diff --git a/opsroot.json b/opsroot.json
index 97bf9be8..f7ea2169 100644
--- a/opsroot.json
+++ b/opsroot.json
@@ -9,7 +9,7 @@
          "controller": "ghcr.io/nuvolaris/openwhisk-controller:3.1.0-mastrogpt.2402101445",
          "invoker": "ghcr.io/nuvolaris/openwhisk-invoker:3.1.0-mastrogpt.2402101445",
          "streamer": "registry.hub.docker.com/apache/openserverless-streamer:0.1.0-incubating.2505031325",
-         "systemapi": "registry.hub.docker.com/apache/openserverless-admin-api:0.1.0-incubating.2508161629"
+         "systemapi": "registry.hub.docker.com/apache/openserverless-admin-api:0.1.0-incubating.2509280912"
         }
     }
 }
diff --git a/setup/docker/kind.yaml b/setup/docker/kind.yaml
index 4102b179..4924a9db 100644
--- a/setup/docker/kind.yaml
+++ b/setup/docker/kind.yaml
@@ -17,6 +17,17 @@
 
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
+containerdConfigPatches:
+- |-
+  [plugins."io.containerd.grpc.v1.cri".registry]
+    [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
+      [plugins."io.containerd.grpc.v1.cri".registry.mirrors."127.0.0.1:32000"]
+        endpoint = ["http://127.0.0.1:32000"]
+
+    [plugins."io.containerd.grpc.v1.cri".registry.configs]
+      [plugins."io.containerd.grpc.v1.cri".registry.configs."127.0.0.1:32000".tls]
+        insecure_skip_verify = true
+         
 nodes:
 - role: control-plane
   kubeadmConfigPatches:
@@ -99,4 +110,4 @@ nodes:
     protocol: TCP 
   - containerPort: 32531
     hostPort: 9091
-    protocol: TCP                    
+    protocol: TCP           
diff --git a/setup/nuvolaris/system-api/deploy/buildkit/buildkitd.toml b/setup/nuvolaris/system-api/deploy/buildkit/buildkitd.toml
new file mode 100644
index 00000000..37460c45
--- /dev/null
+++ b/setup/nuvolaris/system-api/deploy/buildkit/buildkitd.toml
@@ -0,0 +1,41 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+# =========================
+# Worker OCI (rootlesskit)
+# =========================
+[worker.oci]
+  enabled = true
+  rootless = true
+  no-process-sandbox = true
+  snapshotter = "overlayfs"   # usa overlayfs se il kernel lo consente
+
+[worker.containerd]
+  enabled = false
+
+# =========================
+# Registry HTTP insicuro
+# =========================
+[registry."nuvolaris-registry-svc:5000"]
+  #insecure = true
+  http = true
+
+# =========================
+# Logging
+# =========================
+[log]
+  level = "trace"
\ No newline at end of file
diff --git a/setup/nuvolaris/system-api/opsfile.yml b/setup/nuvolaris/system-api/opsfile.yml
index 79a27680..d3c00548 100644
--- a/setup/nuvolaris/system-api/opsfile.yml
+++ b/setup/nuvolaris/system-api/opsfile.yml
@@ -46,8 +46,46 @@ env:
 
   INGRESS_TYPE:
     sh: $OPS util ingress-type
+  
+  REGISTRY_PASS:
+    sh: $OPS debug kube ctl CMD="-n nuvolaris get cm/config  -o jsonpath='{.metadata.annotations.registry_password}'"
 
 tasks:
+  install-toml:
+    desc: Update the buildkitd.toml file config map
+    silent: true
+    cmds:
+      - task: remove-toml
+      - $OPS debug kube ctl CMD="-n nuvolaris create configmap nuvolaris-buildkitd-conf --from-file=$OPS_PWD/setup/nuvolaris/system-api/deploy/buildkit/buildkitd.toml"
+  
+  remove-toml:
+    desc: Remove the buildkitd.toml config map
+    silent: true
+    cmds:
+      - |
+        if $OPS debug kube ctl CMD="-n nuvolaris get cm nuvolaris-buildkitd-conf" >/dev/null 2>&1;
+          then $OPS debug kube ctl CMD="-n nuvolaris delete configmap nuvolaris-buildkitd-conf"
+        fi
+  
+  install-secret:
+    desc: Create secret to push to internal registry
+    silent: true
+    cmds:
+      - task: remove-secret
+      - |
+        if ! $OPS debug kube ctl CMD="-n nuvolaris get secret registry-pull-secret-int" >/dev/null 2>&1;
+        then $OPS debug kube ctl CMD="create secret docker-registry registry-pull-secret-int --docker-server=http://nuvolaris-registry-svc:5000 --docker-username=opsuser --docker-password=${REGISTRY_PASS}"
+        fi
+    
+  remove-secret:
+    desc: Delete secret to push to internal registry
+    silent: true
+    cmds:
+      - |
+        if $OPS debug kube ctl CMD="-n nuvolaris get secret registry-pull-secret-int" >/dev/null 2>&1;
+        then $OPS debug kube ctl CMD="-n nuvolaris delete secret registry-pull-secret-int"
+        fi
+
 
   deploy:
     silent: true
@@ -58,17 +96,21 @@ tasks:
     - test -n "$IMAGES_SYSTEMAPI" || die "IMAGES_SYSTEMAPI is not set. Please set it to the desired image version."
     - envsubst -i api-template.yaml -o _api.yaml > /dev/null 2>&1
     - envsubst -i ${INGRESS_TYPE}-template.yaml -o _ingress.yaml > /dev/null 2>&1
-    - $OPS debug kube ctl CMD="-n nuvolaris apply -f $OPS_PWD/setup/nuvolaris/system-api/_api.yaml"
+    - $OPS debug kube ctl CMD="-n nuvolaris apply -f $OPS_ROOT/setup/nuvolaris/system-api/_api.yaml"
     #- cat _ingress.yaml
-    - $OPS debug kube ctl CMD="-n nuvolaris apply -f $OPS_PWD/setup/nuvolaris/system-api/_ingress.yaml"
+    - $OPS debug kube ctl CMD="-n nuvolaris apply -f $OPS_ROOT/setup/nuvolaris/system-api/_ingress.yaml"
+    - task: install-toml
+    - task: install-secret
     - |
       echo "Admin API deployed with HOSTNAME: ${SYS_API_HOSTNAME}/system"
   
   undeploy:
     silent: true
     desc: undeploy the admin api
-    ignore_error: true
+    ignore_error: false
     cmds:
+    - task: remove-secret
+    - task: remove-toml
     - $OPS debug kube ctl CMD="-n nuvolaris delete sts/nuvolaris-system-api ing/nuvolaris-system-api-ingress svc/nuvolaris-system-api"
     - |
       echo "System Admin API undeployed"
diff --git a/setup/opsfile.yml b/setup/opsfile.yml
index 44a15122..1033cf1a 100644
--- a/setup/opsfile.yml
+++ b/setup/opsfile.yml
@@ -112,6 +112,7 @@ tasks:
       - ops config apihost miniops.me --protocol=http
       - ops setup devcluster
       - ops setup nuvolaris streamer deploy
+      - ops setup nuvolaris system-api deploy
       - ops setup nuvolaris add-user
 
   devcluster: