vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* If you use [image signing](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontent) and want to use the private domain names, you must re-sign any images that you already have because the domain name forms part of the signed artifact.







 Pushing and pulling images 

Private connections are available so that you can push and pull images. You use the same icr.io domain name, with the prefix private., see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).

You can't use private connections for image management operations by using the IBM Cloud Container Registry CLI.

Run the docker login command to authenticate with your registry. Replace <apikey> with your

API keyand <private_registry_domain> with the private domain name where your namespaces are set up. The private domain names are described in [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).

docker login -u iamapikey -p <apikey> <private_registry_domain>

IBM Cloud Container Registry supports other clients as well as Docker. To log in by using other clients, see [Accessing your namespaces in automation](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_automating).

For more information, see [Automating access to IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_access).







 Enforcing access to your account over a private network 

You can prevent or allow image pulls or pushes over public network connections for your account by using the [ibmcloud cr private-only](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_private_only) command.

You can also use this command to check whether the use of private connections is set for your account.
IBM Cloud Classic Block Storage Block storage [IBM Cloud Block Storage](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-getting-startedgetting-started) is persistent, high-performance iSCSI storage that you can add to your apps by using Kubernetes persistent volumes (PVs). Use block storage to deploy stateful apps in a single zone or as high-performance storage for single pods. For more information about how to provision block storage in your cluster, see [Setting up IBM Cloud Block Storage](https://cloud.ibm.com/docs/containers?topic=containers-block_storageblock_storage) Yes 
 Block Storage for VPC Block storage [Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage) provides hypervisor-mounted, high-performance data storage for your virtual server instances that you provision within a VPC cluster. For more information about how to provision VPC Block Storage in your cluster, see [Setting up Block Storage for VPC](https://cloud.ibm.com/docs/containers?topic=containers-vpc-block) Yes 
 IBM Cloud Code Engine Serverless Code Engine is a fully managed, serverless platform that runs your containerized workloads, including web apps, micro-services, event-driven functions, or batch jobs. Code Engine even builds container images for you from your source code. Because these workloads are all hosted within the same Kubernetes infrastructure, all them can seamlessly work together. For more information, see [Getting started with IBM Cloud Code Engine](https://cloud.ibm.com/docs/codeengine). 
 IBM Cloud Container Registry Container images Set up your own secured Docker image repository where you can safely store and share images between cluster users. For more information, see the [IBM Cloud® Container Registry documentation](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started). Yes Yes 
 IBM Cloud Continuous Delivery Build automation Automate your app builds and container deployments to Kubernetes clusters by using a toolchain.
* [Update types](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsupdate_types)
* [Release lifecycle](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsrelease_lifecycle)
* [Preparing to update](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsprep-up)
* [Archive](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive)



[Kubernetes version change logs](https://cloud.ibm.com/docs/containers?topic=containers-changelogchangelog)



* [Overview](https://cloud.ibm.com/docs/containers?topic=containers-changelogchangelog_overview)
* [Version change logs](https://cloud.ibm.com/docs/containers?topic=containers-changelogchange-logs-by-version)



[CIS Kubernetes Benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkcis-benchmark)



* [Available benchmark versions](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkcis-benchmark-versions)
* [Using the benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkcis-benchmark-use)



* [What does the benchmark cover?](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkbenchmark-scope)
* [What do the benchmark recommendations mean?](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkbenchmark-meaning)
* [What parts of the benchmark am I responsible for?]
* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_list_example)



* [ibmcloud cr namespace-rm](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_rm)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_rm_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_rm_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_rm_example)



* [ibmcloud cr plan](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_prereq)



* [ibmcloud cr plan-upgrade](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_upgrade)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_upgrade_prereq)
A domain name consists of a sequence of subnames that are separated by a delimiter character, for example, www.ibm.com.

The domain names that Container Registry uses are in the format us.icr.io. Earlier domain names that Container Registry used are in the format registry.ng.bluemix.net. Both formats of domain name refer to the same registry and content. The Container Registry service responds to earlier and canonical domain names equally. You can push or pull images by using either domain name interchangeably.

The domain name is only significant in the following situations:



* When Kubernetes is selecting a pull-secret, it chooses one that matches the domain name.
* When [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) is helping you to log in, it uses domain names in the format us.icr.io only.
* When images are signed, the signature includes the domain name that was used at the time of signing.



