Chapter 9. Component and feature configuration fields

REGISTRY_TITLE

String

If specified, the long-form title for the registry. Displayed in frontend of your Red Hat Quay deployment, for example, at the sign in page of your organization. Should not exceed 35 characters. Default: Red Hat Quay

REGISTRY_TITLE_SHORT

String

If specified, the short-form title for the registry. Title is displayed on various pages of your organization, for example, as the title of the tutorial on your organization’s Tutorial page. Default: Red Hat Quay

CONTACT_INFO

Array of String

If specified, contact information to display on the contact page. If only a single piece of contact information is specified, the contact footer will link directly.

[0]

String

Adds a link to send an e-mail. Pattern: ^mailto:(.)+$ Example: mailto:support@quay.io

[1]

String

Adds a link to visit an IRC chat room. Pattern: ^irc://(.)+$ Example: irc://chat.freenode.net:6665/quay

[2]

String

Adds a link to call a phone number. Pattern: ^tel:(.)+$ Example: tel:+1-888-930-3475

[3]

String

Adds a link to a defined URL. Pattern: ^http(s)?://(.)+$ Example: https://twitter.com/quayio

BRANDING

Object

Custom branding for logos and URLs in the Red Hat Quay UI.

.logo (Required)

String

Main logo image URL. The header logo defaults to 205x30 PX. The form logo on the Red Hat Quay sign in screen of the web UI defaults to 356.5x39.7 PX. Example: /static/img/quay-horizontal-color.svg

.footer_img

String

Logo for UI footer. Defaults to 144x34 PX. Example: /static/img/RedHat.svg

.footer_url

String

Link for footer image. Example: https://redhat.com

FOOTER_LINKS

Object

Enable customization of footer links in Red Hat Quay’s UI for on-prem installations.

.TERMS_OF_SERVICE_URL

String

Custom terms of service for on-prem installations. Example: https://index.hr

.PRIVACY_POLICY_URL

String

Custom privacy policy for on-prem installations. Example: https://example.hr

.SECURITY_URL

String

Custom security page for on-prem installations. Example: https://example.hr

.ABOUT_URL

String

Custom about page for on-prem installations. Example: https://example.hr

PREFERRED_URL_SCHEME

String

One of http or https. Note that users only set their PREFERRED_URL_SCHEME to http when there is no TLS encryption in the communication path from the client to Quay. Users must set their PREFERRED_URL_SCHEME`to `https when using a TLS-terminating load balancer, a reverse proxy (for example, Nginx), or when using Quay with custom SSL certificates directly. In most cases, the PREFERRED_URL_SCHEME should be https. Default: http

SERVER_HOSTNAME (Required)

String

The URL at which Red Hat Quay is accessible, without the scheme Example: quay-server.example.com

SSL_CIPHERS

Array of String

If specified, the nginx-defined list of SSL ciphers to enabled and disabled Example: [ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES256-GCM-SHA384, DHE-RSA-AES128-GCM-SHA256, DHE-DSS-AES128-GCM-SHA256, kEDH+AESGCM, ECDHE-RSA-AES128-SHA256, ECDHE-ECDSA-AES128-SHA256, ECDHE-RSA-AES128-SHA, ECDHE-ECDSA-AES128-SHA, ECDHE-RSA-AES256-SHA384, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES256-SHA, ECDHE-ECDSA-AES256-SHA, DHE-RSA-AES128-SHA256, DHE-RSA-AES128-SHA, DHE-DSS-AES128-SHA256, DHE-RSA-AES256-SHA256, DHE-DSS-AES256-SHA, DHE-DSS-AES256-SHA, AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA256, AES256-SHA256, AES128-SHA, AES256-SHA, AES, !3DES", !aNULL, !eNULL, !EXPORT, DES, !RC4, MD5, !PSK, !aECDH, !EDH-DSS-DES-CBC3-SHA, !EDH-RSA-DES-CBC3-SHA, !KRB5-DES-CBC3-SHA]

SSL_PROTOCOLS

Array of String

If specified, nginx is configured to enabled a list of SSL protocols defined in the list. Removing an SSL protocol from the list disables the protocol during Red Hat Quay startup. Example: ['TLSv1','TLSv1.1','TLSv1.2', `TLSv1.3]`

SESSION_COOKIE_SECURE

Boolean

Whether the secure property should be set on session cookies Default: False Recommendation: Set to True for all installations using SSL

EXTERNAL_TLS_TERMINATION

Boolean

Set to True if TLS is supported, but terminated at a layer before Quay. Set to False when Quay is running with its own SSL certificates and receiving TLS traffic directly.

FEATURE_LISTEN_IP_VERSION

String

Enables IPv4, IPv6, or dual-stack protocol family. This configuration field must be properly set, otherwise Red Hat Quay fails to start. Default: IPv4Additional configurations: IPv6, dual-stack

DEBUGLOG

Boolean

Whether to enable or disable debug logs.

USERS_DEBUG

Integer. Either 0 or 1.

Used to debug LDAP operations in clear text, including passwords. Must be used with DEBUGLOG=TRUE.

