Skip to main content
Connect your Docker Hub account so agents can inventory accessible namespaces, review repository visibility and lifetime pulls, inspect tag metadata, and update repository descriptions with approval. Docker Hub authenticates with your account username and a personal access token (PAT).

​
Prerequisites

  • A Docker account with access to the personal and organization repositories you want to inspect.
  • Your Docker Hub username. Use the account name, not an email address or organization name.
  • A personal access token with the permissions described below.
Use a dedicated, expiring PAT for CloudThinker. A Read-only PAT covers every inventory and tag inspection capability.

​
Setup

1

Create a personal access token

Sign in to Docker Home, then select your avatar → Account settings → Personal access tokens → Generate new token. Docker documents this flow in its personal access token guide.Configure the token:
  • Description: cloudthinker
  • Expiration date: choose a lifetime that matches your security policy
  • Access permissions: select Read-only for inventory, or Read, Write & Delete if you also need repository description updates
Select Generate, then copy the token immediately.
2

Add the connection in CloudThinker

Navigate to Connections → Docker Hub and enter:
  • Docker Hub username: the account that created the PAT
  • Personal access token: the PAT you just created
Click Connect. CloudThinker verifies the credentials and personal namespace, then shows a Connected status.
Docker shows a new PAT only once. Store it securely before you leave the page, or generate a replacement.

​
Connection details

​
Required permissions

Docker Hub rejects repository description updates from a Read & Write PAT. Use Read, Write & Delete only when you need that capability. The connection cannot delete repositories or images, even with this PAT. CloudThinker’s write permission ships as Never allow. To enable description updates, open the connected Docker Hub account, expand Tool permissions → Write/delete tools, and select Needs approval. Each update then requires approval.
Start with a Read-only PAT. Grant the broader PAT permission and enable the write permission only for workspaces that need repository text updates.

​
Agent capabilities

Pull counts are lifetime totals, not rates. Reported sizes are compressed image sizes, not storage usage or runtime footprint.

​
Verify the connection

​
Example prompts

​
Troubleshooting

Enter the Docker Hub account name that created the PAT. Do not enter an email address or an organization namespace.
The PAT is wrong, expired, deactivated, or deleted. Generate a new PAT, then reconnect with the same Docker Hub username.
Docker Hub may refuse organization listing for a PAT. This does not prove that the account has no organizations. Ask the agent to inspect the known organization namespace directly, and confirm that the PAT’s account is a member.
Confirm the namespace and repository name. The account that created the PAT must also have permission to read that private repository.
The PAT does not have Read, Write & Delete permission. Docker Hub also rejects this update from a Read & Write PAT. Generate a replacement PAT with the required permission and reconnect.
Open the Docker Hub connection and check Tool permissions → Write/delete tools. Set the write permission to Needs approval, then approve the update when CloudThinker asks.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Prefer Read-only: use Read, Write & Delete only when agents must update repository text. The connection still cannot push, delete, rename, or change repository visibility.
  • Rotate and revoke: set an expiration, review last-used dates, and deactivate or delete unused PATs under Account settings → Personal access tokens.

CircleCI Connection

Monitor pipelines, workflows, jobs, and build logs

Approval

Control actions that require human confirmation