fix: move writeLogsToFile doc comment to correct position

The buildRegistryAuths function was inserted between the writeLogsToFile doc comment and the writeLogsToFile function body, causing Go to treat the writeLogsToFile comment as part of buildRegistryAuths godoc. Move the writeLogsToFile comment to sit directly above its function, and keep only the buildRegistryAuths comment above buildRegistryAuths.
feat: add private Docker registry authentication for base images
2026-03-17 02:39:38 -07:00 · 2026-03-17 02:14:39 -07:00
18 changed files with 703 additions and 747 deletions
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ A simple self-hosted PaaS that auto-deploys Docker containers from Git repositor
 - Per-app UUID-based webhook URLs for Gitea integration
 - Branch filtering - only deploy on configured branch changes
 - Environment variables, labels, and volume mounts per app
- CPU and memory resource limits per app
+- Private Docker registry authentication for base images
 - Docker builds via socket access
 - Notifications via ntfy and Slack-compatible webhooks
 - Simple server-rendered UI with Tailwind CSS
--- a/internal/database/migrations/007_add_registry_credentials.sql
+++ b/internal/database/migrations/007_add_registry_credentials.sql
@@ -0,0 +1,11 @@
+-- Add registry credentials for private Docker registry authentication during builds
+CREATE TABLE registry_credentials (
+    id INTEGER PRIMARY KEY,
+    app_id TEXT NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
+    registry TEXT NOT NULL,
+    username TEXT NOT NULL,
+    password TEXT NOT NULL,
+    UNIQUE(app_id, registry)
+);
+
+CREATE INDEX idx_registry_credentials_app_id ON registry_credentials(app_id);
--- a/internal/database/migrations/007_add_resource_limits.sql
+++ b/internal/database/migrations/007_add_resource_limits.sql
@@ -1,3 +0,0 @@
-- Add CPU and memory resource limits per app
-ALTER TABLE apps ADD COLUMN cpu_limit REAL;
-ALTER TABLE apps ADD COLUMN memory_limit INTEGER;
--- a/internal/docker/auth_test.go
+++ b/internal/docker/auth_test.go
@@ -0,0 +1,96 @@
+package docker //nolint:testpackage // tests unexported buildAuthConfigs
+
+import (
+	"testing"
+)
+
+func TestBuildAuthConfigsEmpty(t *testing.T) {
+	t.Parallel()
+
+	result := buildAuthConfigs(nil)
+	if len(result) != 0 {
+		t.Errorf("expected empty map, got %d entries", len(result))
+	}
+}
+
+func TestBuildAuthConfigsSingle(t *testing.T) {
+	t.Parallel()
+
+	auths := []RegistryAuth{
+		{
+			Registry: "registry.example.com",
+			Username: "user",
+			Password: "pass",
+		},
+	}
+
+	result := buildAuthConfigs(auths)
+
+	if len(result) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(result))
+	}
+
+	cfg, ok := result["registry.example.com"]
+	if !ok {
+		t.Fatal("expected registry.example.com key")
+	}
+
+	if cfg.Username != "user" {
+		t.Errorf("expected username 'user', got %q", cfg.Username)
+	}
+
+	if cfg.Password != "pass" {
+		t.Errorf("expected password 'pass', got %q", cfg.Password)
+	}
+
+	if cfg.ServerAddress != "registry.example.com" {
+		t.Errorf("expected server address 'registry.example.com', got %q", cfg.ServerAddress)
+	}
+}
+
+func TestBuildAuthConfigsMultiple(t *testing.T) {
+	t.Parallel()
+
+	auths := []RegistryAuth{
+		{Registry: "ghcr.io", Username: "ghuser", Password: "ghtoken"},
+		{Registry: "docker.io", Username: "dkuser", Password: "dktoken"},
+	}
+
+	result := buildAuthConfigs(auths)
+
+	if len(result) != 2 {
+		t.Fatalf("expected 2 entries, got %d", len(result))
+	}
+
+	ghcr := result["ghcr.io"]
+	if ghcr.Username != "ghuser" || ghcr.Password != "ghtoken" {
+		t.Errorf("unexpected ghcr.io config: %+v", ghcr)
+	}
+
+	dkr := result["docker.io"]
+	if dkr.Username != "dkuser" || dkr.Password != "dktoken" {
+		t.Errorf("unexpected docker.io config: %+v", dkr)
+	}
+}
+
+func TestRegistryAuthStruct(t *testing.T) {
+	t.Parallel()
+
+	auth := RegistryAuth{
+		Registry: "registry.example.com",
+		Username: "testuser",
+		Password: "testpass",
+	}
+
+	if auth.Registry != "registry.example.com" {
+		t.Errorf("expected registry 'registry.example.com', got %q", auth.Registry)
+	}
+
+	if auth.Username != "testuser" {
+		t.Errorf("expected username 'testuser', got %q", auth.Username)
+	}
+
+	if auth.Password != "testpass" {
+		t.Errorf("expected password 'testpass', got %q", auth.Password)
+	}
+}
--- a/internal/docker/client.go
+++ b/internal/docker/client.go
@@ -20,6 +20,7 @@ import (
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/registry"
 	"github.com/docker/docker/client"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/go-connections/nat"
@@ -105,12 +106,20 @@ func (c *Client) IsConnected() bool {
 	return c.docker != nil
 }

+// RegistryAuth contains authentication credentials for a Docker registry.
+type RegistryAuth struct {
+	Registry string
+	Username string
+	Password string //nolint:gosec // credential field required for registry auth
+}
+
 // BuildImageOptions contains options for building an image.
 type BuildImageOptions struct {
 	ContextDir     string
 	DockerfilePath string
 	Tags           []string
 	LogWriter      io.Writer      // Optional writer for build output
+	RegistryAuths  []RegistryAuth // Optional registry credentials for pulling private base images
 }

 // BuildImage builds a Docker image from a context directory.
@@ -145,8 +154,6 @@ type CreateContainerOptions struct {
 	Volumes []VolumeMount
 	Ports   []PortMapping
 	Network string
-	CPULimit    float64 // CPU cores (e.g. 0.5 = half a core, 2.0 = two cores). 0 means unlimited.
-	MemoryLimit int64   // Memory in bytes. 0 means unlimited.
 }

 // VolumeMount represents a volume mount.
@@ -163,12 +170,19 @@ type PortMapping struct {
 	Protocol      string // "tcp" or "udp"
 }

-// nanoCPUsPerCPU is the number of NanoCPUs per CPU core.
-const nanoCPUsPerCPU = 1e9
+// buildAuthConfigs converts RegistryAuth slices into Docker's AuthConfigs map.
+func buildAuthConfigs(auths []RegistryAuth) map[string]registry.AuthConfig {
+	configs := make(map[string]registry.AuthConfig, len(auths))