+

ALLOW_PULLS_WITHOUT_STRICT_LOGGING

Boolean

If true, pulls will still succeed even if the pull audit log entry cannot be written . This is useful if the database is in a read-only state and it is desired for pulls to continue during that time. Default: False

ENABLE_HEALTH_DEBUG_SECRET

String

If specified, a secret that can be given to health endpoints to see full debug info when not authenticated as a superuser

HEALTH_CHECKER

String

The configured health check Example: ('RDSAwareHealthCheck', {'access_key': 'foo', 'secret_key': 'bar'})

FEATURE_AGGREGATED_LOG_COUNT_RETRIEVAL

Boolean

Whether to allow retrieval of aggregated log counts Default: True

REGISTRY_STATE

String

The state of the registry. Values: normal or read-only

WEBHOOK_HOSTNAME_BLACKLIST

Array of String

The set of hostnames to disallow from webhooks when validating, beyond localhost

AVATAR_KIND

String

The types of avatars to display, either generated inline (local) or Gravatar (gravatar) Values: local, gravatar

FRESH_LOGIN_TIMEOUT

String

The time after which a fresh login requires users to re-enter their password Example: 5m

FEATURE_UI_V2

Boolean

When set, allows users to try the v2 beta UI environment.

Default: True

FEATURE_UI_V2_REPO_SETTINGS

Boolean

When set to True, enables repository settings in the Red Hat Quay v2 UI.

Default: False

FEATURE_DIRECT_LOGIN

Boolean

Whether users can directly login to the UI

Default: True

FEATURE_PARTIAL_USER_AUTOCOMPLETE

Boolean

If set to true, autocompletion will apply to partial usernames+

Default: True

FEATURE_LIBRARY_SUPPORT

Boolean

Whether to allow for "namespace-less" repositories when pulling and pushing from Docker

Default: True

FEATURE_PERMANENT_SESSIONS

Boolean

Whether sessions are permanent

Default: True

FEATURE_PUBLIC_CATALOG

Boolean

If set to true, the _catalog endpoint returns public repositories. Otherwise, only private repositories can be returned.

Default: False

DISABLE_ANGULAR_UI

Boolean

Disable legacy Angular UI pages and redirects.

Default: False

DEFAULT_UI

String

Allows Red Hat Quay administrators the option to set the default UI to the angular theme (legacy) or react theme (v2 UI).

Options: react, angular

PERMANENT_SESSION_LIFETIME

Integer

A timedelta which is used to set the expiration date of a permanent session. The default is 31 days, which makes a permanent session survive for roughly one month.

Default: 2678400

FEATURE_SUPER_USERS

Boolean

Whether superusers are supported

Default: True

FEATURE_USER_CREATION

Boolean

Whether users can be created (by non-superusers)

Default: True

FEATURE_USER_LAST_ACCESSED

Boolean

Whether to record the last time a user was accessed

Default: True

FEATURE_USER_LOG_ACCESS

Boolean

If set to true, users will have access to audit logs for their namespace

Default: False

FEATURE_USER_METADATA

Boolean

Whether to collect and support user metadata

Default: False

FEATURE_USERNAME_CONFIRMATION

Boolean

If set to true, users can confirm and modify their initial usernames when logging in via OpenID Connect (OIDC) or a non-database internal authentication provider like LDAP.

Default: True

FEATURE_USER_RENAME

Boolean

If set to true, users can rename their own namespace.

Default: False

FEATURE_INVITE_ONLY_USER_CREATION

Boolean

Whether users being created must be invited by another user

Default: False

FRESH_LOGIN_TIMEOUT

String

The time after which a fresh login requires users to re-enter their password

Example: 5m

USERFILES_LOCATION

String

ID of the storage engine in which to place user-uploaded files

Example: s3_us_east

USERFILES_PATH

String

Path under storage in which to place user-uploaded files

Example: userfiles

USER_RECOVERY_TOKEN_LIFETIME

String

The length of time a token for recovering a user accounts is valid Pattern: ^[0-9]+(w|m|d|h|s)$

Default: 30m

FEATURE_SUPERUSERS_FULL_ACCESS

Boolean

Grants superusers the ability to read, write, and delete content from other repositories in namespaces that they do not own or have explicit permissions for.

Default: False

FEATURE_SUPERUSERS_ORG_CREATION_ONLY

Boolean

Whether to only allow superusers to create organizations.

Default: False

FEATURE_SUPERUSER_CONFIGDUMP

Boolean

Enables a full config dump of the running Framework, environment and schema for validation.

Default: False

FEATURE_RESTRICTED_USERS

Boolean

When set to True with RESTRICTED_USERS_WHITELIST:

Default: False

RESTRICTED_USERS_WHITELIST

String

When set with FEATURE_RESTRICTED_USERS: true, specific users are excluded from the FEATURE_RESTRICTED_USERS setting.

GLOBAL_READONLY_SUPER_USERS

String

When set, grants users of this list read access to all repositories, regardless of whether they are public repositories.

ROBOTS_DISALLOW

Boolean

When set to True, robot accounts are prevented from all interactions, as well as from being created
Default: False

AUTHENTICATION_TYPE (Required)

String

Must be set to LDAP.

FEATURE_TEAM_SYNCING

Boolean

Whether to allow for team membership to be synced from a backing group in the authentication engine (OIDC, LDAP, or Keystone). Default: True

FEATURE_NONSUPERUSER_TEAM_SYNCING_SETUP

Boolean

If enabled, non-superusers can setup team syncrhonization.

Default: False

LDAP_ADMIN_DN

String

The admin DN for LDAP authentication.

LDAP_ADMIN_PASSWD

String

The admin password for LDAP authentication.

