> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissões do Registry

> Conceda pull, push e administração separadamente.

Recursos do Registry pertencem à conta e região. CRNs de repositório usam `crn:registry:sa-saopaulo-1:my-account:repository/team/api`. Regras de cache usam o tipo de recurso `pull-through-cache-rule`.

<span id="container-client-permissions" />

## Permissões de clientes de contêiner

Obter uma credencial exige `registry:GetAuthorizationToken`. Pull também exige `registry:ListImages`, `registry:BatchGetImage` e `registry:GetDownloadUrlForLayer` no repositório. A credencial de login sozinha não concede acesso às imagens.

Push acrescenta `registry:InitiateLayerUpload`, `registry:UploadLayerPart`, `registry:CompleteLayerUpload` e `registry:PutImage`. Importar da origem sem cache também exige `registry:BatchImportUpstreamImage`. Políticas de recurso podem conceder acesso a outros principais; negações explícitas continuam valendo. Separe administração de identidades de build e execução.

<span id="control-plane-actions" />

## Ações de gerenciamento

| Ação | Chamadas da API |
| - | - |
| `registry:BatchDeleteImage` | `POST /v1/repositories/{repository_id}/images/batch-delete` |
| `registry:BatchGetImage` | `GET /v1/repositories/{repository_id}/images/{image_reference}` |
| `registry:CreatePullThroughCacheRule` | `POST /v1/pull-through-cache-rules` |
| `registry:CreateRepository` | `POST /v1/repositories` |
| `registry:DeleteLifecyclePolicy` | `DELETE /v1/repositories/{repository_id}/lifecycle-policy` |
| `registry:DeletePullThroughCacheRule` | `DELETE /v1/pull-through-cache-rules/{prefix}` |
| `registry:DeleteRepository` | `DELETE /v1/repositories/{repository_id}` |
| `registry:DeleteRepositoryPolicy` | `DELETE /v1/repositories/{repository_id}/policy` |
| `registry:DescribeImages` | `GET /v1/repositories/{repository_id}/images` |
| `registry:DescribePullThroughCacheRules` | `GET /v1/pull-through-cache-rules`<br />`GET /v1/pull-through-cache-rules/{prefix}` |
| `registry:DescribeRepositories` | `GET /v1/repositories`<br />`GET /v1/repositories/{repository_id}` |
| `registry:GetAuthorizationToken` | `POST /v1/authorization-token` |
| `registry:GetEncryptionConfiguration` | `GET /v1/encryption-configuration/retained-data`<br />`GET /v1/encryption-configuration` |
| `registry:GetLifecyclePolicy` | `GET /v1/repositories/{repository_id}/lifecycle-policy` |
| `registry:GetRepositoryPolicy` | `GET /v1/repositories/{repository_id}/policy` |
| `registry:ListImages` | `GET /v1/repositories/{repository_id}/tags` |
| `registry:PutEncryptionConfiguration` | `DELETE /v1/encryption-configuration`<br />`PUT /v1/encryption-configuration` |
| `registry:PutLifecyclePolicy` | `PUT /v1/repositories/{repository_id}/lifecycle-policy` |
| `registry:SetRepositoryPolicy` | `PUT /v1/repositories/{repository_id}/policy` |
| `registry:StartLifecyclePolicyPreview` | `POST /v1/repositories/{repository_id}/lifecycle-policy/preview` |
| `registry:UpdatePullThroughCacheRule` | `PATCH /v1/pull-through-cache-rules/{prefix}` |
| `registry:UpdateRepository` | `PATCH /v1/repositories/{repository_id}` |

<span id="example-pull-one-repository" />

## Exemplo: baixar de um repositório

Esta política de identidade concede uma credencial de login e acesso a um repositório:

```json theme={null}
{
  "version": "2024-01-01",
  "statements": [
    {"effect":"allow","actions":["registry:GetAuthorizationToken"],"resources":["*"]},
    {"effect":"allow","actions":["registry:ListImages","registry:BatchGetImage","registry:GetDownloadUrlForLayer"],"resources":["crn:registry:sa-saopaulo-1:my-account:repository/team/api"]}
  ]
}
```

Adicione criação, alteração, exclusão, políticas de recurso ou ciclo de vida somente quando a identidade precisar. A criptografia da conta usa a ação separada `registry:PutEncryptionConfiguration`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.