-// cpuLimitToNanoCPUs converts a CPU limit (e.g. 0.5 cores) to Docker NanoCPUs.
-func cpuLimitToNanoCPUs(cpuLimit float64) int64 {
-	return int64(cpuLimit * nanoCPUsPerCPU)
+	for _, auth := range auths {
+		configs[auth.Registry] = registry.AuthConfig{
+			Username:      auth.Username,
+			Password:      auth.Password,
+			ServerAddress: auth.Registry,
+		}
+	}
+
+	return configs
 }

 // buildPortConfig converts port mappings to Docker port configuration.
@@ -195,48 +209,6 @@ func buildPortConfig(ports []PortMapping) (nat.PortSet, nat.PortMap) {
 	return exposedPorts, portBindings
 }

-// buildEnvSlice converts an env map to a Docker-compatible env slice.
-func buildEnvSlice(env map[string]string) []string {
-	envSlice := make([]string, 0, len(env))
-
-	for key, val := range env {
-		envSlice = append(envSlice, key+"="+val)
-	}
-
-	return envSlice
-}
-
-// buildMounts converts volume mounts to Docker mount configuration.
-func buildMounts(volumes []VolumeMount) []mount.Mount {
-	mounts := make([]mount.Mount, 0, len(volumes))
-
-	for _, vol := range volumes {
-		mounts = append(mounts, mount.Mount{
-			Type:     mount.TypeBind,
-			Source:   vol.HostPath,
-			Target:   vol.ContainerPath,
-			ReadOnly: vol.ReadOnly,
-		})
-	}
-
-	return mounts
-}
-
-// buildResources builds Docker resource constraints from container options.
-func buildResources(opts CreateContainerOptions) container.Resources {
-	resources := container.Resources{}
-
-	if opts.CPULimit > 0 {
-		resources.NanoCPUs = cpuLimitToNanoCPUs(opts.CPULimit)
-	}
-
-	if opts.MemoryLimit > 0 {
-		resources.Memory = opts.MemoryLimit
-	}
-
-	return resources
-}
-
 // CreateContainer creates a new container.
 func (c *Client) CreateContainer(
 	ctx context.Context,
@@ -248,20 +220,40 @@ func (c *Client) CreateContainer(

 	c.log.Info("creating container", "name", opts.Name, "image", opts.Image)

+	// Convert env map to slice
+	envSlice := make([]string, 0, len(opts.Env))
+
+	for key, val := range opts.Env {
+		envSlice = append(envSlice, key+"="+val)
+	}
+
+	// Convert volumes to mounts
+	mounts := make([]mount.Mount, 0, len(opts.Volumes))
+
+	for _, vol := range opts.Volumes {
+		mounts = append(mounts, mount.Mount{
+			Type:     mount.TypeBind,
+			Source:   vol.HostPath,
+			Target:   vol.ContainerPath,
+			ReadOnly: vol.ReadOnly,
+		})
+	}
+
+	// Convert ports to exposed ports and port bindings
 	exposedPorts, portBindings := buildPortConfig(opts.Ports)

+	// Create container
 	resp, err := c.docker.ContainerCreate(ctx,
 		&container.Config{
 			Image:        opts.Image,
-			Env:          buildEnvSlice(opts.Env),
+			Env:          envSlice,
 			Labels:       opts.Labels,
 			ExposedPorts: exposedPorts,
 		},
 		&container.HostConfig{
-			Mounts:       buildMounts(opts.Volumes),
+			Mounts:       mounts,
 			PortBindings: portBindings,
 			NetworkMode:  container.NetworkMode(opts.Network),
-			Resources:    buildResources(opts),
 			RestartPolicy: container.RestartPolicy{
 				Name: container.RestartPolicyUnlessStopped,
 			},
@@ -545,12 +537,18 @@ func (c *Client) performBuild(
 	}()

 	// Build image
-	resp, err := c.docker.ImageBuild(ctx, tarArchive, dockertypes.ImageBuildOptions{
+	buildOpts := dockertypes.ImageBuildOptions{
 		Dockerfile: opts.DockerfilePath,
 		Tags:       opts.Tags,
 		Remove:     true,
 		NoCache:    false,
-	})
+	}
+
+	if len(opts.RegistryAuths) > 0 {
+		buildOpts.AuthConfigs = buildAuthConfigs(opts.RegistryAuths)
+	}
+
+	resp, err := c.docker.ImageBuild(ctx, tarArchive, buildOpts)
 	if err != nil {
 		return "", fmt.Errorf("failed to build image: %w", err)
 	}
--- a/internal/docker/resource_limits_test.go
+++ b/internal/docker/resource_limits_test.go
@@ -1,31 +0,0 @@
-package docker //nolint:testpackage // tests unexported cpuLimitToNanoCPUs
-
-import (
-	"testing"
-)
-
-func TestCpuLimitToNanoCPUs(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		cpuLimit float64
-		expected int64
-	}{
-		{"one core", 1.0, 1_000_000_000},
-		{"half core", 0.5, 500_000_000},
-		{"two cores", 2.0, 2_000_000_000},
-		{"quarter core", 0.25, 250_000_000},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := cpuLimitToNanoCPUs(tt.cpuLimit)
-			if got != tt.expected {
-				t.Errorf("cpuLimitToNanoCPUs(%v) = %d, want %d", tt.cpuLimit, got, tt.expected)
-			}
-		})
-	}
-}
--- a/internal/handlers/app.go
+++ b/internal/handlers/app.go
@@ -148,6 +148,7 @@ func (h *Handlers) HandleAppDetail() http.HandlerFunc {
 		labels, _ := application.GetLabels(request.Context())
 		volumes, _ := application.GetVolumes(request.Context())
 		ports, _ := application.GetPorts(request.Context())
+		registryCreds, _ := application.GetRegistryCredentials(request.Context())
 		deployments, _ := application.GetDeployments(
 			request.Context(),
 			recentDeploymentsLimit,
@@ -168,6 +169,7 @@ func (h *Handlers) HandleAppDetail() http.HandlerFunc {
 			"Labels":              labels,
 			"Volumes":             volumes,
 			"Ports":               ports,
+			"RegistryCredentials": registryCreds,
 			"Deployments":         deployments,
 			"LatestDeployment":    latestDeployment,
 			"WebhookURL":          webhookURL,
@@ -257,19 +259,23 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // valid
 		application.RepoURL = request.FormValue("repo_url")
 		application.Branch = request.FormValue("branch")
 		application.DockerfilePath = request.FormValue("dockerfile_path")
-		application.DockerNetwork = optionalNullString(request.FormValue("docker_network"))
-		application.NtfyTopic = optionalNullString(request.FormValue("ntfy_topic"))
-		application.SlackWebhook = optionalNullString(request.FormValue("slack_webhook"))