LDAP_ALLOW_INSECURE_FALLBACK

Boolean

Whether or not to allow SSL insecure fallback for LDAP authentication.

LDAP_BASE_DN

Array of String

The base DN for LDAP authentication.

LDAP_EMAIL_ATTR

String

The email attribute for LDAP authentication.

LDAP_UID_ATTR

String

The uid attribute for LDAP authentication.

LDAP_URI

String

The LDAP URI.

LDAP_USER_FILTER

String

The user filter for LDAP authentication.

LDAP_USER_RDN

Array of String

The user RDN for LDAP authentication.

LDAP_SECONDARY_USER_RDNS

Array of String

Provide Secondary User Relative DNs if there are multiple Organizational Units where user objects are located.

TEAM_RESYNC_STALE_TIME

String

If team syncing is enabled for a team, how often to check its membership and resync if necessary. Pattern: ^[0-9]+(w|m|d|h|s)$ Example: 2h

Default: 30m

LDAP_SUPERUSER_FILTER

String

Subset of the LDAP_USER_FILTER configuration field. When configured, allows Red Hat Quay administrators the ability to configure Lightweight Directory Access Protocol (LDAP) users as superusers when Red Hat Quay uses LDAP as its authentication provider.

With this field, administrators can add or remove superusers without having to update the Red Hat Quay configuration file and restart their deployment.

This field requires that your AUTHENTICATION_TYPE is set to LDAP.

LDAP_GLOBAL_READONLY_SUPERUSER_FILTER

String

Subset of the LDAP_USER_FILTER configuration field. When configured, grants LDAP users who match this filter read access to all repositories, regardless of whether they are public. Red Hat Quay evaluates this filter separately from LDAP_SUPERUSER_FILTER; matching users do not need to be LDAP superusers.

LDAP_RESTRICTED_USER_FILTER

String

Subset of the LDAP_USER_FILTER configuration field. When configured, allows Red Hat Quay administrators the ability to configure Lightweight Directory Access Protocol (LDAP) users as restricted users when Red Hat Quay uses LDAP as its authentication provider.

This field requires that your AUTHENTICATION_TYPE is set to LDAP.

FEATURE_RESTRICTED_USERS

Boolean

When set to True with LDAP_RESTRICTED_USER_FILTER active, only the listed users in the defined LDAP group are restricted.

Default: False

LDAP_TIMEOUT

Integer

Specifies the time limit, in seconds, for LDAP operations. This limits the amount of time an LDAP search, bind, or other operation can take. Similar to the -l option in ldapsearch, it sets a client-side operation timeout.

Default: 10

LDAP_NETWORK_TIMEOUT

Integer

Specifies the time limit, in seconds, for establishing a connection to the LDAP server. This is the maximum time Red Hat Quay waits for a response during network operations, similar to the -o nettimeout option in ldapsearch.

Default: 10

FEATURE_LDAP_CACHING

Boolean

enable in-memory caching for LDAP permission check results (superuser, restricted user). Reduces LDAP server load.

Default: False

LDAP_CACHE_TTL

Integer

Time-to-live, in seconds, for cached LDAP permission results.

Default: 60

DIRECT_OAUTH_CLIENTID_WHITELIST

Array of String

A list of client IDs for Quay-managed applications that are allowed to perform direct OAuth approval without user approval.

FEATURE_ASSIGN_OAUTH_TOKEN

Boolean

Allows organization administrators to assign OAuth tokens to other users.

FEATURE_GITHUB_LOGIN

Boolean

Whether GitHub login is supported

Default: False

GITHUB_LOGIN_CONFIG

Object

Configuration for using GitHub (Enterprise) as an external login provider.

   .ALLOWED_ORGANIZATIONS

Array of String

The names of the GitHub (Enterprise) organizations whitelisted to work with the ORG_RESTRICT option.

   .API_ENDPOINT

String

The endpoint of the GitHub (Enterprise) API to use. Must be overridden for github.com Example: https://api.github.com/

   .CLIENT_ID    (Required)

String

The registered client ID for this Red Hat Quay instance; cannot be shared with GITHUB_TRIGGER_CONFIG. Example: <client_id>

   .CLIENT_SECRET    (Required)

String

The registered client secret for this Red Hat Quay instance. Example: <client_secret>

   .GITHUB_ENDPOINT    (Required)

String

The endpoint for GitHub (Enterprise).

Example: https://github.com/

   .ORG_RESTRICT

Boolean

If true, only users within the organization whitelist can login using this provider.

FEATURE_GOOGLE_LOGIN

Boolean

Whether Google login is supported.

Default: False

GOOGLE_LOGIN_CONFIG

Object

Configuration for using Google for external authentication.

   .CLIENT_ID    (Required)

String

The registered client ID for this Red Hat Quay instance.

Example: <client_id>

   .CLIENT_SECRET    (Required)

String

The registered client secret for this Red Hat Quay instance.

Example: <client_secret>

<string>_LOGIN_CONFIG (Required)

String

The parent key that holds the OIDC configuration settings. Typically the name of the OIDC provider, for example, AZURE_LOGIN_CONFIG, however any arbitrary string is accepted.

   .CLIENT_ID (Required)

String

The registered client ID for this Red Hat Quay instance. Example: 0e8dbe15c4c7630b6780

   .CLIENT_SECRET (Required)

String

The registered client secret for this Red Hat Quay instance. Example: e4a58ddd3d7408b7aec109e85564a0d153d3e846

   .LOGIN_BINDING_FIELD

String

Used when the internal authorization is set to LDAP. Red Hat Quay reads this parameter and tries to search through the LDAP tree for the user with this username. If it exists, it automatically creates a link to that LDAP account.

   .LOGIN_SCOPES

Object

Scopes Red Hat Quay requests during the OIDC login flow. Must include openid. Each scope listed here must also appear in the IdP’s scopes_supported array from /.well-known/openid-configuration.

   .OIDC_ENDPOINT_CUSTOM_PARAMS

String

Support for custom query parameters on OIDC endpoints. The following endpoints are supported: authorization_endpoint, token_endpoint, and user_endpoint.

   .OIDC_ISSUER

String

Allows the user to define the issuer to verify. For example, JWT tokens container a parameter known as iss which defines who issued the token. By default, this is read from the .well-know/openid/configuration endpoint, which is exposed by every OIDC provider. If this verification fails, there is no login.

   .OIDC_ISSUERS

Array of String

Accepted issuer URLs for this provider. When set, Red Hat Quay accepts tokens whose iss claim matches any entry. Use this field to accept multiple issuers, for example Microsoft Entra ID v1.0 and v2.0 URLs during migration. If not set, Red Hat Quay uses OIDC_ISSUER.

   .OIDC_AUDIENCES

Array of String

Accepted audience values for bearer token and On-Behalf-Of (OBO) flows. When set, Red Hat Quay validates the token aud claim against this list. CLIENT_ID is always implicitly included. If not set, audience validation defaults to CLIENT_ID.

   .OIDC_ALLOWED_CLIENTS

Array of String

Optional whitelist of authorized party (azp) client IDs. When set, only tokens from these client applications are accepted. If not set, all clients are accepted. When restricting OBO clients, include your application’s own CLIENT_ID so direct user login continues to work.

   .OIDC_SERVER (Required)

String

The OIDC discovery base URL for authentication. Red Hat Quay uses path joining for OIDC discovery, so the URL must end with a trailing /. Example: https://login.microsoftonline.com/<tenant-id>/v2.0/

   .PREFERRED_USERNAME_CLAIM_NAME

String

Sets the preferred username to a parameter from the token.

   .SERVICE_ICON

String

Changes the icon on the login screen.

   .SERVICE_NAME (Required)

String

The name of the service that is being authenticated. Example: Microsoft Entra ID

   .VERIFIED_EMAIL_CLAIM_NAME

String

The name of the claim that is used to verify the email address of the user.

   .PREFERRED_GROUP_CLAIM_NAME

String

The key name within the OIDC token payload that holds information about the user’s group memberships.

   .OIDC_DISABLE_USER_ENDPOINT

Boolean

Whether to allow or disable the /userinfo endpoint. If using Azure Entra ID, this field must be set to True because Azure obtains the user’s information from the token instead of calling the /userinfo endpoint.

Default: False

USE_PKCE

Boolean

Whether to enable support for Proof Key for Code Exchange.

Default: False

PKCE_METHOD

Integer

The code challenge method used to generate the code_challenge sent in the initial authorization request.

Default: S256

PUBLIC_CLIENT

Boolean

Whether to omit client_secret during token request when the client is public.

Default: False

FEATURE_RECAPTCHA

Boolean

Whether Recaptcha is necessary for user login and recovery

Default: False

RECAPTCHA_SECRET_KEY

String

If recaptcha is enabled, the secret key for the Recaptcha service

RECAPTCHA_SITE_KEY

String

If recaptcha is enabled, the site key for the Recaptcha service

JWT_AUTH_ISSUER

String

The endpoint for JWT users Pattern: ^http(s)?://(.)+$ Example: http://192.168.99.101:6060

JWT_GETUSER_ENDPOINT

String

The endpoint for JWT users Pattern: ^http(s)?://(.)+$ Example: http://192.168.99.101:6060

JWT_QUERY_ENDPOINT

String

The endpoint for JWT queries Pattern: ^http(s)?://(.)+$ Example: http://192.168.99.101:6060

JWT_VERIFY_ENDPOINT

String

The endpoint for JWT verification Pattern: ^http(s)?://(.)+$ Example: http://192.168.99.101:6060

FEATURE_APP_SPECIFIC_TOKENS

Boolean

If enabled, users can create tokens for use by the Docker CLI

Default: True

APP_SPECIFIC_TOKEN_EXPIRATION

String

The expiration for external app tokens.

Default None

Pattern: ^[0-9]+(w|m|d|h|s)$

EXPIRED_APP_SPECIFIC_TOKEN_GC

String

Duration of time expired external app tokens will remain before being garbage collected

Default: 1d

FEATURE_PROGRAMMATIC_BOOTSTRAP

Boolean

Enables programmatic bootstrap token provisioning. When true, Red Hat Quay creates a bootstrap OAuth token on startup and writes it to a local file or Kubernetes Secret. When false, Red Hat Quay revokes any existing bootstrap token on restart.

Default: false

BOOTSTRAP_TOKEN_OWNER

String

Username that owns the bootstrap OAuth application and token. Required when FEATURE_PROGRAMMATIC_BOOTSTRAP is true. The user must exist in the database and be listed in SUPER_USERS.

