Feat/registries auth implementation

Cargo.toml

@@ -41,6 +41,7 @@ futures = "0.3"
 getset = "0.1"
 hex = "0.4"
 indicatif = "0.18"
+keyring = "3.6"
 intaglio = "1.10"
 ipnetwork = { version = "0.21.0", features = ["serde"] }
 jsonwebtoken = "9.3"
@@ -87,6 +88,7 @@ tracing = "0.1"
 tracing-subscriber = "0.3"
 typed-builder = "0.23"
 typed-path = "0.12"
+url = "2.5"
 uuid = { version = "1.11", features = ["v4"] }
 uzers = "0.12"
 walkdir = "2.4"

docs/references/cli.md

@@ -646,6 +646,15 @@ msb pull [--image] [--image-group] <name> [options]
 **Examples:**
 
 ```bash
+# Pull a private image using env credentials (token)
+export MSB_REGISTRY_TOKEN=token123
+msb pull registry.example.com/org/app:1.0
+
+# Pull a private image using env credentials (username/password)
+export MSB_REGISTRY_USERNAME=user
+export MSB_REGISTRY_PASSWORD=pass
+msb pull registry.example.com/org/app:1.0
+
 # Pull an image
 msb pull --image python:3.11
 
@@ -686,6 +695,67 @@ msb push myapp:latest
 
 ===
 
+==- `msb login`
+Set registry credentials (persisted in microsandbox home).
+
+```bash
+msb login [registry] [--username <user>] [--password-stdin] [--token <token>]
+```
+
+| Option            | Description                        |
+| ----------------- | ---------------------------------- |
+| `--username`      | Registry username                  |
+| `--password-stdin`| Read password from stdin           |
+| `--token`         | Registry access token (bearer)     |
+
+**Examples:**
+
+```bash
+# Provide a token
+msb login ghcr.io --token token123
+
+# Provide username and password via stdin
+echo "pass" | msb login docker.io --username user --password-stdin
+
+# Use env fallback if CLI is invalid
+export MSB_REGISTRY_TOKEN=token123
+msb login ghcr.io --username user --password-stdin
+```
+
+!!!note
+`msb login` stores credentials locally but does not validate them against the registry.
+When pulling images, environment variables take priority over stored credentials.
+!!!
+
+!!!warning Security
+Credentials are stored in `~/.microsandbox/registry_auth.json`. Restrict file permissions and avoid sharing it.
+!!!
+
+===
+
+==- `msb logout`
+Remove stored registry credentials.
+
+```bash
+msb logout [registry] [--all]
+```
+
+| Option    | Description                              |
+| --------- | ---------------------------------------- |
+| `--all`   | Remove all stored registry credentials   |
+
+**Examples:**
+
+```bash
+# Remove credentials for a registry
+msb logout ghcr.io
+
+# Remove all stored credentials
+msb logout --all
+```
+
+===
+
 ---
 
 ### Maintenance