-		limitsErr := applyResourceLimits(application, request)
-		if limitsErr != "" {
-			data := h.addGlobals(map[string]any{
-				"App":   application,
-				"Error": limitsErr,
-			}, request)
-			h.renderTemplate(writer, tmpl, "app_edit.html", data)
+		if network := request.FormValue("docker_network"); network != "" {
+			application.DockerNetwork = sql.NullString{String: network, Valid: true}
+		} else {
+			application.DockerNetwork = sql.NullString{}
+		}

-			return
+		if ntfy := request.FormValue("ntfy_topic"); ntfy != "" {
+			application.NtfyTopic = sql.NullString{String: ntfy, Valid: true}
+		} else {
+			application.NtfyTopic = sql.NullString{}
+		}
+
+		if slack := request.FormValue("slack_webhook"); slack != "" {
+			application.SlackWebhook = sql.NullString{String: slack, Valid: true}
+		} else {
+			application.SlackWebhook = sql.NullString{}
 		}

 		saveErr := application.Save(request.Context())
@@ -1364,129 +1370,6 @@ func validateVolumePaths(hostPath, containerPath string) error {
 	return nil
 }

-// ErrInvalidMemoryFormat is returned when a memory limit string cannot be parsed.
-var ErrInvalidMemoryFormat = errors.New(
-	"must be a number with optional unit suffix (e.g. 256m, 1g, 512000000)",
-)
-
-// ErrNegativeValue is returned when a resource limit is negative.
-var ErrNegativeValue = errors.New("value must be positive")
-
-// Memory unit byte multipliers.
-const (
-	kilobyte = 1024
-	megabyte = 1024 * 1024
-	gigabyte = 1024 * 1024 * 1024
-)
-
-// optionalNullString converts a form value to a sql.NullString.
-// Returns a valid NullString if non-empty, invalid (NULL) if empty.
-func optionalNullString(s string) sql.NullString {
-	if s != "" {
-		return sql.NullString{String: s, Valid: true}
-	}
-
-	return sql.NullString{}
-}
-
-// applyResourceLimits parses CPU and memory limit form values and applies them to the app.
-// Returns an error message string if validation fails, or empty string on success.
-func applyResourceLimits(application *models.App, request *http.Request) string {
-	cpuLimit, cpuErr := parseOptionalFloat64(request.FormValue("cpu_limit"))
-	if cpuErr != nil {
-		return "Invalid CPU limit: must be a positive number (e.g. 0.5, 1, 2)"
-	}
-
-	application.CPULimit = cpuLimit
-
-	memoryLimit, memErr := parseOptionalMemoryBytes(request.FormValue("memory_limit"))
-	if memErr != nil {
-		return "Invalid memory limit: " + memErr.Error()
-	}
-
-	application.MemoryLimit = memoryLimit
-
-	return ""
-}
-
-// memoryUnitMultiplier returns the byte multiplier for a memory unit suffix.
-// Returns 0 if the suffix is not recognized.
-func memoryUnitMultiplier(suffix byte) int64 {
-	switch suffix {
-	case 'k':
-		return kilobyte
-	case 'm':
-		return megabyte
-	case 'g':
-		return gigabyte
-	default:
-		return 0
-	}
-}
-
-// parseOptionalFloat64 parses an optional float64 form field.
-// Returns a valid NullFloat64 if the string is non-empty and parses to a positive number.
-// Returns an empty NullFloat64 if the string is empty.
-// Returns an error if the string is non-empty but invalid or non-positive.
-func parseOptionalFloat64(s string) (sql.NullFloat64, error) {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return sql.NullFloat64{}, nil
-	}
-
-	val, err := strconv.ParseFloat(s, 64)
-	if err != nil {
-		return sql.NullFloat64{}, fmt.Errorf("invalid number: %w", err)
-	}
-
-	if val <= 0 {
-		return sql.NullFloat64{}, ErrNegativeValue
-	}
-
-	return sql.NullFloat64{Float64: val, Valid: true}, nil
-}
-
-// parseOptionalMemoryBytes parses an optional memory limit string into bytes.
-// Accepts plain bytes (e.g. "536870912") or suffixed values (e.g. "512m", "1g", "256k").
-// Returns a valid NullInt64 with bytes if non-empty, empty NullInt64 if blank.
-func parseOptionalMemoryBytes(s string) (sql.NullInt64, error) {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return sql.NullInt64{}, nil
-	}
-
-	s = strings.ToLower(s)
-
-	// Check for unit suffix
-	multiplier := memoryUnitMultiplier(s[len(s)-1])
-	if multiplier > 0 {
-		numStr := s[:len(s)-1]
-
-		val, err := strconv.ParseFloat(numStr, 64)
-		if err != nil {
-			return sql.NullInt64{}, ErrInvalidMemoryFormat
-		}
-
-		if val <= 0 {
-			return sql.NullInt64{}, ErrNegativeValue
-		}
-
-		return sql.NullInt64{Int64: int64(val * float64(multiplier)), Valid: true}, nil
-	}
-
-	// Plain bytes
-	val, err := strconv.ParseInt(s, 10, 64)
-	if err != nil {
-		return sql.NullInt64{}, ErrInvalidMemoryFormat
-	}
-
-	if val <= 0 {
-		return sql.NullInt64{}, ErrNegativeValue
-	}
-
-	return sql.NullInt64{Int64: val, Valid: true}, nil
-}
-
 // formatDeployKey formats an SSH public key with a descriptive comment.
 // Format: ssh-ed25519 AAAA... upaas_2025-01-15_myapp
 func formatDeployKey(pubKey string, createdAt time.Time, appName string) string {
@@ -1501,3 +1384,126 @@ func formatDeployKey(pubKey string, createdAt time.Time, appName string) string

