Getting started

Getting started

• Before you begin

• Install the Container Registry CLI

• Set up a namespace

• Pull images from a registry to your local computer

• Tag the image

• Push images to your namespace

• Verify that the image was pushed

• Set up an audit trail for changes in Container Registry

• Monitor metrics for Container Registry

• Next steps in Container Registry

About Container Registry

About Container Registry

• Service plans

• Quota limits and billing

  • Billing for storage and pull traffic

    • Storage charges

    • Pull traffic charges

  • Quota limits for storage and pull traffic

    • Storage quota limits

    • Pull traffic quota limits

  • Cost of Container Registry

• Upgrading your service plan

• Terms that are used in IBM Cloud Container Registry

  • Container image

  • Digest

  • Dockerfile

  • Docker V2 container images

  • Domain name

  • Image manifest

  • OCI container images

  • Registry

  • Registry namespace

  • Repository

  • Tag

  • Untagged image

• Regions

  • Global registry

    • Targeting the global registry

  • Local regions

    • Targeting a local region

• Supported clients

  • Support for Docker

  • Support for other clients

Architecture and workload

Architecture and workload

• Segmentation of data

• Private connections

Public IBM images

Public IBM images

• Accessing the public IBM images by using the CLI

What are containers?

What are containers?

Notifications

Notifications

• Notifications topics

  • 2024

  • 2023

  • 2022

  • 2017

Firewall changes from 4 September 2024 for users that pull images from global

• What you need to know about this change

• What actions you must take by 4 September 2024

Vulnerability Advisor version 3 is being discontinued on 13 November 2023

• What you need to know about this change

• What actions you must take by 13 November 2023

Upcoming public networking changes from 15 June 2023

Update Vulnerability Advisor to version 4 by 19 June 2023

• What you need to know about this change

• What actions you must take by 19 June 2023

Changes to VPE gateways from 11 November 2022

• What you need to know about this change

• How you benefit from this change

• Understanding if you are impacted by this change

• What actions you must take

Changes to private IP addresses from 15 December 2022

• What you need to know about this change

• What actions you need to take

Container Registry CLI stops returning security status results in lists from version 1.0.0

• What actions you need to take

Private IP addresses changed on 5 July 2022

• What you need to know about this change

• How you benefit from this change

• Understanding if you are impacted by this change

• What actions you need to take

IAM access policies are required from 5 July 2022

• What are the changes?

• Check whether these changes affect you

• Prepare for the changes

• What if I did not implement the changes in time?

Minimum supported Docker version from 1 March 2022

IBM Cloud Container Registry is available

Release notes

Release notes

• 14 February 2025

  • Access IBM Cloud Container Registry by using trusted profiles

• 9 December 2024

  • Content delivery network (CDN) is enabled for users that pull IBM Cloud Container Registry images from global (icr.io) over a public network

• 26 June 2024

  • Firewall changes from 4 September 2024 for users that pull IBM Cloud Container Registry images from global (icr.io)

• 15 March 2024

  • New region in Madrid

• 13 November 2023

  • Discontinuation of Vulnerability Advisor version 3

• 11 October 2023

  • Vulnerability Advisor version 3 is discontinued from 13 November 2023

• 24 July 2023

  • Added the option to output several IBM Cloud Container Registry commands in JSON format

  • The --json option for IBM Cloud Container Registry commands is deprecated

• 19 June 2023

  • Vulnerability Advisor version 3 is deprecated from 19 June 2023

• 19 May 2023

  • Update Vulnerability Advisor to version 4 by 19 June 2023

• 26 April 2023

  • Using Portieris to block the deployment of images with issues is deprecated.