For more information about the domain names that Container Registry uses, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).





 Image manifest 

An image manifest is a .json document that references the configuration object and image layers that are required to pull and run the image. The sha256 hash of the image manifest is the [digest](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_digest), which is used to identify the image. You can view the image manifest by running the [ibmcloud cr manifest-inspect](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_manifest_inspect) command.





 OCI container images 

A container image that is compliant with the [OCI Image Format](https://github.com/opencontainers/image-spec) specification.

The media type for OCI container images is application/vnd.oci.image.manifest.v1+json.





 Registry
Note that the secret data is encoded with base64 and not directly visible; however, the secret contains credentials. In the command output, check the Data section. It must contain a key that is called .dockerconfigjson. If the .dockerconfigjson key is not displayed, then this secret is not suitable to authenticate with a container registry and you need to create a correct secret and reference it in the build. For more information, see [Adding access to a private container registry](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registry).

Example output

$ ibmcloud code-engine secret get -n <REGISTRY_SECRET>
Getting secret <REGISTRY_SECRET>...
OK

Name: <REGISTRY_SECRET>
ID: <REGISTRY_SECRET_ID>
Project: <PROJECT_NAME>
Project ID: <PROJECT_NAMESPACE>
Age: 8s
Created: 2021-02-12T10:26:59-06:00

Data:
---
.dockerconfigjson: <BASE64_STRING>
3. If the .dockerconfigjson key exists, then decode the key, which is a base64 encoded string by using the following command,

echo "<BASE64_STRING>" | base64 -d
{"auths":{"<REGISTRY>":{"username":"<USERNAME>","password":"<PASSWORD>","auth":"<AUTH>"}}}

The output of this command typically contains one <REGISTRY> key.
4. Confirm the following information about the key:

a. Look at the <REGISTRY> value. This value must match the image of the build.



* If the image name is on IBM Cloud Container Registry, for example us.icr.io/aNamespace/anImage, then the <REGISTRY> needs to be us.icr.io.
* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_tag_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_tag_option)
* [Examples](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_tag_example)



* [ibmcloud cr image-untag](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_untag)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_untag_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_untag_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_untag_example)



* [ibmcloud cr info](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_info)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_info_prereq)



* [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login_option)
When you connect to Container Registry now, the real IP address of your VPC [Cloud service endpoint source addresses](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-behind-the-curtaincse-source-addresses) is maintained in a request, which means that IAM restricted IP lists can be configured to specifically allow requests from your VPC, which improves security.





 Understanding if you are impacted by this change 

You are affected by this change if you are using a Container Registry VPE gateway that was created before 11 November 2022. VPE gateways created before this date can be identified by differences in their target CRN. You can find the target CRN of a VPE gateway by viewing the VPE gateway details in the IBM Cloud console (GUI) or CLI, see [Viewing details of an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&interface=ui).

VPE gateways that were created before 11 November 2022 are in the format:

crn:v1:bluemix:public:container-registry:<cloud-region>:::endpoint:vpe.<cloud-region>.container-registry.cloud.ibm.com

VPE gateways that are created after 11 November 2022 are in the format:

crn:v1:bluemix:public:container-registry:<cloud-region>:::endpoint:<registry-region-domain>

For a list of updated Container Registry VPE CRNs, see [Setting up a VPE for IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_vpe&interface=uiregistry_vpe_endpoint_setup).

If you are using a Container Registry VPE gateway that was created before 11 November 2022 and also maintain IAM restricted IP address lists, you must change your restricted IP address list to contain your VPC Cloud Service Endpoint source addresses.





 What actions you must take
: For accounts that have VRF and service endpoints enabled, image push and pull traffic to IBM Cloud Container Registry is now on [the private network](https://cloud.ibm.com/docs/containers?topic=containers-registrycluster_registry_auth_private).





 17 April 2020 

Version change log
: Master patch updates are available for Kubernetes [1.17.4_1521](https://cloud.ibm.com/docs/containers?topic=containers-117_changelog1174_1521_master).





 16 April 2020 

Ingress ALB change log
: Updated the [ingress-auth image build to 394](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 13 April 2020 

Gateway appliance firewalls
: Updated the [required IP addresses and ports](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_private) that you must open in a private gateway device firewall for IBM Cloud Container Registry.

