PodTemplate.containerRegistryAuthId is required for private images and is documented nowhere

[kbennett2000]

Versions: runpod-flash 1.19.0, runpod 1.12.0, runpodctl 2.9.0-c094cac, Python 3.13.

The gap. docs.runpod.io/flash/custom-docker-images tells the reader to "configure Docker registry authentication in Runpod console for private images", but never states how a Flash endpoint then references the resulting credential. The PodTemplate example on that page shows only containerDiskInGb.

Without the field, a private image simply fails to pull, and the deploy path gives no indication that a credential reference was the missing piece.

The mechanism. It is PodTemplate(containerRegistryAuthId="<id>"):

Endpoint(
    name="scriptorium-imagegen",
    image="ghcr.io/<owner>/<private-image>:<tag>",
    gpu=GpuType.NVIDIA_GEFORCE_RTX_4090,
    template=PodTemplate(
        containerDiskInGb=64,
        containerRegistryAuthId="<id from runpodctl registry list>",
    ),
)

The field exists in the SDK at runpod_flash/core/resources/template.py and is threaded into the deploy manifest at cli/commands/build_utils/manifest.py. It was found by reading the SDK source, because it is not in the documentation and not in the PodTemplate reference in the published flash agent skill, which documents four fields — containerDiskInGb, dockerArgs, ports, startScript — and not this one.

Confirmed working. Two endpoints have now pulled a private GHCR image using it, with a token scoped read:packages only. The field is correct and sufficient; it is only undocumented.

Suggestion. Add containerRegistryAuthId to the PodTemplate reference, and show it in the private-image section of flash/custom-docker-images alongside how to obtain the id — runpodctl registry list, or the console page that creates the credential.