vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Install the CLI](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespacecli_namespace_registry_cli_install) to work with images in your namespace.
* [Set up your own namespace in IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_setup).
* [Pull](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_registry_images_pulling_reg) or [build](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_registry_images_creating) an image on your local computer and tag the image with your namespace information.
* [Make sure that you can run Docker commands without root permissions](https://docs.docker.com/engine/install/linux-postinstall/). If your Docker client is set up to require root permissions, you must run ibmcloud login, ibmcloud cr login, docker pull, and docker push commands with sudo.

If you change your permissions to run Docker commands without root privileges, you must run the ibmcloud login command again.



IBM Cloud Container Registry supports other clients as well as Docker. To log in by using other clients, see [Accessing your namespaces interactively](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive).

To upload (push) an image, complete the following steps:



1. Log in to the CLI by running the [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) command.

ibmcloud cr login

You must log in if you pull an image from your private IBM Cloud Container Registry.
* [What if I want to use service credentials that use the private cloud service endpoint?](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingsvc-bind-private-cse)
* [Can I use all IBM Cloud services in my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingsvc-bind-which)
* [Can I bind multiple IBM Cloud services to multiple clusters at once?](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingsvc-bind-trusted-profile)



* [Adding IBM Cloud services to clusters](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingbind-services)
* [Accessing service credentials from your apps](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingadding_app)



* [Mounting the secret as a volume to your pod](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingmount_secret)
* [Referencing the secret in environment variables](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingreference_secret)



* [Removing a service from a cluster](https://cloud.ibm.com/docs/containers?topic=containers-service-bindingunbind-service)



[Understanding high availability and disaster recovery](https://cloud.ibm.com/docs/containers?topic=containers-haha)



* [About high availability](https://cloud.ibm.com/docs/containers?topic=containers-haha-about)
* [Overview of potential points of failure in IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-hafault_domains)







 API reference 

[IBM Cloud Kubernetes Service API](https://containers.cloud.ibm.com/global/swagger-global-api//)
I tried to run a pipeline, why am I getting a 403 error from the IBM Cloud Container Registry? 

The IBM Cloud® Container Registry pipeline pushes and pulls images to and from the [IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview). The IBM Cloud Container Registry service plan determines the amount of storage and pull traffic that you can use for your private images.

 What’s happening 

When I attempt to run a pipeline, I receive the following error message:

Failed to pull image "us.icr.io/sdl-ns/achilles:a100-p203-6-20190717161046-78fbc8a3a0fbc8571d887e57499642e0326e7035": rpc error: code = Unknown desc = failed to pull and unpack image "us.icr.io/sdl-ns/achilles:a100-p203-6-20190717161046-78fbc8a3a0fbc8571d887e57499642e0326e7035": failed to copy: httpReaderSeeker: failed open: unexpected status code https://us.icr.io/v2/sdl-ns/achilles/blobs/sha256:365b19774a508fd998bc636981cb9869a406786ad811e51937fa6fb089c86005: 403 Forbidden

 Why it’s happening 

You might have exceeded your [pull traffic quota limits](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_quotaregistry_quota_get), which prevents the Docker image from being fetched.

 How to fix it 

Review your [quota limits and usage](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_quotaregistry_quota_get) for storing and pulling images.
Why does the Container Registry login keep expiring? 

Logging in to IBM Cloud® Container Registry by using the [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) command is subject to IAM login session limits.

  What’s happening 

Pushes and pulls to the registry fail after a period of inactivity. The following example is a typical scenario:



1.  You log in by using the ibmcloud cr login command, and then you push or pull an image.
2.  You don't run any other commands for a length of time that is longer than the IAM session inactivity limit.
3.  Without logging in again, you try to push or pull an image and the command fails.



  Why it’s happening 

When you log in by using the ibmcloud cr login command, you are subject to the IAM session limits, see [Setting limits for login sessions](https://cloud.ibm.com/docs/account?topic=account-iam-work-sessions).

