DOCKER
Stacks and registries, governed.
Compose stacks as first-class objects with their environment, their registry credentials and their deploy history attached — instead of a compose file on a server and a token in someone’s shell profile.
THE MANUAL WAY
The compose file nobody owns.
THE DRIFTED STACK
The compose file in git and the one running on the server stopped matching some time last quarter. Nobody knows which change is missing, or in which direction.
THE REGISTRY TOKEN
A pull fails at 3am because a registry token expired. The token was created by hand, is in root’s docker config on four hosts, and is documented nowhere.
THE ENV VAR
Someone changed a secret directly on the host to unblock a deploy. It works, it is in no repository, and the next redeploy silently reverts it.
WHAT TALOS DOES
Containers with a paper trail.
Stacks as objects
A stack owns its compose definition, its environment and its target host. Deploying is a job, not an SSH session.
Encrypted registry credentials
Credentials for GHCR, ECR, ACR, GAR and Docker Hub are stored encrypted and injected at pull time rather than written into a host’s docker config.
Managed environment variables
Per-stack variables with secret values masked in the UI and in logs, versioned so a change is attributable.
Service-level control
Restart, scale or inspect an individual service without redeploying the whole stack.
Streaming container logs
Follow logs live in the same pane as every other job, so the muscle memory transfers.
Stack templates
Reusable definitions so the tenth deployment of the same shape is a form, not a copy-paste.
HOW IT RUNS
Every action is a tracked job.
WHAT MAKES THIS DIFFERENT
The credentials never land on the host.
The usual failure is not the container — it is the registry token sitting in root’s docker config on every machine, created by hand, shared, and impossible to rotate because nobody can find all the copies. Talos holds registry credentials encrypted, injects them for the duration of the pull, and removes them afterwards. Rotating one is a single edit that every host picks up on its next deploy.
RELATED CAPABILITIES
Import one stack.
Point Talos at a host running compose today and it will read the stack before it changes it.