BOOTSTRAP_TOKEN_PATH

String

Filesystem path where the bootstrap token JSON is written on standalone and virtual machine deployments. In containerized deployments, use a mounted path that the Red Hat Quay process can write, for example /datastorage/bootstrap-token.json.

Default: /var/lib/quay/quay-machine-token.json

BOOTSTRAP_TOKEN_EXPIRATION

Integer

Bootstrap token lifetime in seconds.

Default: 3600 (60 minutes)

BOOTSTRAP_TOKEN_SCOPE

String

Space-separated OAuth scopes assigned to the bootstrap token.

Default: org:admin repo:admin repo:create repo:read repo:write super:user user:admin user:read

PROGRAMMATIC_TOKEN_K8S_SECRET

String

Kubernetes Secret name used to store the bootstrap token when Red Hat Quay runs in Kubernetes. When set, Red Hat Quay writes the token to this Secret instead of BOOTSTRAP_TOKEN_PATH. On Red Hat Quay on OpenShift Container Platform, the Operator sets this field to <quayregistry_name>-bootstrap-token when programmatic bootstrap is enabled. Do not set this field manually in Operator-managed deployments.

PROGRAMMATIC_TOKEN_K8S_KEY

String

Secret data key that stores the bootstrap token JSON. On Red Hat Quay on OpenShift Container Platform, the Operator sets this field to token.json.

Default: token.json

PROGRAMMATIC_TOKEN_K8S_NAMESPACE

String

Kubernetes namespace that contains the bootstrap token Secret. When unset, Red Hat Quay uses the pod service account namespace. On Red Hat Quay on OpenShift Container Platform, the Operator uses the QuayRegistry namespace.

PROGRAMMATIC_TOKEN_PATH

String

Operator-rendered mount path for configuration compatibility. On Red Hat Quay on OpenShift Container Platform, the Operator sets this field to /var/lib/quay/bootstrap-token/token.json. Standalone deployments use BOOTSTRAP_TOKEN_PATH for local file storage.

DEFAULT_NAMESPACE_MAXIMUM_BUILD_COUNT

Number

The default maximum number of builds that can be queued in a namespace.

Default: None

CREATE_PRIVATE_REPO_ON_PUSH

Boolean

Whether new repositories created by push are set to private visibility

Default: True

CREATE_NAMESPACE_ON_PUSH

Boolean

Whether new push to a non-existent organization creates it

Default: False

PUBLIC_NAMESPACES

Array of String

If a namespace is defined in the public namespace list, then it will appear on all users' repository list pages, regardless of whether the user is a member of the namespace. Typically, this is used by an enterprise customer in configuring a set of "well-known" namespaces.

NON_RATE_LIMITED_NAMESPACES

Array of String

If rate limiting has been enabled using FEATURE_RATE_LIMITS, you can override it for specific namespace that require unlimited access.

DISABLE_PUSHES

Boolean

Disables pushes of new content to the registry while retaining all other functionality. Differs from read-only mode because database is not set as read-only. When DISABLE_PUSHES is set to True, the Red Hat Quay garbage collector is disabled. As a result, when PERMANENTLY_DELETE_TAGS is enabled, using the Red Hat Quay UI to permanently delete a tag does not result in the immediate deletion of a tag. Instead, the image stays in the backend storage until DISABLE_PUSHES is set to False, which re-enables the garbage collector. Red Hat Quay administrators should be aware of this caveat when using DISABLE_PUSHES and PERMANENTLY_DELETE_TAGS together.

Default: False

FEATURE_EXTENDED_REPOSITORY_NAMES

Boolean

Enable support for nested repositories Default: True

FEATURE_REPO_MIRROR

Boolean

If set to true, enables repository mirroring.

Default: False

FEATURE_PROXY_STORAGE

Boolean

Whether to proxy all direct download URLs in storage through NGINX.

Default: False

FEATURE_STORAGE_REPLICATION

Boolean

Whether to automatically replicate between storage engines.

Default: False

FEATURE_LOG_EXPORT

Boolean

Whether to allow exporting of action logs.

Default: True

LOGS_MODEL

String

Specifies the preferred method for handling log data. Values: One of database, transition_reads_both_writes_es, elasticsearch, splunk

Default: database

LOGS_MODEL_CONFIG

Object

Logs model config for action logs.

ALLOW_WITHOUT_STRICT_LOGGING

Boolean

When set to True, if the external log system like Splunk or ElasticSearch is intermittently unavailable, allows users to push images normally. Events are logged to the stdout instead. Overrides ALLOW_PULLS_WITHOUT_STRICT_LOGGING if set.

Default: False

LOGS_MODEL_CONFIG.elasticsearch_config.access_key

String

Elasticsearch user (or IAM key for AWS ES).

Example: some_string

.elasticsearch_config.host

String

Elasticsearch cluster endpoint.

Example: host.elasticsearch.example

.elasticsearch_config.index_prefix

String

Prefix for Elasticsearch indexes.

Example: logentry_

.elasticsearch_config.index_settings

Object

Index settings for Elasticsearch.

LOGS_MODEL_CONFIG.elasticsearch_config.use_ssl

Boolean

Whether to use SSL for Elasticsearch.

Default: True

Example: True

.elasticsearch_config.secret_key

String

Elasticsearch password (or IAM secret for AWS ES).