  How to fix it 

You can mitigate the issue by taking one of the following actions:



*  Log in by using an IAMAPI keybecause this key is not subject to the IAM session expiry, see [Using Docker to authenticate with an API key](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_apikey_auth_docker).
*  Change the IAM login session limits to better suit your needs, see [Setting limits for login sessions](https://cloud.ibm.com/docs/account?topic=account-iam-work-sessions). The longer you set the limits, the longer your IBM Cloud Container Registry login lasts for.
--registry-secret The registry secret that is used to access the registry when you create the container image. Run the secret create --format registry command to create a registry secret. The registry secret is used to authenticate with a private registry. 
 --source The URL of the Git repository or the path to the local source that contains your source code; for example, git@github.com:myprivaterepo/builds.git. 
 --context-dir The directory in the repository that contains the buildpacks file or the Dockerfile. Specify this value if your buildpacks file or Dockerfile is contained in a subdirectory. 
 --strategy The strategy to use for building the image. Valid values are dockerfile and buildpacks. 
 --git-repo-secret The name of the SSH secret, which contains the credentials to access the private repository that contains the source code to build your container image. Run the secret create --ssh command to create this secret. An SSH secret is also used as a Git repository access secret. 



2. Use the buildrun get command to check the status of your build run.

ibmcloud ce buildrun get --name helloworld-buildrun-private2

Example output

Getting build run 'helloworld-buildrun-private2'...
For troubleshooting information visit: https://cloud.ibm.com/docs/codeengine?topic=codeengine-troubleshoot-build.
Run 'ibmcloud ce buildrun events -n helloworld-buildrun-private2' to get the system events of the build run.
Run 'ibmcloud ce buildrun logs -f -n helloworld-buildrun-private2' to follow the logs of the build run.
OK

Name: helloworld-buildrun-private2
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 2d10h
* [Registering a DNS record and TLS certificate](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_dns)



* [Persistent VPC load balancers](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_persist)
* [Moving a VPC load balancer from one cluster to another](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_move)



* [Detaching a VPC load balancer from a cluster](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_move_detach)
* [Attaching a VPC load balancer to a cluster](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_move_attach)



* [Health checks for load balancers](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_health)



* [Customizing health checks for VPC load balancers](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_health_custom)
* [Enabling TCP health checks for UDP load balancers](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaasvpc_lb_health_udp)



* [Changing load balancer subnets or zones](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaaslbaas_change_subnets)
* [Limitations](https://cloud.ibm.com/docs/containers?topic=containers-vpc-lbaaslbaas_limitations)
You can view the image manifest by running the [ibmcloud cr manifest-inspect](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_manifest_inspect) command.





 OCI container images 

A container image that is compliant with the [OCI Image Format](https://github.com/opencontainers/image-spec) specification.

The media type for OCI container images is application/vnd.oci.image.manifest.v1+json.





 Registry 

A public or private container image storage and distribution service.

Storage is provided for

OCI container images(also known as Docker container images). OCI container images can be accessed or "pulled" by OCI clients that use the appropriate registry domain name. Container images can be accessed by anyone (public images) or access can be limited to a group (private images). Container Registry provides a multi-tenant, highly available, private image registry that is hosted and managed by IBM. You can use the registry by adding a namespace that is private to your account and then push images to your namespace.





 Registry namespace 

A collection of repositories that store your container images in Container Registry. The registry namespace is associated with your IBM Cloud account. You can have multiple registry namespaces in an account.

A registry namespace is made up of one or more repositories.

When you set up your own namespace in Container Registry, the namespace is appended to the registry URL, <region>.icr.io/my_namespace. The namespace must be unique across all IBM Cloud accounts in the same region. Every user in your IBM Cloud account can view and work with images that are stored in your registry namespace.

You can have 100 namespaces in each region.

