Registry permissions

Registry resources are account- and region-scoped. Repository CRNs use crn:registry:sa-saopaulo-1:my-account:repository/team/api. Pull-through rule CRNs use the pull-through-cache-rule resource type.

Container client permissions

Obtaining a login credential requires registry:GetAuthorizationToken. Pulling also requires registry:ListImages, registry:BatchGetImage, and registry:GetDownloadUrlForLayer on the repository. A login credential alone does not grant image access. Pushing adds registry:InitiateLayerUpload, registry:UploadLayerPart, registry:CompleteLayerUpload, and registry:PutImage. Importing an upstream image on a cache miss additionally requires registry:BatchImportUpstreamImage. Resource policies can grant repository access to other principals; explicit denies still apply. Keep administration permissions separate from build and runtime identities.

Control-plane actions

Action	API calls
`registry:BatchDeleteImage`	`POST /v1/repositories/{repository_id}/images/batch-delete`
`registry:BatchGetImage`	`GET /v1/repositories/{repository_id}/images/{image_reference}`
`registry:CreatePullThroughCacheRule`	`POST /v1/pull-through-cache-rules`
`registry:CreateRepository`	`POST /v1/repositories`
`registry:DeleteLifecyclePolicy`	`DELETE /v1/repositories/{repository_id}/lifecycle-policy`
`registry:DeletePullThroughCacheRule`	`DELETE /v1/pull-through-cache-rules/{prefix}`
`registry:DeleteRepository`	`DELETE /v1/repositories/{repository_id}`
`registry:DeleteRepositoryPolicy`	`DELETE /v1/repositories/{repository_id}/policy`
`registry:DescribeImages`	`GET /v1/repositories/{repository_id}/images`
`registry:DescribePullThroughCacheRules`	`GET /v1/pull-through-cache-rules` `GET /v1/pull-through-cache-rules/{prefix}`
`registry:DescribeRepositories`	`GET /v1/repositories` `GET /v1/repositories/{repository_id}`
`registry:GetAuthorizationToken`	`POST /v1/authorization-token`
`registry:GetEncryptionConfiguration`	`GET /v1/encryption-configuration/retained-data` `GET /v1/encryption-configuration`
`registry:GetLifecyclePolicy`	`GET /v1/repositories/{repository_id}/lifecycle-policy`
`registry:GetRepositoryPolicy`	`GET /v1/repositories/{repository_id}/policy`
`registry:ListImages`	`GET /v1/repositories/{repository_id}/tags`
`registry:PutEncryptionConfiguration`	`DELETE /v1/encryption-configuration` `PUT /v1/encryption-configuration`
`registry:PutLifecyclePolicy`	`PUT /v1/repositories/{repository_id}/lifecycle-policy`
`registry:SetRepositoryPolicy`	`PUT /v1/repositories/{repository_id}/policy`
`registry:StartLifecyclePolicyPreview`	`POST /v1/repositories/{repository_id}/lifecycle-policy/preview`
`registry:UpdatePullThroughCacheRule`	`PATCH /v1/pull-through-cache-rules/{prefix}`
`registry:UpdateRepository`	`PATCH /v1/repositories/{repository_id}`

Example: pull one repository

This identity policy grants a login credential and access to one repository:

{
  "version": "2024-01-01",
  "statements": [
    {"effect":"allow","actions":["registry:GetAuthorizationToken"],"resources":["*"]},
    {"effect":"allow","actions":["registry:ListImages","registry:BatchGetImage","registry:GetDownloadUrlForLayer"],"resources":["crn:registry:sa-saopaulo-1:my-account:repository/team/api"]}
  ]
}

Add repository creation, mutation, deletion, resource-policy management, or lifecycle administration only when that identity needs them. Changing account registry encryption uses its own registry:PutEncryptionConfiguration action.

Get started

Products

Platform

Help

Registry permissions

Container client permissions

Control-plane actions

Example: pull one repository

​Container client permissions

​Control-plane actions

​Example: pull one repository

Container client permissions

Control-plane actions

Example: pull one repository