Version change logs
: Worker node patch updates are available.
: Kubernetes [1.17.4_1521](https://cloud.ibm.com/docs/containers?topic=containers-117_changelog1174_1521), [1.16.7_1528](https://cloud.ibm.com/docs/containers?topic=containers-116_changelog1168_1528), [1.15.10_1535](https://cloud.ibm.com/docs/containers?topic=containers-115_changelog11511_1535), and [1.14.10_1551](https://cloud.ibm.com/docs/containers?topic=containers-114_changelog11410_1551).





 6 April 2020 

CLI change log
* [Assign IBM Cloud IAM roles with the CLI](https://cloud.ibm.com/docs/containers?topic=containers-usersadd_users_cli)



* [Assigning IBM Cloud IAM platform roles from the CLI](https://cloud.ibm.com/docs/containers?topic=containers-usersadd_users_cli_platform)
* [Assigning IBM Cloud IAM service roles from the CLI:**](https://cloud.ibm.com/docs/containers?topic=containers-usersadd_users_cli_service)



* [Understanding RBAC permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersunderstand-rbac)



* [What are the types of RBAC roles?](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac-types)
* [What are RBAC role bindings and cluster role bindings?](https://cloud.ibm.com/docs/containers?topic=containers-userswhat-is-rbac)
* [What do these roles look like in my cluster?](https://cloud.ibm.com/docs/containers?topic=containers-userswhat-do-roles-look-like)
* [Can I create custom roles or cluster roles?](https://cloud.ibm.com/docs/containers?topic=containers-userscreate-custom-rbac-roles)
* [When do I need to use custom cluster role bindings and role bindings?](https://cloud.ibm.com/docs/containers?topic=containers-userswhen-do-i-use-custom-rbac)



* [Creating custom RBAC permissions for users, groups, or service accounts](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac)
* [Extending existing permissions by aggregating cluster roles](https://cloud.ibm.com/docs/containers?topic=containers-usersrbac_aggregate)
[Deploying Roll Your Own VMware on IBM Cloud Bare Metal Servers for Virtual Private Cloud](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware)Deploying Roll Your Own VMware on IBM Cloud Bare Metal Servers for Virtual Private Cloud

This tutorial walks you through creating your own IBM Cloud VPC with multiple subnets as required to support vSphere networking and the provisioning of IBM Cloud Bare Metal Servers for Virtual Private Cloud (BMS) for a basic VMware vSphere deployment. After the IBM Cloud VPC and Bare Metal Servers for VPC have been provisioned, the tutorial covers a manual deployment of the vCenter, creating VMware compute cluster with vSAN or NFS shared storage options. The tutorial also covers optional features, such as using IBM Cloud VPC network for VMware Virtual Machine networking.

VMware Solutions Virtual Private Cloud (VPC)



* 8 hours
* 2023-05-05



[Getting started with VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-getting-started)Getting started with VMware Solutions

In this IBM Cloud® for VMware Solutions getting started tutorial, we take you through the process of ordering an instance and some services for it.

VMware Solutions



* 2 hours
* 2023-06-12



Containers[Getting started with Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started)Getting started with Container Registry

IBM Cloud® Container Registry provides a multi-tenant private image registry that you can use to store and share your container images with users in your IBM Cloud account.

Kubernetes service Container Registry



* 45 minutes
* 2023-06-02



[Encrypting images for content confidentiality](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encrypt)Encrypting images for content confidentiality
ibmcloud cr info



 Prerequisites 

None







 ibmcloud cr login 

Log the local Docker or Podman client in to IBM Cloud Container Registry.

This command is required if you want to run the push or pull commands for the registry. If you want to run other ibmcloud cr commands, you're not required to log in to Container Registry.

ibmcloud cr login [--client CLIENT]

Container Registry supports other clients as well as Docker and Podman. To log in by using other clients, see [Accessing your namespaces interactively](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive).

If you have a problem when you try to log in, see [Why can't I log in to Container Registry?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-login) for assistance. If you're using a Mac and you have a problem when you try to log in, see [Why is Docker login on my Mac failing?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-docker-mac) for assistance.

Logging in to Container Registry by using the ibmcloud cr login command is subject to IAM login session limits. If your login expires, see [Why does the Container Registry login keep expiring?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-login-expire) for assistance.



