DOCKER

Stacks and registries, governed.

Compose stacks as first-class objects with their environment, their registry credentials and their deploy history attached — instead of a compose file on a server and a token in someone’s shell profile.

Install itSee the install guide
Docker Engine·Compose v2·GHCR / ECR / ACR / GAR·Docker Hub

THE MANUAL WAY

The compose file nobody owns.

THE DRIFTED STACK

The compose file in git and the one running on the server stopped matching some time last quarter. Nobody knows which change is missing, or in which direction.

THE REGISTRY TOKEN

A pull fails at 3am because a registry token expired. The token was created by hand, is in root’s docker config on four hosts, and is documented nowhere.

THE ENV VAR

Someone changed a secret directly on the host to unblock a deploy. It works, it is in no repository, and the next redeploy silently reverts it.

WHAT TALOS DOES

Containers with a paper trail.

Stacks as objects

A stack owns its compose definition, its environment and its target host. Deploying is a job, not an SSH session.

Encrypted registry credentials

Credentials for GHCR, ECR, ACR, GAR and Docker Hub are stored encrypted and injected at pull time rather than written into a host’s docker config.

Managed environment variables

Per-stack variables with secret values masked in the UI and in logs, versioned so a change is attributable.

Service-level control

Restart, scale or inspect an individual service without redeploying the whole stack.

Streaming container logs

Follow logs live in the same pane as every other job, so the muscle memory transfers.

Stack templates

Reusable definitions so the tenth deployment of the same shape is a form, not a copy-paste.

talos.internal/docker/stacks
Servers
Kubernetes
Frappe
Docker
Databases
Pipelines
Monitoring
Stacks9 stacks · 34 containers
web · 3 replicasACTIVE
ghcr.io/acme/web:2.9.1
api · 2 replicasACTIVE
ghcr.io/acme/api:1.14.0
worker · q1ACTIVE
ghcr.io/acme/worker:1.14.0
cache · redisRESTART
redis:7.4 · restarting
$ stack deploy web --tag 2.9.1
→ authenticating to ghcr.io
→ pulled 2.9.1 · 148 MB
→ rolling update 3/3
✓ deploy complete · 41s · job #7712

HOW IT RUNS

Every action is a tracked job.

Requestyou, API or schedule
Queuegated if required
the Sentinelbackground worker
AdapterSSH · Ansible · Terraform · API
Your infrastructurelogs stream back live

WHAT MAKES THIS DIFFERENT

The credentials never land on the host.

The usual failure is not the container — it is the registry token sitting in root’s docker config on every machine, created by hand, shared, and impossible to rotate because nobody can find all the copies. Talos holds registry credentials encrypted, injects them for the duration of the pull, and removes them afterwards. Rotating one is a single edit that every host picks up on its next deploy.

Credentials are scoped per registry and per organization, not global to the machine.
A pull failure names the registry and the reason rather than a generic auth error.
Nothing durable is written to the host’s docker config, so decommissioning a server leaks nothing.
registries · acme-ops
ghcr.io/acme
encrypted · used by 6 stacks
OK
ecr · eu-west-1
encrypted · short-lived tokens
OK
!
docker.io/acme
expires in 9 days
ROTATE
legacy registry
unreachable since 2026-06
STALE

RELATED CAPABILITIES

Deployments

Ship these images through a reviewable pipeline.

explore →

Kubernetes

The same images, orchestrated on a cluster.

explore →

Monitoring

Container health, restarts and live logs.

explore →

Import one stack.

Point Talos at a host running compose today and it will read the stack before it changes it.

Install in one commandSee every capability →