 	return parts[0] + " " + parts[1] + " " + comment
 }
+
+// HandleRegistryCredentialAdd handles adding a registry credential.
+func (h *Handlers) HandleRegistryCredentialAdd() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, findErr := models.FindApp(request.Context(), h.db, appID)
+		if findErr != nil || application == nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		parseErr := request.ParseForm()
+		if parseErr != nil {
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		registryURL := strings.TrimSpace(request.FormValue("registry"))
+		username := strings.TrimSpace(request.FormValue("username"))
+		password := request.FormValue("password")
+
+		if registryURL == "" || username == "" || password == "" {
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+
+			return
+		}
+
+		cred := models.NewRegistryCredential(h.db)
+		cred.AppID = appID
+		cred.Registry = registryURL
+		cred.Username = username
+		cred.Password = password
+
+		saveErr := cred.Save(request.Context())
+		if saveErr != nil {
+			h.log.Error("failed to save registry credential", "error", saveErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	}
+}
+
+// HandleRegistryCredentialEdit handles editing an existing registry credential.
+func (h *Handlers) HandleRegistryCredentialEdit() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+		credIDStr := chi.URLParam(request, "credID")
+
+		credID, parseErr := strconv.ParseInt(credIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		cred, findErr := models.FindRegistryCredential(request.Context(), h.db, credID)
+		if findErr != nil || cred == nil || cred.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		formErr := request.ParseForm()
+		if formErr != nil {
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		registryURL := strings.TrimSpace(request.FormValue("registry"))
+		username := strings.TrimSpace(request.FormValue("username"))
+		password := request.FormValue("password")
+
+		if registryURL == "" || username == "" || password == "" {
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+
+			return
+		}
+
+		cred.Registry = registryURL
+		cred.Username = username
+		cred.Password = password
+
+		saveErr := cred.Save(request.Context())
+		if saveErr != nil {
+			h.log.Error("failed to update registry credential", "error", saveErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	}
+}
+
+// HandleRegistryCredentialDelete handles deleting a registry credential.
+func (h *Handlers) HandleRegistryCredentialDelete() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+		credIDStr := chi.URLParam(request, "credID")
+
+		credID, parseErr := strconv.ParseInt(credIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		cred, findErr := models.FindRegistryCredential(request.Context(), h.db, credID)
+		if findErr != nil || cred == nil || cred.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		deleteErr := cred.Delete(request.Context())
+		if deleteErr != nil {
+			h.log.Error("failed to delete registry credential", "error", deleteErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	}
+}
--- a/internal/handlers/resource_limits_test.go
+++ b/internal/handlers/resource_limits_test.go
@@ -1,195 +0,0 @@
-package handlers //nolint:testpackage // tests unexported parsing functions
-
-import (
-	"database/sql"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParseOptionalFloat64(t *testing.T) {
-	t.Parallel()
-
-	t.Run("empty string returns invalid", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalFloat64("")
-		require.NoError(t, err)
-		assert.False(t, result.Valid)
-	})
-
-	t.Run("whitespace only returns invalid", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalFloat64("   ")
-		require.NoError(t, err)
-		assert.False(t, result.Valid)
-	})
-
-	t.Run("valid float", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalFloat64("0.5")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.InDelta(t, 0.5, result.Float64, 0.001)
-	})
-
-	t.Run("valid integer", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalFloat64("2")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.InDelta(t, 2.0, result.Float64, 0.001)
-	})
-
-	t.Run("negative value rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalFloat64("-1")
-		require.Error(t, err)
-	})
-
-	t.Run("zero value rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalFloat64("0")
-		require.Error(t, err)
-	})
-
-	t.Run("non-numeric rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalFloat64("abc")
-		require.Error(t, err)
-	})
-}
-
-func TestParseOptionalMemoryBytes(t *testing.T) { //nolint:funlen // table-driven test
-	t.Parallel()
-
-	t.Run("empty string returns invalid", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("")
-		require.NoError(t, err)
-		assert.False(t, result.Valid)
-	})
-
-	t.Run("whitespace only returns invalid", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("   ")
-		require.NoError(t, err)
-		assert.False(t, result.Valid)
-	})
-
-	t.Run("plain bytes", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("536870912")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(536870912), result.Int64)
-	})
-
-	t.Run("megabytes suffix", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("256m")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(256*1024*1024), result.Int64)
-	})
-
-	t.Run("megabytes suffix uppercase", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("256M")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(256*1024*1024), result.Int64)
-	})
-
-	t.Run("gigabytes suffix", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("1g")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(1024*1024*1024), result.Int64)
-	})
-
-	t.Run("kilobytes suffix", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("512k")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(512*1024), result.Int64)
-	})
-
-	t.Run("fractional gigabytes", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("1.5g")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(1.5*1024*1024*1024), result.Int64)
-	})
-
-	t.Run("negative value rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalMemoryBytes("-256m")
-		require.Error(t, err)
-	})
-
-	t.Run("zero value rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalMemoryBytes("0")
-		require.Error(t, err)
-	})
-
-	t.Run("invalid string rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalMemoryBytes("abc")
-		require.Error(t, err)
-	})
-
-	t.Run("negative plain bytes rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalMemoryBytes("-100")
-		require.Error(t, err)
-	})
-}
-
-func TestAppResourceLimitsRoundTrip(t *testing.T) {
-	t.Parallel()
-
-	// Test that parsing and formatting are consistent
-	tests := []struct {
-		input    string
-		expected sql.NullInt64
-		format   string
-	}{
-		{"256m", sql.NullInt64{Int64: 256 * 1024 * 1024, Valid: true}, "256m"},
-		{"1g", sql.NullInt64{Int64: 1024 * 1024 * 1024, Valid: true}, "1g"},
-		{"512k", sql.NullInt64{Int64: 512 * 1024, Valid: true}, "512k"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			t.Parallel()
-
-			result, err := parseOptionalMemoryBytes(tt.input)
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
--- a/internal/models/app.go
+++ b/internal/models/app.go
@@ -14,8 +14,7 @@ import (
 const appColumns = `id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
 			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id, cpu_limit, memory_limit,
-			created_at, updated_at`
+			previous_image_id, created_at, updated_at`

 // AppStatus represents the status of an app.
 type AppStatus string
@@ -48,8 +47,6 @@ type App struct {
 	DockerNetwork     sql.NullString
 	NtfyTopic         sql.NullString
 	SlackWebhook      sql.NullString
-	CPULimit          sql.NullFloat64
-	MemoryLimit       sql.NullInt64
 	CreatedAt         time.Time
 	UpdatedAt         time.Time
 }
@@ -122,6 +119,11 @@ func (a *App) GetWebhookEvents(
 	return FindWebhookEventsByAppID(ctx, a.db, a.ID, limit)
 }

+// GetRegistryCredentials returns all registry credentials for the app.
+func (a *App) GetRegistryCredentials(ctx context.Context) ([]*RegistryCredential, error) {
+	return FindRegistryCredentialsByAppID(ctx, a.db, a.ID)
+}
+
 func (a *App) exists(ctx context.Context) bool {
 	if a.ID == "" {
 		return false
@@ -145,14 +147,14 @@ func (a *App) insert(ctx context.Context) error {
 			id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
 			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id, cpu_limit, memory_limit
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			previous_image_id
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`

 	_, err := a.db.Exec(ctx, query,
 		a.ID, a.Name, a.RepoURL, a.Branch, a.DockerfilePath, a.WebhookSecret,
 		a.SSHPrivateKey, a.SSHPublicKey, a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook, a.WebhookSecretHash,
-		a.PreviousImageID, a.CPULimit, a.MemoryLimit,
+		a.PreviousImageID,
 	)
 	if err != nil {
 		return err
@@ -168,7 +170,6 @@ func (a *App) update(ctx context.Context) error {
 			image_id = ?, status = ?,
 			docker_network = ?, ntfy_topic = ?, slack_webhook = ?,
 			previous_image_id = ?,
-			cpu_limit = ?, memory_limit = ?,
 			updated_at = CURRENT_TIMESTAMP
 		WHERE id = ?`