Example: some_secret_string

.elasticsearch_config.aws_region

String

AWS region. Example: us-east-1

.elasticsearch_config.port

Number

Port of the Elasticsearch cluster. Example: 1234

.kinesis_stream_config.aws_secret_key

String

AWS secret key. Example: some_secret_key

.kinesis_stream_config.stream_name

String

AWS Kinesis stream to send action logs to. Example: logentry-kinesis-stream

.kinesis_stream_config.aws_access_key

String

AWS access key. Example: some_access_key

.kinesis_stream_config.retries

Number

Max number of retry attempts for a single request. Example: 5

.kinesis_stream_config.read_timeout

Number

Read timeout in seconds. Example: 5

.kinesis_stream_config.max_pool_connections

Number

Max number of connections in the pool. Example: 10

.kinesis_stream_config.aws_region

String

AWS region. Example: us-east-1

.kinesis_stream_config.connect_timeout

Number

Connection timeout in seconds. Example: 5

.producer

String

Logs producer type. Accepted values: kafka, elasticsearch, kinesis_stream Example: kafka

.kafka_config.topic

String

Kafka topic used to publish log entries. Example: logentry

.kafka_config.bootstrap_servers

Array

List of Kafka brokers used to bootstrap the client.

.kafka_config.max_block_seconds

Number

Max seconds to block during a send() operation. Example: 10

FEATURE_BUILD_SUPPORT

Boolean

Whether to support Dockerfile build.

Default: False

SUCCESSIVE_TRIGGER_FAILURE_DISABLE_THRESHOLD

Number

If not set to None, the number of successive failures that can occur before a build trigger is automatically disabled.

Default: 100

SUCCESSIVE_TRIGGER_INTERNAL_ERROR_DISABLE_THRESHOLD

Number

If not set to None, the number of successive internal errors that can occur before a build trigger is automatically disabled

Default: 5

FEATURE_GITHUB_BUILD

Boolean

Whether to support GitHub build triggers.

Default: False

GITHUB_TRIGGER_CONFIG

Object

Configuration for using GitHub Enterprise for build triggers.

   .GITHUB_ENDPOINT    (Required)

String

The endpoint for GitHub Enterprise. Example: https://github.com/

   .API_ENDPOINT

String

The endpoint of the GitHub Enterprise API to use. Must be overridden for github.com. Example: https://api.github.com/

   .CLIENT_ID    (Required)

String

The registered client ID for this Red Hat Quay instance; this cannot be shared with GITHUB_LOGIN_CONFIG.

   .CLIENT_SECRET    (Required)

String

The registered client secret for this Red Hat Quay instance.

FEATURE_BITBUCKET_BUILD

Boolean

Whether to support Bitbucket build triggers.

Default: False

BITBUCKET_TRIGGER_CONFIG

Object

Configuration for using BitBucket for build triggers.

   .CONSUMER_KEY    (Required)

String

The registered consumer key (client ID) for this Red Hat Quay instance.

   .CONSUMER_SECRET    (Required)

String

The registered consumer secret (client secret) for this Red Hat Quay instance.

FEATURE_GITLAB_BUILD

Boolean

Whether to support GitLab build triggers.

Default: False

GITLAB_TRIGGER_CONFIG

Object

Configuration for using Gitlab for build triggers.

   .GITLAB_ENDPOINT    (Required)

String

The endpoint at which Gitlab Enterprise is running.

   .CLIENT_ID    (Required)

String

The registered client ID for this Red Hat Quay instance.

   .CLIENT_SECRET    (Required)

String

The registered client secret for this Red Hat Quay instance.

ALLOWED_WORKER_COUNT

String

Defines how many Build Workers are instantiated per Red Hat Quay pod. Typically set to 1.

ORCHESTRATOR_PREFIX

String

Defines a unique prefix to be added to all Redis keys. This is useful to isolate Orchestrator values from other Redis keys.

REDIS_HOST

Object

The hostname for your Redis service.

REDIS_PASSWORD

String

The password to authenticate into your Redis service.

REDIS_SSL

Boolean

Defines whether or not your Redis connection uses SSL/TLS.

REDIS_SKIP_KEYSPACE_EVENT_SETUP

Boolean

By default, Red Hat Quay does not set up the keyspace events required for key events at runtime. To do so, set REDIS_SKIP_KEYSPACE_EVENT_SETUP to False.

EXECUTOR

String

Starts a definition of an Executor of this type. Valid values are kubernetes and ec2.

BUILDER_NAMESPACE

String

Kubernetes namespace where Red Hat Quay Builds will take place.

K8S_API_SERVER

Object

Hostname for API Server of the OpenShift Container Platform cluster where Builds will take place.

K8S_API_TLS_CA

Object

The filepath in the Quay container of the Build cluster’s CA certificate for the Quay application to trust when making API calls.

KUBERNETES_DISTRIBUTION

String

Indicates which type of Kubernetes is being used. Valid values are openshift and k8s.

CONTAINER_*

Object

Define the resource requests and limits for each build pod.

NODE_SELECTOR_*

Object

Defines the node selector label name-value pair where build Pods should be scheduled.

CONTAINER_RUNTIME

Object

Specifies whether the Builder should run docker or podman. Customers using Red Hat’s quay-builder image should set this to podman.

SERVICE_ACCOUNT_NAME/SERVICE_ACCOUNT_TOKEN

Object

Defines the Service Account name or token that will be used by build pods.