Namespaces are created in a [resource group](https://cloud.ibm.com/docs/account?topic=account-rgs) that you specify so that you can configure access to resources within the namespace at the resource group level.
* To view and analyze namespaces, you must have the Reader or Manager role in the IBM Cloud Container Registry service, see [Access roles for using IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).



For more information about user roles, [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).







 Setting up a namespace 

You must create a namespace to store your Docker images in IBM Cloud Container Registry.

Before you begin, complete the following tasks:



* [Install the IBM Cloud CLI and the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_cli_install).
* [Plan how to use and name your registry namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespace&interface=uiregistry_setup_cli_namespace_plan).



To create a namespace, see [Set up a namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_namespace_add). Namespaces are created in the resource group that you specify so that you can configure access to resources within the namespace at the resource group level. If you don't specify a resource group, and a resource group isn't targeted, the default resource group is used. For more information about resource groups, see [Managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs).

Namespaces that are assigned to a resource group show in the Resource list page of the IBM Cloud console.

The namespace must be unique across all IBM Cloud accounts in the same region. Namespaces must have 4 - 30 characters, and contain lowercase letters, numbers, hyphens (-), and underscores (_) only. Namespaces must start and end with a letter or number.
* [Enforce security in your cluster](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_tutorial_workflowregistry_tutorial_workflow_enforce_security)
* [Resolve vulnerabilities in your image](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_tutorial_workflowregistry_tutorial_workflow_resolve_vulnerabilities)



* [Deploying to nondefault Kubernetes namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_tutorial_workflowregistry_tutorial_workflow_deploy_nondefault_namespaces)







 Granting access to Container Registry resources tutorial 

[Granting access to Container Registry resources tutorial](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_accessiam_access)



* [Before you begin](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_accessiam_access_prereq)
* [Authorize a user to configure the registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_accessconfigure_registry)
* [Authorize a user to access specific namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_accessaccess_resources)
* [Create a service ID and grant access to a resource](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_accessservice_id)
* [Cleaning up your account](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_accessclean_up)







 Solution tutorials 

[Moving a VM based app to Kubernetes](https://cloud.ibm.com/docs/Registry?topic=Registry-vm-to-containers-and-kubernetesvm-to-containers-and-kubernetes)
* Free-form fields, including IDs, descriptions, and image names ([registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_registry), [namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_namespace), [repository](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_repository) name, and image [tag](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_tag))
* Metadata about the file modes and creation timestamps of the configuration files
* The content of system and application configuration files in images and containers
* Installed packages and libraries (including their versions)



Scan results, aggregated at a data center level, are processed to produce anonymized metrics to operate and improve the service. Scan results are deleted 30 days after they are generated. For more information, see [Data protection](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiabout_data_protection).

Do not put personal information into any field or location that IBM Cloud Container Registry processes, as identified in the preceding list.







 Deleting your data 

You can delete your IBM Cloud Container Registry namespaces, images, and private repositories.



 Deleting the service 

When an IBM Cloud account is canceled or removed, the resource instances that track the account's usage of IBM Cloud Container Registry are deleted. As part of that action all namespaces, and the images that they contain, are removed in accordance with the data retention policy.

The IBM Cloud Container Registry data retention policy describes how long your data is stored after you delete the service. The data retention policy is included in the IBM Cloud Container Registry service description, which you can find in the Service Description for IBM Cloud in the [IBM Cloud Terms and Notices](https://cloud.ibm.com/docs/overview?topic=overview-terms).





 Deleting namespaces
Public registries, such as public Docker Hub, can be used to get started with Docker and Code Engine to create your first application or job. But when it comes to enterprise workloads, use a private registry, such as the one provided in IBM Cloud Container Registry to protect your images from being used by unauthorized users. For private registries, use registry secrets to ensure that the credentials are available to gain access to the private registry.