@@ -177,7 +178,6 @@ func (a *App) update(ctx context.Context) error {
 		a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook,
 		a.PreviousImageID,
-		a.CPULimit, a.MemoryLimit,
 		a.ID,
 	)

@@ -193,7 +193,6 @@ func (a *App) scan(row *sql.Row) error {
 		&a.DockerNetwork, &a.NtfyTopic, &a.SlackWebhook,
 		&a.WebhookSecretHash,
 		&a.PreviousImageID,
-		&a.CPULimit, &a.MemoryLimit,
 		&a.CreatedAt, &a.UpdatedAt,
 	)
 }
@@ -212,7 +211,6 @@ func scanApps(appDB *database.Database, rows *sql.Rows) ([]*App, error) {
 			&app.DockerNetwork, &app.NtfyTopic, &app.SlackWebhook,
 			&app.WebhookSecretHash,
 			&app.PreviousImageID,
-			&app.CPULimit, &app.MemoryLimit,
 			&app.CreatedAt, &app.UpdatedAt,
 		)
 		if scanErr != nil {
--- a/internal/models/models_test.go
+++ b/internal/models/models_test.go
@@ -23,6 +23,7 @@ const (
 	testBranch    = "main"
 	testValue     = "value"
 	testEventType = "push"
+	testUser      = "user"
 )

 func setupTestDB(t *testing.T) (*database.Database, func()) {
@@ -704,6 +705,127 @@ func TestAppGetWebhookEvents(t *testing.T) {
 	assert.Len(t, events, 1)
 }

+// RegistryCredential Tests.
+
+func TestRegistryCredentialCreateAndFind(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	app := createTestApp(t, testDB)
+
+	cred := models.NewRegistryCredential(testDB)
+	cred.AppID = app.ID
+	cred.Registry = "registry.example.com"
+	cred.Username = "myuser"
+	cred.Password = "mypassword"
+
+	err := cred.Save(context.Background())
+	require.NoError(t, err)
+	assert.NotZero(t, cred.ID)
+
+	creds, err := models.FindRegistryCredentialsByAppID(
+		context.Background(), testDB, app.ID,
+	)
+	require.NoError(t, err)
+	require.Len(t, creds, 1)
+	assert.Equal(t, "registry.example.com", creds[0].Registry)
+	assert.Equal(t, "myuser", creds[0].Username)
+	assert.Equal(t, "mypassword", creds[0].Password)
+}
+
+func TestRegistryCredentialUpdate(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	app := createTestApp(t, testDB)
+
+	cred := models.NewRegistryCredential(testDB)
+	cred.AppID = app.ID
+	cred.Registry = "old.registry.com"
+	cred.Username = "olduser"
+	cred.Password = "oldpass"
+
+	err := cred.Save(context.Background())
+	require.NoError(t, err)
+
+	cred.Registry = "new.registry.com"
+	cred.Username = "newuser"
+	cred.Password = "newpass"
+
+	err = cred.Save(context.Background())
+	require.NoError(t, err)
+
+	found, err := models.FindRegistryCredential(context.Background(), testDB, cred.ID)
+	require.NoError(t, err)
+	require.NotNil(t, found)
+	assert.Equal(t, "new.registry.com", found.Registry)
+	assert.Equal(t, "newuser", found.Username)
+	assert.Equal(t, "newpass", found.Password)
+}
+
+func TestRegistryCredentialDelete(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	app := createTestApp(t, testDB)
+
+	cred := models.NewRegistryCredential(testDB)
+	cred.AppID = app.ID
+	cred.Registry = "delete.registry.com"
+	cred.Username = testUser
+	cred.Password = "pass"
+
+	err := cred.Save(context.Background())
+	require.NoError(t, err)
+
+	err = cred.Delete(context.Background())
+	require.NoError(t, err)
+
+	creds, err := models.FindRegistryCredentialsByAppID(
+		context.Background(), testDB, app.ID,
+	)
+	require.NoError(t, err)
+	assert.Empty(t, creds)
+}
+
+func TestRegistryCredentialFindByIDNotFound(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	found, err := models.FindRegistryCredential(context.Background(), testDB, 99999)
+	require.NoError(t, err)
+	assert.Nil(t, found)
+}
+
+func TestAppGetRegistryCredentials(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	app := createTestApp(t, testDB)
+
+	cred := models.NewRegistryCredential(testDB)
+	cred.AppID = app.ID
+	cred.Registry = "ghcr.io"
+	cred.Username = testUser
+	cred.Password = "token"
+	_ = cred.Save(context.Background())
+
+	creds, err := app.GetRegistryCredentials(context.Background())
+	require.NoError(t, err)
+	assert.Len(t, creds, 1)
+	assert.Equal(t, "ghcr.io", creds[0].Registry)
+}
+
 // Cascade Delete Tests.

 //nolint:funlen // Test function with many assertions - acceptable for integration tests
@@ -749,6 +871,13 @@ func TestCascadeDelete(t *testing.T) {
 		deploy.Status = models.DeploymentStatusSuccess
 		_ = deploy.Save(context.Background())

+		regCred := models.NewRegistryCredential(testDB)
+		regCred.AppID = app.ID
+		regCred.Registry = "registry.example.com"
+		regCred.Username = testUser
+		regCred.Password = "pass"
+		_ = regCred.Save(context.Background())
+
 		// Delete app.
 		err := app.Delete(context.Background())
 		require.NoError(t, err)
@@ -778,96 +907,11 @@ func TestCascadeDelete(t *testing.T) {
 			context.Background(), testDB, app.ID, 10,
 		)
 		assert.Empty(t, deployments)
-	})
-}

