What if docker pull knew who was paying?
Breakwater adds the licensing layer between your registry and your customers. Per-customer credentials, automatic expiry, and a full audit trail—without building it yourself.
$ docker login registry.breakwaterapp.com
Username: acme-co-prod
Password: ••••••••••••••••
$ docker pull registry.breakwaterapp.com/acme/app:2.1.0
> policy: enterprise
> status: allowed (active subscription)
Stop managing access the hard way
You're probably sharing credentials manually, chasing down revocations, and hoping nobody leaks your registry password. There's a better way.
Without Breakwater
- ✗ One shared credential for all customers
- ✗ Manual credential rotation when customers churn
- ✗ No visibility into who's pulling what
- ✗ Version access is all-or-nothing
- ✗ Customers email you asking for credentials
With Breakwater
- ✓ Per-customer, per-product credentials
- ✓ Access expires automatically with the license
- ✓ Full audit trail by customer, product, and tag
- ✓ Tag patterns restrict access to specific versions
- ✓ Customers log in and get their own credentials
Built for licensed container distribution
Breakwater sits in front of your container registry to enforce license, plan, and subscription rules at pull time. No more custom glue code or leaky access tokens.
License-aware auth
Tie access directly to subscriptions, plans, or license keys. Change a customer's status and their pull access updates in real time.
Customer-specific credentials
Issue scoped credentials per customer, project, or environment. Rotate and revoke without disturbing other accounts.
Self-service customer portal
Customers log in, see their licensed products, and copy their docker login commands. No more credential requests in your inbox.
Version-gated access
Restrict licenses to specific tags or version patterns. Enterprise customers get v2.*, Starter customers stay on v1.*.
Observability & audit
See who pulled what, when, and under which license. Exportable logs for security, support, and compliance.
Hosted or bring your own
Use Breakwater's registry and skip the infrastructure. Or connect your existing registry and keep your internal images isolated from customer-facing distribution.
How Breakwater fits into your stack
Use Breakwater's hosted registry or connect your own. Either way, you get an authorization layer that speaks your customer and license model.
Push your images
Push directly to Breakwater's hosted registry, or connect your existing registry (ghcr, ECR, Harbor). Keep internal images separate from customer-facing distribution.
docker push registry.breakwaterapp.com/acme/app
Model plans & licenses
Sync your billing or license system. Define which plans or licenses map to which images and tags.
plans: starter, pro, enterprise
Issue credentials, start pulling
Your customers authenticate via Breakwater. Each pull is checked against active licenses before the registry is touched.
docker login registry.breakwaterapp.com
A dashboard for your sales and support teams
The vendor portal gives your team full control over customers, products, and licenses—without touching the command line.
- Create and manage customers and their licenses
- Issue, rotate, or revoke credentials instantly
- See pull activity by customer, product, or tag
- Extend, expire, or cancel licenses in one click
Developer-first by design
A clean API, webhooks, and CLI tools so Breakwater can plug into the systems you already run—billing, CRM, CI/CD, and support.
- REST + webhook integrations for your billing system.
- CLI for issuing credentials and debugging policies.
- Audit-friendly logs and export formats.
Just shipping your first container?
You don't need a big team to sell containerized software. Our Starter plan gives you everything you need to license and distribute your product to your first customers—no registry setup required.
Be the first to test Breakwater
We're working with a small group of vendors who distribute their product as containers. Tell us a bit about your setup and we'll reach out with details.
Request early access