> This page is for AI Cluster Runtime, version Latest · v1.0.0 (default).
> For other versions, use one of these documentation indexes:
> - Latest · v1.0.0 (default): https://docs.nvidia.com/aicr/latest/llms.txt
> - v1.0.0: https://docs.nvidia.com/aicr/v1.0.0/llms.txt
> - v0.22.0: https://docs.nvidia.com/aicr/v0.22.0/llms.txt
> - v0.21.1: https://docs.nvidia.com/aicr/v0.21.1/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/aicr/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/aicr/_mcp/server.

# AICR build/CI registry egress

> Generated by `tools/registry-inventory` — do not edit by hand. Run `make registry-docs` to regenerate.

Every package/container registry AICR's builds and CI reach out to, extracted from the
structured build/CI sources (recipes/registry.yaml, .settings.yaml, .goreleaser.yaml /
.ko.yaml, Dockerfiles, .github Actions, tools/setup-tools). This host-level summary is
the browsable companion to the CODEOWNER-gated allowlist that gates these hosts in CI
(tools/registry-inventory/registry-allowlist.yaml). Transitive chart-rendered image
pulls are inventoried separately in the BOM (docs/user/container-images.md); the full
per-record inventory (image refs, pins, provenance) is produced by `make registry-inventory`.

## Distinct hosts (27)

| Host | Package types | Directions |
|---|---|---|
| `apt` | apt | pull |
| `aws.github.io` | helm-chart-http | pull |
| `charts.jetstack.io` | helm-chart-http | pull |
| `cr.agentgateway.dev` | oci-helm-chart | pull |
| `dl.k8s.io` | binary-release | pull |
| `docker.gitea.com` | container-image | pull |
| `docker.io` | container-image | pull |
| `dsx-ai-factory.github.io` | helm-chart-http | pull |
| `ecr-public.aws.com` | container-image | pull |
| `get.helm.sh` | binary-release | pull |
| `ghcr.io` | container-image, oci-helm-chart | pull, push |
| `github-actions` | github-action | pull |
| `github.com` | binary-release | pull |
| `helm.ngc.nvidia.com` | helm-chart-http | pull |
| `homebrew` | brew | pull |
| `jmcgrath207.github.io` | helm-chart-http | pull |
| `kind.sigs.k8s.io` | binary-release | pull |
| `kubernetes-sigs.github.io` | helm-chart-http | pull |
| `nvcr.io` | container-image | pull |
| `open-policy-agent.github.io` | helm-chart-http | pull |
| `prometheus-community.github.io` | helm-chart-http | pull |
| `proxy.golang.org` | go-module | pull |
| `public.ecr.aws` | container-image | pull |
| `pypi.org` | pypi | pull |
| `raw.githubusercontent.com` | install-script | pull |
| `registry.k8s.io` | oci-helm-chart | pull |
| `sum.golang.org` | go-module | pull |

## Not statically gated

These egress surfaces are known but not host-gated — the inventory is a floor, not a ceiling:

- tests/uat/lib/phases.sh (helm-diff plugin + workload images assembled from shell vars)
- kwok/scripts/*.sh (in-cluster registry/gitea/karpenter side-loads)
- pkg/**/*.go Sigstore endpoint constants (fulcio/rekor/tuf/oidc) — see pkg/defaults/sigstore.go
- GitHub workflow inline `image:` and docker/login-action registry inputs
- GitHub workflow and composite-action inline `run:` bodies — the .github pass mines `uses:` refs only, so an installer invoked from a `run:` step (e.g. the `go install` of go-coverage-report in on-push-comment.yaml) reaches hosts this inventory does not record
- tools/setup-tools: best-effort only — URLs built from shell vars are reported as warnings, not records
- GitHub Actions per-OWNER trust: all `uses:` collapse to host `github-actions`, so a new third-party action owner is not gated (only SHA-pinning is enforced, by TestExternalActionsArePinned)