• 11 November 2022

  • Change to virtual private endpoints

• 2 November 2022

  • Changes to private IP addresses from 15 December 2022

• 15 September 2022

  • Container Registry plug-in 1.0.0 is available

  • All releases of Container Registry plug-in 0.1 are deprecated

  • Vulnerability Advisor 4 is available from Container Registry plug-in 1.0.0

  • New commands for setting and checking the Vulnerability Advisor version are available from Container Registry plug-in 1.0.0

• 3 August 2022

  • The CLI stops returning security status results in lists by default from version 1.0.0

• 8 July 2022

  • Context-based restrictions

• 5 July 2022

  • Change to Container Registry private IP addresses in all regions

  • All accounts require IAM access policies

• 27 June 2017

  • Introducing IBM Cloud Container Registry

Container Registry and Vulnerability Advisor workflow tutorial

Container Registry and Vulnerability Advisor workflow tutorial

• Objectives

• Services used

• Before you begin

• From code to a running container

  • Create a namespace

  • Build and push an image

  • Deploy a container that uses your image

• Secure your images and clusters

  • View the vulnerability report for your image

  • Enforce security in your cluster

  • Resolve vulnerabilities in your image

• Deploying to nondefault Kubernetes namespaces

Granting access to Container Registry resources tutorial

Granting access to Container Registry resources tutorial

• Before you begin

• Authorize a user to configure the registry

• Authorize a user to access specific namespaces

• Create a service ID and grant access to a resource

• Cleaning up your account

Solution tutorials

Moving a VM based app to Kubernetes

• Objectives

• Architecture

  • Traditional app architecture with VMs

  • Containerized architecture

  • VMs, containers, and Kubernetes

    • Virtual machines vs containers

    • Kubernetes orchestration

  • What IBM is doing for you

• Sizing clusters

• Decide what Database option to use

• Decide where to store application files

  • Non-persistent data storage

  • Learn how to create persistent data storage for your app

  • Learn how to move existing data to persistent storage

  • Set up backups for persistent storage

• Prepare your code

  • Apply the 12-factor principles

  • Store credentials in Kubernetes secrets

• Containerize your app

• Deploy your app to a Kubernetes cluster

  • Learn how to create a Kubernetes deployment yaml file

• Summary

• Put everything learned to practice, run the JPetStore app in your cluster

• Related Content

Resilient and secure multi-region Kubernetes clusters with IBM Cloud Internet Services

• Objectives

• Before you begin

• Deploy an application to one location

  • Create a Kubernetes cluster

  • Deploy the application to the Kubernetes cluster

  • Get the Ingress Subdomain assigned to the cluster

  • Configure the Ingress for your DNS subdomain

• And then to another location

• Configure multi-location load-balancing

  • Register a custom domain with IBM Cloud Internet Services

  • Configure Health Check for the Global Load Balancer

  • Define Origin Pools

    • One pool for the cluster in Dallas

    • One pool for the cluster in London

  • Create the Global Load Balancer

• Secure the application

  • Turn the Web Application Firewall On

  • Increase performance and protect from Denial of Service attacks

• Remove resources

  • Remove Kubernetes Cluster resources

  • Remove CIS resources

• Related content

Setting up the CLI and namespace

Setting up the CLI and namespace

• Installing the container-registry CLI plug-in

• Updating the container-registry CLI plug-in

  • Updating container-registry CLI plug-in version 1.0

  • Updating container-registry CLI plug-in version 0.1

• Uninstalling the container-registry CLI plug-in

• Planning namespaces

  • User permissions for working with namespaces

• Setting up a namespace

• Assigning existing namespaces to resource groups

• Removing namespaces

Setting up Container Registry as a private registry on Red Hat OpenShift

Setting up Container Registry as a private registry on Red Hat OpenShift

• Set up Red Hat OpenShift on IBM Cloud to use Container Registry

• Set up Red Hat OpenShift Container Platform to use Container Registry

  • Set up the Red Hat OpenShift Container Platform internal registry to pull from Container Registry

  • Set up the Red Hat OpenShift Container Platform build to push images to Container Registry