-// Resource Limits Tests.
-
-func TestAppResourceLimits(t *testing.T) { //nolint:funlen // integration test with multiple subtests
-	t.Parallel()
-
-	t.Run("saves and loads CPU limit", func(t *testing.T) {
-		t.Parallel()
-
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		app.CPULimit = sql.NullFloat64{Float64: 0.5, Valid: true}
-
-		err := app.Save(context.Background())
-		require.NoError(t, err)
-
-		found, err := models.FindApp(context.Background(), testDB, app.ID)
-		require.NoError(t, err)
-		require.NotNil(t, found)
-		assert.True(t, found.CPULimit.Valid)
-		assert.InDelta(t, 0.5, found.CPULimit.Float64, 0.001)
-	})
-
-	t.Run("saves and loads memory limit", func(t *testing.T) {
-		t.Parallel()
-
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		app.MemoryLimit = sql.NullInt64{Int64: 536870912, Valid: true} // 512m
-
-		err := app.Save(context.Background())
-		require.NoError(t, err)
-
-		found, err := models.FindApp(context.Background(), testDB, app.ID)
-		require.NoError(t, err)
-		require.NotNil(t, found)
-		assert.True(t, found.MemoryLimit.Valid)
-		assert.Equal(t, int64(536870912), found.MemoryLimit.Int64)
-	})
-
-	t.Run("null limits by default", func(t *testing.T) {
-		t.Parallel()
-
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		found, err := models.FindApp(context.Background(), testDB, app.ID)
-		require.NoError(t, err)
-		require.NotNil(t, found)
-		assert.False(t, found.CPULimit.Valid)
-		assert.False(t, found.MemoryLimit.Valid)
-	})
-
-	t.Run("clears limits when set to null", func(t *testing.T) {
-		t.Parallel()
-
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		// Set limits
-		app.CPULimit = sql.NullFloat64{Float64: 1.0, Valid: true}
-		app.MemoryLimit = sql.NullInt64{Int64: 1073741824, Valid: true} // 1g
-
-		err := app.Save(context.Background())
-		require.NoError(t, err)
-
-		// Clear limits
-		app.CPULimit = sql.NullFloat64{}
-		app.MemoryLimit = sql.NullInt64{}
-
-		err = app.Save(context.Background())
-		require.NoError(t, err)
-
-		found, err := models.FindApp(context.Background(), testDB, app.ID)
-		require.NoError(t, err)
-		require.NotNil(t, found)
-		assert.False(t, found.CPULimit.Valid)
-		assert.False(t, found.MemoryLimit.Valid)
+		regCreds, _ := models.FindRegistryCredentialsByAppID(
+			context.Background(), testDB, app.ID,
+		)
+		assert.Empty(t, regCreds)
 	})
 }

--- a/internal/models/registry_credential.go
+++ b/internal/models/registry_credential.go
@@ -0,0 +1,130 @@
+package models
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"sneak.berlin/go/upaas/internal/database"
+)
+
+// RegistryCredential represents authentication credentials for a private Docker registry.
+type RegistryCredential struct {
+	db *database.Database
+
+	ID       int64
+	AppID    string
+	Registry string
+	Username string
+	Password string //nolint:gosec // credential field required for registry auth
+}
+
+// NewRegistryCredential creates a new RegistryCredential with a database reference.
+func NewRegistryCredential(db *database.Database) *RegistryCredential {
+	return &RegistryCredential{db: db}
+}
+
+// Save inserts or updates the registry credential in the database.
+func (r *RegistryCredential) Save(ctx context.Context) error {
+	if r.ID == 0 {
+		return r.insert(ctx)
+	}
+
+	return r.update(ctx)
+}
+
+// Delete removes the registry credential from the database.
+func (r *RegistryCredential) Delete(ctx context.Context) error {
+	_, err := r.db.Exec(ctx, "DELETE FROM registry_credentials WHERE id = ?", r.ID)
+
+	return err
+}
+
+func (r *RegistryCredential) insert(ctx context.Context) error {
+	query := "INSERT INTO registry_credentials (app_id, registry, username, password) VALUES (?, ?, ?, ?)"
+
+	result, err := r.db.Exec(ctx, query, r.AppID, r.Registry, r.Username, r.Password)
+	if err != nil {
+		return err
+	}
+
+	id, err := result.LastInsertId()
+	if err != nil {
+		return err
+	}
+
+	r.ID = id
+
+	return nil
+}
+
+func (r *RegistryCredential) update(ctx context.Context) error {
+	query := "UPDATE registry_credentials SET registry = ?, username = ?, password = ? WHERE id = ?"
+
+	_, err := r.db.Exec(ctx, query, r.Registry, r.Username, r.Password, r.ID)
+
+	return err
+}
+
+// FindRegistryCredential finds a registry credential by ID.
+//
+//nolint:nilnil // returning nil,nil is idiomatic for "not found" in Active Record
+func FindRegistryCredential(
+	ctx context.Context,
+	db *database.Database,
+	id int64,
+) (*RegistryCredential, error) {
+	cred := NewRegistryCredential(db)
+
+	row := db.QueryRow(ctx,
+		"SELECT id, app_id, registry, username, password FROM registry_credentials WHERE id = ?",
+		id,
+	)
+
+	err := row.Scan(&cred.ID, &cred.AppID, &cred.Registry, &cred.Username, &cred.Password)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("scanning registry credential: %w", err)
+	}
+
+	return cred, nil
+}
+
+// FindRegistryCredentialsByAppID finds all registry credentials for an app.
+func FindRegistryCredentialsByAppID(
+	ctx context.Context,
+	db *database.Database,
+	appID string,
+) ([]*RegistryCredential, error) {
+	query := `
+		SELECT id, app_id, registry, username, password FROM registry_credentials
+		WHERE app_id = ? ORDER BY registry`
+
+	rows, err := db.Query(ctx, query, appID)
+	if err != nil {
+		return nil, fmt.Errorf("querying registry credentials by app: %w", err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var creds []*RegistryCredential
+
+	for rows.Next() {
+		cred := NewRegistryCredential(db)
+
+		scanErr := rows.Scan(
+			&cred.ID, &cred.AppID, &cred.Registry, &cred.Username, &cred.Password,
+		)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+
+		creds = append(creds, cred)
+	}
+
+	return creds, rows.Err()
+}
--- a/internal/server/routes.go
+++ b/internal/server/routes.go
@@ -98,6 +98,11 @@ func (s *Server) SetupRoutes() {
 			// Ports
 			r.Post("/apps/{id}/ports", s.handlers.HandlePortAdd())
 			r.Post("/apps/{id}/ports/{portID}/delete", s.handlers.HandlePortDelete())
+
+			// Registry Credentials
+			r.Post("/apps/{id}/registry-credentials", s.handlers.HandleRegistryCredentialAdd())
+			r.Post("/apps/{id}/registry-credentials/{credID}/edit", s.handlers.HandleRegistryCredentialEdit())
+			r.Post("/apps/{id}/registry-credentials/{credID}/delete", s.handlers.HandleRegistryCredentialDelete())
 		})
 	})

--- a/internal/service/deploy/deploy.go
+++ b/internal/service/deploy/deploy.go
@@ -830,6 +830,13 @@ func (svc *Service) buildImage(
 	logWriter := newDeploymentLogWriter(ctx, deployment)
 	defer logWriter.Close()

