Google Cloud · Cloud service
Google Artifact Registry with OrchestrAI
Catalog exported 2026-09-02
Run Google Artifact Registry from chat: create repositories, list images, and configure Docker auth.
OrchestrAI exposes 6 Artifact Registry operations: 3 are low-risk (read-only or low-impact), and 3 create or modify resources and run only after you confirm the plan. 1 of them also carries a step-level approval gate.
What teams use it for
Teams use OrchestrAI with Artifact Registry to stand up a Docker repository for a new service, point their local Docker client at it, and check which image tags have landed before a rollout. Listing repositories across a project is a common first step when auditing what a CI pipeline has been pushing. There is no operation to delete individual images or set a cleanup policy, so pruning stale tags still happens in the console or with gcloud.
Every Artifact Registry operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Configure Docker for GAR |
Configure Docker to authenticate with Artifact Registry | Low risk | No |
List Artifact Registry Images |
List images in a GCP Artifact Registry repository | Low risk | No |
List Artifact Registry Repos |
List GCP Artifact Registry repositories | Low risk | No |
Create Artifact Registry Repo |
Create a GCP Artifact Registry repository | Creates resources | No |
Create Artifact Registry Repository |
Create a Google Artifact Registry repository | Creates resources | No |
Delete Artifact Registry Repo |
Delete a GCP Artifact Registry repository | Modifies existing | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
Prompts that work
- Create a Docker repository called api-images in Artifact Registry in us-central1
- Configure my Docker client to authenticate with Artifact Registry in europe-west1
- List the images in the frontend repository in us-central1 and show the latest tags
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Can OrchestrAI delete an Artifact Registry repository?
- Yes, but repository deletion is rated high risk and waits for your explicit confirmation before it runs, since it removes every image stored in that repository.
- How does OrchestrAI authenticate to Google Artifact Registry?
- It uses a role you grant in your GCP project and mints a short-lived token through workload identity federation before each run. The Docker configuration step writes credential helper settings so docker push and pull work against your registry hostname.
- Which Artifact Registry operations need an extra approval step?
- One operation carries a step-level approval gate on top of plan confirmation: Delete Artifact Registry Repo. None of them is classed destructive.
Other Google Cloud services
Related integrations
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.