Pull OpenTofu Modules Directly from OCI Registries in Scalr

OpenTofu's oci:// module source scheme lets you store and version Terraform modules as OCI artifacts alongside your container images. The new OCI registry integration in Scalr handles the credentials part for you. You store your registry credentials once in Scalr, and every plan and apply run can authenticate with your private registry automatically. You don't have to set environment variables, hardcode secrets, or configure anything per workspace.

How It Works

When you create a Docker-compatible registry integration and enable Export credentials, Scalr encrypts the credentials at rest and injects them into the Docker auth configuration on each run. When tofu init encounters an oci:// source, it finds the credentials already in place and pulls the module without any additional setup.

module "networking" {
  source = "oci://ghcr.io/your-org/terraform-networking?tag=1.4.0"
}

That's the only change you make to your configuration. The credential injection happens at the platform level, so the person consuming the workspace never sees it.

Supported Registries

The integration works with any registry that speaks the Docker Registry HTTP API V2 with username/password or PAT authentication:

• Docker Hub (https://registry-1.docker.io)
• GitHub Container Registry (https://ghcr.io)
• GitLab Container Registry (https://registry.gitlab.com)
• JFrog Artifactory (https://<your-subdomain>.jfrog.io)
• Any other Docker-compatible private registry

One caveat worth knowing upfront: registries that require provider-specific auth flows, like Amazon ECR, Azure ACR, and Google Artifact Registry, are not yet supported.

Setting It Up

The setup is three steps for any of the supported registries:

1. Generate a PAT in your registry with at least read access to the repository holding your modules.
2. Create the integration in Scalr under Account → Integrations → Docker registry. Enter the registry URL, username, and PAT, and enable Export credentials.
3. Reference your modules using the oci:// source scheme in your OpenTofu configurations.

One integration per registry host is all you need. Scalr injects a single credential set per host per run, so if you're pulling from multiple registries, create one integration for each.

Credentials Stay Out of Your Code

The credentials are encrypted at rest and never returned in API responses. There's nothing to rotate in your workspaces when a token changes. Update the integration once and every run picks it up automatically. The same RBAC model that governs other account-scoped integrations in Scalr controls who can create, update, or delete registry credentials.

For setup details per registry, see the OCI Registry documentation.