QUAY_USERNAME/QUAY_PASSWORD

Object

Defines the registry credentials needed to pull the Red Hat Quay build worker image that is specified in the WORKER_IMAGE field. Customers should provide a Red Hat Service Account credential as defined in the section "Creating Registry Service Accounts" against registry.redhat.io in the article at https://access.redhat.com/RegistryAuthentication.

WORKER_IMAGE

Object

Image reference for the Red Hat Quay Builder image. registry.redhat.io/quay/quay-builder

WORKER_TAG

Object

Tag for the Builder image desired. The latest version is 3.18.

BUILDER_VM_CONTAINER_IMAGE

Object

The full reference to the container image holding the internal VM needed to run each Red Hat Quay Build. (registry.redhat.io/quay/quay-builder-qemu-rhcos:3.18).

SETUP_TIME

String

Specifies the number of seconds at which a Build times out if it has not yet registered itself with the Build Manager. Defaults at 500 seconds. Builds that time out are attempted to be restarted three times. If the Build does not register itself after three attempts it is considered failed.

MINIMUM_RETRY_THRESHOLD

String

This setting is used with multiple Executors. It indicates how many retries are attempted to start a Build before a different Executor is chosen. Setting to 0 means there are no restrictions on how many tries the build job needs to have. This value should be kept intentionally small (three or less) to ensure failovers happen quickly during infrastructure failures. You must specify a value for this setting. For example, Kubernetes is set as the first executor and EC2 as the second executor. If you want the last attempt to run a job to always be executed on EC2 and not Kubernetes, you can set the Kubernetes executor’s MINIMUM_RETRY_THRESHOLD to 1 and EC2’s MINIMUM_RETRY_THRESHOLD to 0 (defaults to 0 if not set). In this case, the Kubernetes' MINIMUM_RETRY_THRESHOLD retries_remaining(1) would evaluate to False, therefore falling back to the second executor configured.

SSH_AUTHORIZED_KEYS

Object

List of SSH keys to bootstrap in the ignition config. This allows other keys to be used to SSH into the EC2 instance or QEMU virtual machine (VM).

FEATURE_READER_BUILD_LOGS

Boolean

If set to true, build logs can be read by those with read access to the repository, rather than only write access or admin access.

Default: False

LOG_ARCHIVE_LOCATION

String

The storage location, defined in DISTRIBUTED_STORAGE_CONFIG, in which to place the archived build logs. Example: s3_us_east

LOG_ARCHIVE_PATH

String

The path under the configured storage engine in which to place the archived build logs in .JSON format. Example: archives/buildlogs

FEATURE_IMAGE_PULL_STATS

Boolean

Whether to track and display image pull statistics.

Default: False

REDIS_FLUSH_INTERVAL_SECONDS

Integer

Interval, in seconds, at which the Redis flush worker clears old data. Shorter intervals keep data fresher and help prevent Redis from bloating, while longer intervals reduce flush frequency.

Default: 300 (5 minutes)

PULL_METRICS_REDIS

Object

Connection settings for the Redis database used to store image pull metrics. The host field specifies the Redis server hostname, and the optional db field identifies the Redis database index to use.

Default: {"host": "<redis_host>", "password": "<redis_password>", "port": "<port>", "db": 1}

FEATURE_GARBAGE_COLLECTION

Boolean

Whether garbage collection of repositories is enabled.

Default: True

TAG_EXPIRATION_OPTIONS (Required)

Array of string

If enabled, the options that users can select for expiration of tags in their namespace. Pattern: ^[0-9]+(y|w|m|d|h|s)$

DEFAULT_TAG_EXPIRATION (Required)

String

The default, configurable tag expiration time for time machine. Pattern: ^[0-9]+(y\w|m|d|h|s)$

Default: 2w

FEATURE_CHANGE_TAG_EXPIRATION

Boolean

Whether users and organizations are allowed to change the tag expiration for tags in their namespace.

Default: True

FEATURE_AUTO_PRUNE

Boolean

When set to True, enables functionality related to the auto-pruning of tags.

Default: False

NOTIFICATION_TASK_RUN_MINIMUM_INTERVAL_MINUTES

Integer

The interval, in minutes, that defines the frequency to re-run notifications for expiring images.

Default: 300

DEFAULT_NAMESPACE_AUTOPRUNE_POLICY

Object

The default organization-wide auto-prune policy.

    .method: number_of_tags

Object

The option specifying the number of tags to keep.

    .value: <integer>

Integer

When used with method: number_of_tags, denotes the number of tags to keep. For example, to keep two tags, specify 2.

    .creation_date

Object

The option specifying the duration of which to keep tags.

    .value: <integer>

Integer

When used with creation_date, denotes how long to keep tags. Can be set to seconds (s), days (d), months (m), weeks (w), or years (y). Must include a valid integer. For example, to keep tags for one year, specify 1y.

AUTO_PRUNING_DEFAULT_POLICY_POLL_PERIOD

Integer

The period in which the auto-pruner worker runs at the registry level. By default, it is set to run one time per day (one time per 24 hours). Value must be in seconds.

FEATURE_IMAGE_EXPIRY_TRIGGER

Boolean

Allows users to set up notifications on image expiration. Notifications are only returned on the v2 UI.

Default: False

FEATURE_IMMUTABLE_TAGS

Boolean

Whether to enable immutability policies. Immutability can be set at the individual setting level and via a policy in the repository configuration by an administrator.