Table 1. Public and private image registry types

 Registry Description 

 [IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgetting-started) With this type of registry, you can set up your own secured image repository in IBM Cloud Container Registry where you can safely store and share images between users. <br>With IBM Cloud Container Registry, you can<br><br><br><br> * Manage access to images in your account.<br> * Use IBM provided images and sample apps, such as IBM Liberty, as a base image and add your own app code to it.<br><br><br> 
 Any other private registry Connect any existing private registry to Code Engine by adding access. Adding access securely saves your registry URL and credentials in a Kubernetes secret. <br>With private registries, you can:<br><br><br><br> * Use existing private registries independent of their source (Docker Hub, organization-owned registries, or other private Cloud registries).<br><br><br> 
 [Public Docker Hub](https://hub.docker.com/) Use this type of registry to pull existing public images from Docker Hub directly in your Code Engine applications or jobs.<br><br>Important<br><br><br><br> * This registry type might not meet your organization's security requirements such as access management, vulnerability scanning, or app privacy.<br> * When you pull an image from Docker Hub to use with apps or jobs in Code Engine, be aware of [Docker rate limits](https://docs.docker.com/docker-hub/download-rate-limit) for free plan (anonymous) users.
If you started to use Container Registry before the availability of [IAM API key policies in Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-25feb2019) in February 2019, you must now ensure that you're using IAM access policies to manage access to the Container Registry service.

Policy-free authorization will be discontinued in the following Container Registry regions:



* us-south (us.icr.io)
* uk-south (uk.icr.io)
* eu-central (de.icr.io)
* ap-south (au.icr.io)
* ap-north (jp.icr.io)



Other regions are unaffected because they already require IAM access policies for all accounts.

For more information, see [IAM access policies are required from 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_policy) and [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-user).





 2 February 2022 

Replication of exemption policies between IBM regions is discontinued
: From 2 February 2022, all regions require separate exemption policy management. Exemption policies are used to exclude any matching vulnerabilities or configuration issues from Vulnerability Advisor reports. You can set an exemption policy by running the [ibmcloud cr exemption-add](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add) command, see [Setting organizational exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_managing_policy).

For more information, see [IBM Cloud Container Registry Is Ending Exemption Synchronization Across Regions](https://www.ibm.com/cloud/blog/announcements/ibm-cloud-container-registry-is-ending-exemption-synchronization-across-regions).





 1 February 2022 

Storage that is used by untagged images is being charged for
ibmcloud iam service-id-create <cluster_name>-<namespace>-id --description "Service ID for IBM Cloud Container Registry in Kubernetes cluster <cluster_name> namespace <namespace>"
3. Create a custom IBM Cloud IAM policy for your cluster service ID that grants access to IBM Cloud Container Registry.

ibmcloud iam service-policy-create <cluster_service_ID> --roles <service_access_role> --service-name container-registry [--region <IAM_region>] [--resource-type namespace --resource <registry_namespace>]

cluster_service_ID
: Required. Replace with the <cluster_name>-<kube_namespace>-id service ID that you previously created for your Kubernetes cluster.

--service-name container-registry
: Required. Enter container-registry so that the IAM policy is for IBM Cloud Container Registry.

--roles <service_access_role>
: Required. Enter the [service access role](https://cloud.ibm.com/docs/Registry?topic=Registry-iamservice_access_roles) for IBM Cloud Container Registry that you want to scope the service ID access to. Possible values are Reader, Writer, and Manager.

--region <IAM_region>
: Optional. If you want to scope the access policy to certain IAM regions, enter the regions in a comma-separated list. Possible values are global and the [local registry regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions_local).

--resource-type namespace --resource <registry_namespace>
: Optional. If you want to limit access to only images in certain [IBM Cloud Container Registry namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_setup_cli_namespace_plan), enter namespace for the resource type and specify the <registry_namespace>.
* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_prereq)



* [ibmcloud cr plan-upgrade](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_upgrade)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_upgrade_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_upgrade_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_upgrade_example)



* [ibmcloud cr platform-metrics](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_platform_metrics)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_platform_metrics_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_platform_metrics_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_platform_metrics_example)



* [ibmcloud cr private-only](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_private_only)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_private_only_prereq)