Capability pods run YOUR image, and nobody publishes their whole stack
publicly — but create_pod never sent a credential, so a private image
would fail to pull and the pod would just never become healthy, with
nothing in the logs pointing at why.

RunPod stores registry credentials for you (Settings -> Container Registry
Credentials) and gives each set an id; that id now rides along as
`containerRegistryAuthId`, from `runpod.registry_auth_id` account-wide or
a pod block's own `registry_auth_id`. Public images (vLLM, llama.cpp) are
unaffected — they send nothing.

docs/remote-execution.md now says where the images come from: LLM pods
need no publishing at all, a capability pod needs a coderai image in a
registry RunPod can reach, and the 26.6 GB flattened image is paid on
every cold pull.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0182DhR1eFNPQyGmDrpHbedY