Adding images to your namespace

Adding images to your namespace

• Pulling images from another registry

• Pushing Docker images to your namespace

• Copying images between registries

• Creating images that refer to a source image

• Building Docker images to use them with your namespace

• Pushing images by using an API key

• Removing tags from images in your private repository

• Deleting images from your private repository

  • Deleting images from your private repository in the CLI

  • Deleting images from your private repository in the console

• Listing images in the trash

• Restoring images

  • Restoring images by digest

  • Restoring images by tag

• Deleting a private repository and any associated images

Using Helm charts

Using Helm charts

• OCI support for Helm charts

• Adding Helm charts to your namespace

  • Pulling charts from another registry or Helm repository

  • Pushing Helm charts to your namespace

  • Copying charts between registries

  • Installing a Helm chart to the cluster

• Deleting charts from your private repository

  • Deleting charts from your private repository in the CLI

  • Deleting charts from your private repository in the console

• Listing charts in the trash

• Restoring charts

  • Restoring charts by digest

  • Restoring charts by tag

• Deleting a private repository and any associated charts

Cleaning up your namespaces

Cleaning up your namespaces

• Planning retention

• Clean up your namespaces to keep a set number of images

• Set a retention policy for your namespaces

• Update a retention policy to keep all your images

• Clean up your namespaces by deleting untagged images

Managing quota limits for storage and pull traffic

Managing quota limits for storage and pull traffic

• Setting quota limits for storing and pulling images

• Reviewing quota limits and usage

• Staying within quota limits

Managing user access

Accessing Container Registry

• Accessing your namespaces in automation

  • Creating a service ID API key manually

  • Creating a user API key manually

  • Using client software to authenticate in automation

    • Using Buildah to authenticate with the registry

    • Using Docker to authenticate with the registry

    • Using Podman to authenticate with the registry

    • Using Skopeo to authenticate with the registry

• Accessing your namespaces interactively

  • Using Buildah to access your namespace

  • Using Docker to access your namespace

  • Using Podman to access your namespace

  • Using Skopeo to access your namespace

• Accessing your namespaces programmatically

Accessing Container Registry by using trusted profiles

• Accessing namespaces in automation by using a trusted profile

  • Creating a trusted profile

  • Creating a service ID API key manually

  • Using client software to authenticate in automation

    • Using Buildah to authenticate with the registry by using trusted profiles

    • Using Docker to authenticate with the registry by using trusted profiles

    • Using Podman to authenticate with the registry by using trusted profiles

    • Using Skopeo to authenticate with the registry by using trusted profiles

Managing IAM access

• Access policies

• Assign roles

• Context-based restrictions

• Platform management roles

• Service access roles

  • Access roles for configuring Container Registry

  • Access roles for using Container Registry

• Assigning access to Container Registry in the console

• Assigning access to Container Registry in the CLI

• Assigning access to Container Registry by using the API

• Assigning access to Container Registry by using Terraform

Defining IAM access policies

• Creating policies

• Setting up region-based policies for IAM

  • Region-based user policies

  • Region-based service ID policies

Managing image security with Vulnerability Advisor

Managing image security with Vulnerability Advisor

• About Vulnerability Advisor

  • Data protection

• Types of vulnerabilities

  • Vulnerable packages

  • Configuration issues

• Setting the version of Vulnerability Advisor

• Reviewing a vulnerability report

  • Reviewing a vulnerability report by using the console

  • Reviewing a vulnerability report by using the CLI

• Setting organizational exemption policies

  • Setting exemption policies by using the console

  • Setting exemption policies by using the CLI

Setting up Terraform

Setting up Terraform

• Installing Terraform and creating a Container Registry namespace

• Next steps

Enhancing security

Managing security and compliance

Using VPE for VPC to connect privately

• Before you begin

• Virtual private endpoints

• Setting up a VPE for IBM Cloud Container Registry

  • Configuring an endpoint gateway

Securing your connection

• Using private network connections

  • Enabling service endpoint support for the account

  • Considerations for private network connections

  • Pushing and pulling images

• Enforcing access to your account

Encrypting images for content confidentiality

• Before you begin

• Create the public-private key pair

• Encrypt the image

• Pull and decrypt the image

• Storing keys

• Next steps

Managing your data

• How your data is stored

  • Image data

  • Scanning data

• Deleting your data

  • Deleting the service

  • Deleting namespaces

  • Deleting images

  • Deleting private repositories

• Restoring deleted data