+	// Fetch registry credentials for private base images
+	registryAuths, err := svc.buildRegistryAuths(ctx, app)
+	if err != nil {
+		svc.log.Warn("failed to fetch registry credentials", "error", err, "app", app.Name)
+		// Continue without auth — public images will still work
+	}
+
 	// BuildImage creates a tar archive from the local filesystem,
 	// so it needs the container path where files exist, not the host path.
 	imageID, err := svc.docker.BuildImage(ctx, docker.BuildImageOptions{
@@ -837,6 +844,7 @@ func (svc *Service) buildImage(
 		DockerfilePath: app.DockerfilePath,
 		Tags:           []string{imageTag},
 		LogWriter:      logWriter,
+		RegistryAuths:  registryAuths,
 	})
 	if err != nil {
 		svc.notify.NotifyBuildFailed(ctx, app, deployment, err)
@@ -1094,18 +1102,6 @@ func (svc *Service) buildContainerOptions(
 		network = app.DockerNetwork.String
 	}

-	var cpuLimit float64
-
-	if app.CPULimit.Valid {
-		cpuLimit = app.CPULimit.Float64
-	}
-
-	var memoryLimit int64
-
-	if app.MemoryLimit.Valid {
-		memoryLimit = app.MemoryLimit.Int64
-	}
-
 	return docker.CreateContainerOptions{
 		Name:    "upaas-" + app.Name,
 		Image:   imageID.String(),
@@ -1114,8 +1110,6 @@ func (svc *Service) buildContainerOptions(
 		Volumes: buildVolumeMounts(volumes),
 		Ports:   buildPortMappings(ports),
 		Network: network,
-		CPULimit:    cpuLimit,
-		MemoryLimit: memoryLimit,
 	}, nil
 }

@@ -1241,6 +1235,34 @@ func (svc *Service) failDeployment(
 	_ = app.Save(ctx)
 }

+// buildRegistryAuths fetches registry credentials for an app and converts them
+// to Docker RegistryAuth objects for use during image builds.
+func (svc *Service) buildRegistryAuths(
+	ctx context.Context,
+	app *models.App,
+) ([]docker.RegistryAuth, error) {
+	creds, err := app.GetRegistryCredentials(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get registry credentials: %w", err)
+	}
+
+	if len(creds) == 0 {
+		return nil, nil
+	}
+
+	auths := make([]docker.RegistryAuth, 0, len(creds))
+
+	for _, cred := range creds {
+		auths = append(auths, docker.RegistryAuth{
+			Registry: cred.Registry,
+			Username: cred.Username,
+			Password: cred.Password,
+		})
+	}
+
+	return auths, nil
+}
+
 // writeLogsToFile writes the deployment logs to a file on disk.
 // Structure: DataDir/logs/<hostname>/<appname>/<appname>_<sha>_<timestamp>.log.txt
 func (svc *Service) writeLogsToFile(app *models.App, deployment *models.Deployment) {
--- a/internal/service/deploy/deploy_container_test.go
+++ b/internal/service/deploy/deploy_container_test.go
@@ -2,7 +2,6 @@ package deploy_test

 import (
 	"context"
-	"database/sql"
 	"log/slog"
 	"os"
 	"testing"
@@ -44,93 +43,3 @@ func TestBuildContainerOptionsUsesImageID(t *testing.T) {
 		t.Errorf("expected Name=%q, got %q", "upaas-myapp", opts.Name)
 	}
 }
-
-func TestBuildContainerOptionsNoResourceLimits(t *testing.T) {
-	t.Parallel()
-
-	db := database.NewTestDatabase(t)
-
-	app := models.NewApp(db)
-	app.Name = "nolimits"
-
-	err := app.Save(context.Background())
-	if err != nil {
-		t.Fatalf("failed to save app: %v", err)
-	}
-
-	log := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	svc := deploy.NewTestService(log)
-
-	opts, err := svc.BuildContainerOptionsExported(
-		context.Background(), app, docker.ImageID("test:latest"),
-	)
-	if err != nil {
-		t.Fatalf("buildContainerOptions returned error: %v", err)
-	}
-
-	if opts.CPULimit != 0 {
-		t.Errorf("expected CPULimit=0, got %v", opts.CPULimit)
-	}
-
-	if opts.MemoryLimit != 0 {
-		t.Errorf("expected MemoryLimit=0, got %v", opts.MemoryLimit)
-	}
-}
-
-func TestBuildContainerOptionsCPULimit(t *testing.T) {
-	t.Parallel()
-
-	db := database.NewTestDatabase(t)
-
-	app := models.NewApp(db)
-	app.Name = "cpulimit"
-	app.CPULimit = sql.NullFloat64{Float64: 0.5, Valid: true}
-
-	err := app.Save(context.Background())
-	if err != nil {
-		t.Fatalf("failed to save app: %v", err)
-	}
-
-	log := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	svc := deploy.NewTestService(log)
-
-	opts, err := svc.BuildContainerOptionsExported(
-		context.Background(), app, docker.ImageID("test:latest"),
-	)
-	if err != nil {
-		t.Fatalf("buildContainerOptions returned error: %v", err)
-	}
-
-	if opts.CPULimit != 0.5 {
-		t.Errorf("expected CPULimit=0.5, got %v", opts.CPULimit)
-	}
-}
-
-func TestBuildContainerOptionsMemoryLimit(t *testing.T) {
-	t.Parallel()
-
-	db := database.NewTestDatabase(t)
-
-	app := models.NewApp(db)
-	app.Name = "memlimit"
-	app.MemoryLimit = sql.NullInt64{Int64: 536870912, Valid: true} // 512m
-
-	err := app.Save(context.Background())
-	if err != nil {
-		t.Fatalf("failed to save app: %v", err)
-	}
-
-	log := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	svc := deploy.NewTestService(log)
-
-	opts, err := svc.BuildContainerOptionsExported(
-		context.Background(), app, docker.ImageID("test:latest"),
-	)
-	if err != nil {
-		t.Fatalf("buildContainerOptions returned error: %v", err)
-	}
-
-	if opts.MemoryLimit != 536870912 {
-		t.Errorf("expected MemoryLimit=536870912, got %v", opts.MemoryLimit)
-	}
-}
--- a/templates/app_detail.html
+++ b/templates/app_detail.html
@@ -154,6 +154,69 @@
        <div class="hidden">{{ .CSRFField }}</div>
    </div>

