, create or delete repositories, or manage members and tokens.
CloudThinker limits what agents do with the token, not what the token can do. A Repo Read, Write, Delete PAT can delete repositories if it leaks. Use one only where you need description edits, and give it a short expiration.

Agent capabilities

Read the numbers the way Docker Hub reports them:
  • Pulls are lifetime totals. They can’t show a trend or a spike.
  • Sizes are compressed layer sizes, not storage used or runtime footprint.
  • Days since last push is only push age. Docker Hub doesn’t report what runs an image, so it can’t prove a repository is unused.
  • Inactive is Docker Hub’s own marker for no push or pull in a month.
This connection doesn’t report storage cost, vulnerabilities, or image signatures.

Verify the connection

Expect your personal namespace and any organization namespaces, each with private and public repository counts.

Example prompts

Troubleshooting

You entered an email address or an organization name. Enter the account name that created the PAT.
The PAT is wrong, expired, deactivated, or deleted. Generate a new PAT and reconnect with the same username.
Docker Hub refuses part of its organization listing for PAT-based sign-ins. That doesn’t mean you have no organizations. Ask the agent to inspect the namespace by name, such as acme, and confirm the PAT’s account is a member. If it works, the agent lists that namespace’s repositories.
Check the full name, NAMESPACE/NAME. Docker Hub also answers “not found” when the PAT’s account can’t read a private repository.
Check three things in order. The Allow writes switch on the connection’s detail panel must be on. The PAT must be Repo Read, Write, Delete; a Repo Read & Write PAT is refused. No Rule in Approvals may deny the update.
Docker Hub limited the requests. Wait a few minutes, then ask about one namespace or repository at a time.

Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Prefer Repo Read-only: a Repo Read-only PAT covers every read. Even a Repo Read, Write, Delete PAT can only change repository text through this connection.
  • Review PATs: set an expiration and check last-used dates under Account settings → Personal access tokens. Deactivate tokens you no longer need.

CircleCI

Pipeline status, failure logs, flaky tests, and approval-gated reruns.

Connections overview

How credentials, Allow writes, and Approvals work together.