Registry credentials
If an app pulls a private container image, we need a login for that registry. Save it under Security in the sidebar, then Registries, before you deploy the app. Public images need no credential.
Add a credential
Select New credential. Pick the registry from the dropdown: Docker Hub, GitHub Container Registry, GitLab Container Registry, or Custom... with your own host. Then enter the username and the password or token, and save.

Use a token that can only read images. We never push.
Test, edit, delete
Each saved credential has Test, which checks the login against the registry, plus Edit and Delete.
A deployment that pulls a private image with no matching credential fails before it starts. Install an app on a server.