Hi Railway team,

I'm on the Pro plan and trying to deploy a service from my self-hosted Zot registry (OCI Distribution Spec compliant, standard Basic auth). Your docs state that "any registry that supports standard Docker authentication works with Railway", but I'm hitting a blocker.

What's happening

When I enter my image path in Service → Source, I immediately get "Invalid" — before I have any opportunity to add registry credentials. The credentials field doesn't appear to be accessible until the source is validated, which creates a chicken-and-egg situation for private registries.

Image path:registry.quarzo-life.com/quarzo-life/modular-monolith:staging

What I've verified

The registry works correctly from my local machine and from external networks:

• curl -i https://registry.quarzo-life.com/v2/ returns 401 Unauthorized with Www-Authenticate: Basic realm="zot" (correct OCI behavior)
• curl -u railway:*** https://registry.quarzo-life.com/v2/_catalog returns the repository list
• curl -u railway:*** https://registry.quarzo-life.com/v2/quarzo-life/modular-monolith/tags/list lists the staging tag
• curl -u railway:*** https://registry.quarzo-life.com/v2/quarzo-life/modular-monolith/manifests/staging returns 200 OK with a valid OCI manifest
• docker login and docker pull both work from external machines (not just my server)
• Valid TLS certificate (no self-signed issue)

My questions

1. Is there a way to enter registry credentials before the source is validated, or via the CLI / GraphQL API?
2. Does Railway's source validator support arbitrary registry domains, or is there an implicit allowlist beyond Docker Hub / GHCR / GitLab / Quay / ECR / GAR?
3. Is there any known incompatibility with Zot or OCI-only registries?
4. Would a multi-arch index containing a vnd.docker.reference.type: attestation-manifest entry (from buildx provenance) cause the validator to reject the image?

Happy to share project ID, full curl traces, or grant you access to test if helpful.

Thanks!