+    <!-- Registry Credentials -->
+    <div class="card p-6 mb-6">
+        <h2 class="section-title mb-4">Registry Credentials</h2>
+        <p class="text-sm text-gray-500 mb-3">Authenticate to private Docker registries when pulling base images during builds.</p>
+        {{if .RegistryCredentials}}
+        <div class="overflow-x-auto mb-4">
+            <table class="table">
+                <thead class="table-header">
+                    <tr>
+                        <th>Registry</th>
+                        <th>Username</th>
+                        <th>Password</th>
+                        <th class="text-right">Actions</th>
+                    </tr>
+                </thead>
+                <tbody class="table-body">
+                    {{range .RegistryCredentials}}
+                    <tr x-data="{ editing: false }">
+                        <template x-if="!editing">
+                            <td class="font-mono">{{.Registry}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="font-mono">{{.Username}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="font-mono text-gray-400">••••••••</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="text-right">
+                                <button @click="editing = true" class="text-primary-600 hover:text-primary-800 text-sm mr-2">Edit</button>
+                                <form method="POST" action="/apps/{{$.App.ID}}/registry-credentials/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this registry credential?')" @submit="confirm($event)">
+                                    {{ $.CSRFField }}
+                                    <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
+                                </form>
+                            </td>
+                        </template>
+                        <template x-if="editing">
+                            <td colspan="4">
+                                <form method="POST" action="/apps/{{$.App.ID}}/registry-credentials/{{.ID}}/edit" class="flex gap-2 items-center">
+                                    {{ $.CSRFField }}
+                                    <input type="text" name="registry" value="{{.Registry}}" required class="input flex-1 font-mono text-sm" placeholder="registry.example.com">
+                                    <input type="text" name="username" value="{{.Username}}" required class="input flex-1 font-mono text-sm" placeholder="username">
+                                    <input type="password" name="password" required class="input flex-1 font-mono text-sm" placeholder="password">
+                                    <button type="submit" class="btn-primary text-sm">Save</button>
+                                    <button type="button" @click="editing = false" class="text-gray-500 hover:text-gray-700 text-sm">Cancel</button>
+                                </form>
+                            </td>
+                        </template>
+                    </tr>
+                    {{end}}
+                </tbody>
+            </table>
+        </div>
+        {{end}}
+        <form method="POST" action="/apps/{{.App.ID}}/registry-credentials" class="flex flex-col sm:flex-row gap-2">
+            {{ .CSRFField }}
+            <input type="text" name="registry" placeholder="registry.example.com" required class="input flex-1 font-mono text-sm">
+            <input type="text" name="username" placeholder="username" required class="input flex-1 font-mono text-sm">
+            <input type="password" name="password" placeholder="password" required class="input flex-1 font-mono text-sm">
+            <button type="submit" class="btn-primary">Add</button>
+        </form>
+    </div>
+
    <!-- Labels -->
    <div class="card p-6 mb-6">
        <h2 class="section-title mb-4">Docker Labels</h2>
--- a/templates/app_edit.html
+++ b/templates/app_edit.html
@@ -114,38 +114,6 @@
                >
            </div>

-            <hr class="border-gray-200">
-
-            <h3 class="text-lg font-medium text-gray-900">Resource Limits</h3>
-
-            <div class="grid grid-cols-2 gap-4">
-                <div class="form-group">
-                    <label for="cpu_limit" class="label">CPU Limit (cores)</label>
-                    <input
-                        type="text"
-                        id="cpu_limit"
-                        name="cpu_limit"
-                        value="{{if .App.CPULimit.Valid}}{{.App.CPULimit.Float64}}{{end}}"
-                        class="input"
-                        placeholder="e.g. 0.5, 1, 2"
-                    >
-                    <p class="text-sm text-gray-500 mt-1">Number of CPU cores (e.g. 0.5 = half a core)</p>
-                </div>
-
-                <div class="form-group">
-                    <label for="memory_limit" class="label">Memory Limit</label>
-                    <input
-                        type="text"
-                        id="memory_limit"
-                        name="memory_limit"
-                        value="{{if .App.MemoryLimit.Valid}}{{formatMemoryBytes .App.MemoryLimit.Int64}}{{end}}"
-                        class="input"
-                        placeholder="e.g. 256m, 1g"
-                    >
-                    <p class="text-sm text-gray-500 mt-1">Memory with unit suffix (k, m, g) or plain bytes</p>
-                </div>
-            </div>
-
            <div class="flex justify-end gap-3 pt-4">
                <a href="/apps/{{.App.ID}}" class="btn-secondary">Cancel</a>
                <button type="submit" class="btn-primary">Save Changes</button>
--- a/templates/templates.go
+++ b/templates/templates.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"html/template"
 	"io"
-	"strconv"
 	"sync"
 )

@@ -24,34 +23,6 @@ var (
 	templatesMutex sync.RWMutex
 )

-// templateFuncs returns the custom template function map.
-func templateFuncs() template.FuncMap {
-	return template.FuncMap{
-		"formatMemoryBytes": formatMemoryBytes,
-	}
-}
-
-// Memory unit constants.
-const (
-	memGigabyte = 1024 * 1024 * 1024
-	memMegabyte = 1024 * 1024
-	memKilobyte = 1024
-)
-
-// formatMemoryBytes formats bytes into a human-readable string with unit suffix.
-func formatMemoryBytes(bytes int64) string {
-	switch {
-	case bytes >= memGigabyte && bytes%memGigabyte == 0:
-		return strconv.FormatInt(bytes/memGigabyte, 10) + "g"
-	case bytes >= memMegabyte && bytes%memMegabyte == 0:
-		return strconv.FormatInt(bytes/memMegabyte, 10) + "m"
-	case bytes >= memKilobyte && bytes%memKilobyte == 0:
-		return strconv.FormatInt(bytes/memKilobyte, 10) + "k"
-	default:
-		return strconv.FormatInt(bytes, 10)
-	}
-}
-
 // initTemplates parses base template and creates cloned templates for each page.
 func initTemplates() {
 	templatesMutex.Lock()
@@ -61,10 +32,8 @@ func initTemplates() {
 		return
 	}

-	// Parse base template with shared components and custom functions
-	baseTemplate = template.Must(
-		template.New("base.html").Funcs(templateFuncs()).ParseFS(templatesRaw, "base.html"),
-	)
+	// Parse base template with shared components
+	baseTemplate = template.Must(template.ParseFS(templatesRaw, "base.html"))

 	// Pages that extend base
 	pages := []string{
--- a/templates/templates_test.go
+++ b/templates/templates_test.go
@@ -1,34 +0,0 @@
-package templates //nolint:testpackage // tests unexported formatMemoryBytes
-
-import (
-	"testing"
-)
-
-func TestFormatMemoryBytes(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		bytes    int64
-		expected string
-	}{
-		{"gigabytes", 1024 * 1024 * 1024, "1g"},
-		{"two gigabytes", 2 * 1024 * 1024 * 1024, "2g"},
-		{"megabytes", 256 * 1024 * 1024, "256m"},
-		{"kilobytes", 512 * 1024, "512k"},
-		{"plain bytes", 12345, "12345"},
-		{"non-even megabytes", 256*1024*1024 + 1, "268435457"},
-		{"zero", 0, "0"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := formatMemoryBytes(tt.bytes)
-			if got != tt.expected {
-				t.Errorf("formatMemoryBytes(%d) = %q, want %q", tt.bytes, got, tt.expected)
-			}
-		})
-	}
-}