Signing images for trusted content

• Signing images by using Red Hat signatures

  • Using Skopeo to sign images

  • Using Podman to sign images

  • Signing images by using the Red Hat OpenShift CLI

Using IAM IP address access restrictions

• Granting access if you are using a public network

• Granting access if you are using a private network

Enforcing container image security by using Portieris

• Installing Portieris in your cluster

• Portieris policies

• Uninstalling Portieris

Protecting resources with context-based restrictions

• How Container Registry integrates with context-based restrictions

• Protecting specific resources

• Limitations

• Creating rules

  • Creating rules in the IBM Cloud console

  • Creating rules by using the CLI

  • Creating rules by using the API

• Setting up region-based policies for context-based restrictions

Accessing Container Registry through a firewall

• Using a public network to access Container Registry

Observability

Monitoring metrics

• Enabling metrics for Container Registry

• Locations of platform metrics

• Where to look for metrics

  • Monitoring metrics

• Viewing metrics

  • Starting the Monitoring UI from the Observability page

• Predefined dashboards

• Platform metrics

  • Pull Traffic

  • Pull Traffic Quota

  • Storage Quota

  • Storage

Activity tracking events

• Locations where activity tracking events are generated

• Locations where activity tracking events are sent by IBM Cloud Activity Tracker Event Routing

• Viewing activity tracking events for Container Registry

  • Starting IBM Cloud Logs from the Observability page

• Account management events

• Events for images

• Events for namespaces

• Events for vulnerabilities

• Analyzing Container Registry activity tracking events

  • Request data for vulnerability events

    • Request data for the account vulnerability report

    • Request data for the account vulnerability status

    • Request and response data for the vulnerability report

    • Request and response data for the vulnerability status

  • Request data for image signing events

Logging

• Locations where platform logs are generated

• Locations where logs are sent by IBM Cloud Logs Routing

• Platform logs that are generated

• Viewing logs

  • Launching IBM Cloud Logs from the Observability page

• Fields by log type

IAM and activity tracker auditing event actions by API method

• Container Registry

  • Authorization API methods

  • Image API methods

  • Message API methods

  • Namespace API methods

  • Plan API methods

  • Quota API methods

  • Retention API methods

  • Settings API methods

  • Tag API methods

  • Trash API methods

• Vulnerability Advisor API methods

  • Report API methods

  • Exemption API methods

Container Registry CLI

CLI

• Prerequisites

  • Notes

• ibmcloud cr api

  • Prerequisites

• ibmcloud cr exemption-add

  • Prerequisites

  • Command options

  • Examples

• ibmcloud cr exemption-list (ibmcloud cr exemptions)

  • Prerequisites

  • Command options

  • Examples

• ibmcloud cr exemption-rm

  • Prerequisites

  • Command options

  • Examples

• ibmcloud cr exemption-types

  • Prerequisites

  • Command options

• ibmcloud cr iam-policies-enable

  • Prerequisites

• ibmcloud cr iam-policies-status

• ibmcloud cr image-digests (ibmcloud cr digests)

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr image-inspect

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr image-list (ibmcloud cr images)

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr image-prune-untagged

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr image-restore

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr image-rm

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr image-tag

  • Prerequisites

  • Command options

  • Examples

• ibmcloud cr image-untag

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr info

  • Prerequisites

• ibmcloud cr login

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr manifest-inspect

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr namespace-add

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr namespace-assign

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr namespace-list (ibmcloud cr namespaces)

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr namespace-rm

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr plan

  • Prerequisites

  • Command options

• ibmcloud cr plan-upgrade

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr platform-metrics

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr private-only

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr quota

  • Prerequisites

  • Command options

• ibmcloud cr quota-set

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr region

  • Prerequisites

• ibmcloud cr region-set

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr retention-policy-list

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr retention-policy-set

  • Prerequisites

  • Command options

  • Examples

• ibmcloud cr retention-run

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr trash-list

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr va-version

  • Prerequisites

• ibmcloud cr va-version-set

  • Prerequisites

  • Command options

  • Example

• ibmcloud cr vulnerability-assessment (ibmcloud cr va)