 Prerequisites 

None





 Command options 

CLIENT
: (Optional) Select the client that you want to log in. Valid values are docker and podman. If this option is not used and Docker is installed, the default is docker; if Docker is not installed, the default is podman.





 Example 

To log in to the registry with Podman, run the following command.

ibmcloud cr login --client podman







 ibmcloud cr manifest-inspect
container-registry.settings.set [ibmcloud cr platform-metrics](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_platform_metrics) Update registry service settings for the targeted account, such as enabling platform metrics. Manager 







 Access roles for using Container Registry 

To grant a user permission to access Container Registry content in your account, you must create a policy that grants one or more of the roles in the following table. When you create your policy, you can restrict access to a specific namespace by specifying the resource type namespace and the namespace name as the resource. If you don't specify a resource-type and a resource, the policy grants access to all resources in the account. Alternatively, if your namespace is within a resource group, permission can be granted by using an IAM access policy on that resource group.

For example, use the following command to create a user policy. Where <user_email> is the user's email address, <region> is the region, <roles> is the role, or roles, that you want the user to have, and <namespace_name> is the name of the namespace.

ibmcloud iam user-policy-create <user_email> --service-name container-registry --region <region> --roles <roles> [--resource-type namespace --resource <namespace_name>]

The following table details actions that are mapped to operations on the service and to the service access roles for using Container Registry.



Table 5. Service actions and operations for using Container Registry

 Action Operation on service Role Status
* [VPC cluster limitations](https://cloud.ibm.com/docs/containers?topic=containers-limitationsks_vpc_gen2_limits)



: Ready to get started? Try out the [Creating a cluster in your VPC on generation 2 compute tutorial](https://cloud.ibm.com/docs/containers?topic=containers-vpc_ks_tutorial).





 18 May 2020 

Ingress ALB change log
: Updated the [nginx-ingress image build to 628](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog).





 15 May 2020 

Cloud Paks entitlements
: Added information about [Assigning a Cloud Pak entitlement to your IBM Cloud account](https://cloud.ibm.com/docs/openshift?topic=openshift-openshift_cloud_paksoc_cloud_paks_assign).





 13 May 2020 

Registry
: Added the following topics about using IBM Cloud Container Registry with the internal Red Hat OpenShift container registry. For more information, see [Choosing an image registry solution](https://cloud.ibm.com/docs/openshift?topic=openshift-registryopenshift_registry_options).



* [Importing images from IBM Cloud Container Registry into the internal registry image stream](https://cloud.ibm.com/docs/openshift?topic=openshift-registryimagestream_registry).
* [Deploying containers from an existing image stream in the internal registry](https://cloud.ibm.com/docs/openshift?topic=openshift-imagesoc_imagestream_deploy).
* [Setting up builds in the internal registry to push images to IBM Cloud Container Registry](https://cloud.ibm.com/docs/openshift?topic=openshift-registrybuilds_registry).







 12 May 2020 

Version change logs
For example, to update the CLI to version 0.1.584, run the following command:

ibmcloud plugin install container-registry -v 0.1.584







 Uninstalling the container-registry CLI plug-in 

If you no longer need the container-registry CLI plug-in, you can uninstall it.

To uninstall the container-registry CLI plug-in, run the following command:

ibmcloud plugin uninstall container-registry





 Planning namespaces 

IBM Cloud Container Registry provides a multi-tenant private image

registrythat is hosted and managed by IBM. You can store and share your Docker images in this registry by setting up a registrynamespace.

Namespaces are created in a

resource groupthat you specify so that you can configure access to resources within the namespace at the [resource group](https://cloud.ibm.com/docs/account?topic=account-rgs) level. If you don't specify a resource group, and a resource group isn't targeted, the default resource group is used. However, you can still set permissions for the namespace at the account level or in the namespace itself. If you don't specify a resource group, and a resource group isn't targeted, the default resource group is used.

If you have an older namespace that isn't in a resource group, you can assign it to a resource group and then set permissions for that namespace at the resource group level. For more information about resource groups, see [Assigning existing namespaces to resource groups](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_assign).

Namespaces that are assigned to a resource group show in the Resource list page of the IBM Cloud console.

You can set up multiple namespaces, for example, to have separate repositories for your production and staging environments. If you want to use the registry in multiple IBM Cloud regions, you must set up a namespace for each region. Namespace names are unique within regions.