> ## Documentation Index
> Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Docker Hub Repositories From AI Agents

> Let agents list and manage Docker Hub repositories, tags, and organizations with a personal access token that the gateway injects and keeps hidden.

## Overview

OneCLI connects AI agents to [Docker Hub](https://hub.docker.com) with your username and a personal access token. Agents can browse and manage repositories, tags, and organizations. The gateway injects the credentials into every request, so your agent never sees them.

Connecting takes about a minute.

## What you will set up

* A Docker Hub personal access token, read-only or read and write
* Automatic credential injection on Docker Hub requests
* Per-agent, per-tool access, with approval for deletes

## Connect Docker Hub

**1. Create a personal access token in Docker**

Open [app.docker.com](https://app.docker.com), then **Account settings** > **Personal access tokens**, and click **Generate new token**. Name it `OneCLI`, choose the **access permissions** (Read-only, or Read & Write if agents should change repositories), and copy the token right away. Tokens start with `dckr_pat_`.

**2. Enter it in OneCLI**

In the OneCLI dashboard, open **Connections** > **Docker Hub**, enter your **Username** and the **Personal Access Token**, and click **Connect Docker Hub**.

![OneCLI connect window for Docker Hub, showing the setup guide link, the Username and Personal Access Token fields, and the Connect Docker Hub button.](https://mintcdn.com/chartdbinc/L4k9tYUENUtEpMY8/images/integrations/docker/onecli-connect-docker.png?fit=max\&auto=format\&n=L4k9tYUENUtEpMY8\&q=85\&s=f2169e73a1c1be542372964ef4c873a3)

The Docker Hub connect window in OneCLI.

OneCLI signs in to Docker Hub when you connect and rejects wrong credentials right away.

## What agents can do

| Area | What agents can do |
| - | - |
| **Repositories** | List and read repositories. Create, update, and delete repositories |
| **Tags** | List tags and delete a tag |
| **Account** | Read your user, namespaces, and organizations |

## Controlling access

[Grant](https://onecli.sh/docs/guides/agent-access.md) the connection to each agent that needs it, and choose per tool what runs freely, what needs approval, and what's blocked. **Delete repository** and **Delete tag** can't be undone, so put them behind approval. Organization [rules](https://onecli.sh/docs/guides/rules.md) add guardrails on top. A blocked request never reaches Docker Hub.

To disconnect, remove the connection in **Connections** > **Docker Hub**, then delete the token in Docker under **Personal access tokens**.

## FAQ

> [accordion] How do I rotate my Docker Hub token?
>
> Generate a new personal access token in Docker, then update it in **Connections** > **Docker Hub**. Agents pick up the new token automatically. Then delete the old token.

> [accordion] How do I keep the token out of the agent's context?
>
> Store it in OneCLI instead of running `docker login` in the agent's environment. The gateway injects it at the proxy. See [How it works](https://onecli.sh/docs/how-it-works.md).

> [accordion] Can I stop an agent from deleting repositories?
>
> Yes. Use a **Read-only** token, or put **Delete repository** and **Delete tag** behind approval when you [grant](https://onecli.sh/docs/guides/agent-access.md) the connection.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.