  • Prerequisites

  • Command options

  • Examples

Formatting and filtering the CLI output

• Go template options for ibmcloud cr image-digests

• Go template options for ibmcloud cr image-list

• Go template options for ibmcloud cr image-inspect

  • Config field details

  • Healthcheck field details

  • RootFS field details

CLI change log

• Version 1.3.14

• Version 1.3.13

• Version 1.3.12

• Version 1.3.11

• Version 1.3.10

• Version 1.3.8

• Version 1.3.7

• Version 1.3.5

• Version 1.3.4

• Version 1.3.1

• Version 1.2.2

• Version 1.1.0

• Version 1.0.11

• Version 1.0.8

• Version 0.1.587

• Version 1.0.6

• Version 1.0.5

• Version 0.1.585

• Version 1.0.2

• Version 0.1.584

• Version 1.0.1

• Version 0.1.583

• Version 1.0.0

• Version 0.1.582

Service dependencies

Service dependencies

High availability and disaster recovery

High availability

• Ownership of responsibilities

• What level of availability do I need?

• What level of availability does IBM Cloud offer?

• Locations for service availability

• FAQ about high availability

  • Does IBM Cloud replicate the service?

  • Are users required to replicate the service?

Business continuity and disaster recovery

• Your responsibilities when you're using Container Registry

• Disaster recovery strategy

• Locations for service availability

• FAQ about disaster recovery

  • Does the service replicate the data?

  • What data is backed up or replicated?

  • Are users required to replicate the data?

Understanding data portability

Understanding data portability

• Responsibilities

• Procedures for exporting data

• Exported data formats

• Data ownership

Your responsibilities

Your responsibilities

• Incident and operations management

• Change management

• Identity and access management

• Security and regulation compliance

• Disaster recovery

Terraform reference

Terraform reference

API reference

IBM Cloud Container Registry API

Vulnerability Advisor 4 for IBM Cloud Container Registry API

Related links

IBM Cloud Kubernetes Service documentation

Red Hat OpenShift on IBM Cloud documentation

IBM Developer - Containers

Troubleshooting

Troubleshooting Container Registry

• Troubleshooting topics

  • Troubleshooting CLI login

  • Troubleshooting pull and push errors

  • Troubleshooting CLI commands

  • Troubleshooting networking

  • Troubleshooting Portieris

FAQ

FAQ for Container Registry

• Where is the reference documentation for Container Registry?

• How do I set up the Container Registry CLI?

• How do I configure my firewall to allow connections to Container Registry?

• What is my namespace?

• How many namespaces can you have?

• Can I rename a namespace?

• Why don't I have authorization to create a namespace?

• How do I obtain image pull credentials for Container Registry?

• How do I list image names?

• How do you list public images?

• What tools can I use to build and push images?

• How do I log in to Container Registry with Podman?

• Do images in the trash count toward my quota?

• How do I find the image digest?

• How do I use digests to work with images?

• Why can't I push the image into Container Registry?

• How do I list images that are more than a year old?

• How do you use access control?

• How can I share access to an image?

• Can I share a Container Registry namespace across IBM Cloud accounts?

• Can I push images on a different account to the one that is running the build pipeline?

• Do I have any untagged images?

• Do I need untagged images?

• What are eligible images?

• What regions are available?

• How do I get the docker pull command to return the most recent version?

• Why do my pods fail with an ImagePullBackOff error?

• Why am I getting an exceeded quota error?

FAQ for Vulnerability Advisor

• How do I manage vulnerabilities?

• How much does Vulnerability Advisor cost?

• Can images from other registries be scanned by Vulnerability Advisor?

• How is a Vulnerability Advisor scan triggered?

• Why doesn't my image scan in Vulnerability Advisor v4?

• Why doesn't a new image scan in Vulnerability Advisor?

• How often are the security notices updated in Vulnerability Advisor?

• How do I get notified about the security status of an image?

• Which version of a package is installed in my image?

  • Alpine package manager commands

  • Debian and Ubuntu package manager commands

  • Red Hat and CentOS package manager commands

• Does Vulnerability Advisor have versions?

Getting help and support

Getting help and support

• Providing support case details