Default: False

FEATURE_SECURITY_SCANNER

Boolean

Enable or disable the security scanner Default: False

FEATURE_SECURITY_NOTIFICATIONS

Boolean

If the security scanner is enabled, turn on or turn off security notifications Default: False

SECURITY_SCANNER_V4_REINDEX_THRESHOLD

String

This parameter is used to determine the minimum time, in seconds, to wait before re-indexing a manifest that has either previously failed or has changed states since the last indexing. The data is calculated from the last_indexed datetime in the manifestsecuritystatus table. This parameter is used to avoid trying to re-index every failed manifest on every indexing run. The default time to re-index is 300 seconds.

SECURITY_SCANNER_V4_ENDPOINT

String

The endpoint for the V4 security scanner Pattern: ^http(s)?://(.)+$ Example: http://192.168.99.101:6060

SECURITY_SCANNER_V4_PSK

String

The generated pre-shared key (PSK) for Clair // TODO 36 Check that SECURITY_SCANNER_NOTIFICATIONS can be dropped //

SECURITY_SCANNER_NOTIFICATIONS

String

SECURITY_SCANNER_ENDPOINT

String

The endpoint for the V2 security scanner Pattern: ^http(s)?://(.)+$ Example: http://192.168.99.100:6060

SECURITY_SCANNER_INDEXING_INTERVAL

Integer

This parameter is used to determine the number of seconds between indexing intervals in the security scanner. When indexing is triggered, Red Hat Quay will query its database for manifests that must be indexed by Clair. These include manifests that have not yet been indexed and manifests that previously failed indexing. Default: 30

FEATURE_SECURITY_SCANNER_NOTIFY_ON_NEW_INDEX

Boolean

Whether to allow sending notifications about vulnerabilities for new pushes.

Default: True

SECURITY_SCANNER_V4_MANIFEST_CLEANUP

Boolean

Whether the Red Hat Quay garbage collector removes manifests that are not referenced by other tags or manifests.

Default: True

NOTIFICATION_MIN_SEVERITY_ON_NEW_INDEX

String

Set minimal security level for new notifications on detected vulnerabilities. Avoids creation of large number of notifications after first index. If not defined, defaults to High. Available options include Critical, High, Medium, Low, Negligible, and Unknown.

SECURITY_SCANNER_V4_INDEX_MAX_LAYER_SIZE

String

The maximum layer size allowed for indexing. If the layer size exceeds the configured size, the Red Hat Quay UI returns the following message: The manifest for this tag has layer(s) that are too large to index by the Quay Security Scanner. The default is 8G, and the maximum recommended is 10G. Accepted values are B, K, M, T, and G.

Default: 8G

FEATURE_UI_MODELCARD

Boolean

Enables Model Card image tab in UI. Defaults to True.

UI_MODELCARD_ARTIFACT_TYPE

String

Defines the model card artifact type.

UI_MODELCARD_ANNOTATION

Object

This optional field defines the layer annotation of the model card stored in an OCI image.

UI_MODELCARD_LAYER_ANNOTATION

Object

This optional field defines the layer annotation of the model card stored in an OCI image.

FEATURE_REFERRERS_API

Boolean

Enables OCI 1.1’s referrers API.

FEATURE_QUOTA_MANAGEMENT

Boolean

Enables configuration, caching, and validation for quota management feature.

Default: false

FEATURE_QUOTA_NOTIFICATIONS

Boolean

Enables external notification channels, such as email, for quota threshold alerts. When enabled, namespace owners receive proactive notifications when storage consumption crosses configured warning or critical thresholds.

Default: false

FEATURE_MAILING

Boolean

Enables email delivery features across Red Hat Quay. Must be true with SMTP server settings configured for email quota notifications to be delivered to contact email addresses or administrators.

Default: true

QUOTA_NOTIFICATION_COOLDOWN_SECONDS

Integer

Cooldown period in seconds before re-sending a quota notification for the same threshold (default: 86400 / 24 hours). The system prevents repeated notifications for the same namespace and threshold combination within this window. If storage usage drops below a threshold and later crosses the threshold again, the notification state is cleared and the notification will re-fire upon the new crossing. Notification claims (claim_notification()) are handled atomically in the backend to prevent notification storms caused by concurrent image pushes.

Default: 86400

QUOTA_NOTIFICATION_WORKER_POLL_PERIOD

Integer

How often, in seconds, the quota notification background worker polls for threshold crossings that occur between image pushes—for example, when an administrator lowers a quota limit. Default: 300 (5 minutes).

Default: 300

DEFAULT_SYSTEM_REJECT_QUOTA_BYTES

String

Enables system default quota reject byte allowance for all organizations.

By default, no limit is set.

QUOTA_BACKFILL

Boolean

Enables the quota backfill worker to calculate the size of pre-existing blobs.

Default: true

QUOTA_TOTAL_DELAY_SECONDS

String

The time delay for starting the quota backfill. Rolling deployments can cause incorrect totals. This field must be set to a time longer than it takes for the rolling deployment to complete.

Default: 1800

PERMANENTLY_DELETE_TAGS

Boolean

Enables functionality related to the removal of tags from the time machine window.

Default: false

RESET_CHILD_MANIFEST_EXPIRATION

Boolean

Resets the expirations of temporary tags targeting the child manifests. With this feature set to True, child manifests are immediately garbage collected.

Default: false

FEATURE_PROXY_CACHE

Boolean

Enables Red Hat Quay to act as a pull through cache for upstream registries.

Default: False