vania-janet/multiturn-rag-retrieval-data huggingface dataset:
then this attempt fails with HTTP status code 404 (not found). This status code means that the image doesn't exist in your account. If the instance was provisioned by using a shared catalog image in another account, this response is the response that you always get even if the image still exists in the owning account.

Additionally, it is possible that the referenced image might have the same name as a custom image in your account. But these image names are for two different images in two different accounts. The id, crn, and href each uniquely identifies an image across IBM Cloud®.

Verify that your clients handle image reference lookup failures gracefully and do not assume that inaccessible images were deleted, even when it runs with full access to your images. To avoid possible retrieval or use of the wrong image by name, specify the image id, crn, or href instead.





 Using cross-account image references in a private catalog in Terraform 

Instances that you provision belong to your account. Images that are shared to your account through a private catalog might belong to other accounts. When you provision an instance from an image that belongs to another account or from an instance template that specifies such an image, the image still belongs to the other account even though the instance belongs to your account. A reference to such an image might exist in details of the instance and related resources. For example, details about its boot volume and any snapshot that was created from that boot volume might reference that image. Regardless of your authorizations, you can't access this type of custom image by its ID and attempts fail as if the image does not exist.

Image references are used in a few different places in the terraform. For example, if you use the [instance data source](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/is_instance) to retrieve instance data, you see the following within the data source response.

"image": "r006-e0d3b6fb-5421-4421-9061-0ca9f79a4990"
* UI
* CLI
* API







 Managing image from a volume 

Images from volumes have their own lifecycles that you can manage.



* IAM permissions for creating an image from volume.
* Make an immediate or schedule a lifecycle status change.
* Cancel an image queued for creation.
* Delete an image from volume.





 IAM permissions for creating an image from volume 

IAM enables you to securely authenticate users for platform services and control access to resources consistently across IBM Cloud®. The following table shows access requirements for creating an image from a volume.



Table 2. IAM user permissions

 Operation Action API call IAM access roles 

 Create an instance is.instance.instance.create POST/instances Administrator, Editor 
 List all instances is.instance.instance.list GET/instances Administrator, Editor, Operator, Viewer 
 Create an image from an instance boot volume is.image.image.create POST/images Administrator, Editor 
 List all images is.image.image.list GET/images Administrator, Editor, Operator, Viewer 
 Delete image is.image.image.delete DELETE/images Administrator, Editor 
 Schedule deprecation is.image.image.deprecate POST/images with deprecation_at specified Administrator, Editor 
 Schedule obsolescence is.image.image.obsolete POST/images with obsolescence_at specified Administrator, Editor 







 Image from volume lifecycle states 

The following table describes the lifecycle states for custom images that are created from a volume.



Table 3. Image lifecycle states

 Status Explanation 

 Available Image is available when you provision an instance. 
 Pending The image is being created. If successful, the image is available. Otherwise, creation failed. 
 Failed Image creation failed. 
 Deleting The image is being deleted. 
 Deprecated You can use the image to create an instance. Using the deprecated status can discourage use of the image before the status changes to obsolete. 
 Obsolete You can't use the image to a create an instance. If you try to use an obsolete image to create an instance, you receive a message that the image can't be used to create an instance.
For more information about making status changes, see [Managing custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-custom-images&interface=ui).



Table 1. Image lifecycle status

 Image status Description 

 available You can use the image to create an instance. 
 deprecated You can use the image to create an instance. Using the deprecated status can discourage use of the image before changing the status to obsolete. 
 obsolete You can't use the image to create an instance. If you try to use an obsolete image to create an instance, you receive a message that states that you can't use the image to create an instance. This status allows a reversible disabling of an image before you delete the image. 



Any image that is in deprecated or obsolete status is still billed. If you don't want to be billed for the image, you must delete it.





 Next steps 



* Check out the [Creating a custom image from volume and provisioning an instance in the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-and-using-an-image-from-volume) tutorial.
* [Create an image from a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-create-ifv).
* [Troubleshooting custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-ifv-troubleshooting-custom-images).
Schematics internally manages the [state-file](https://cloud.ibm.com/docs/schematics?topic=schematics-schematics-cli-referencestate-file-cmds), in its own COS bucket, that are encrypted by using [envelop encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).
* Why are files removed from Terraform, or Ansible templates?

To protect from malicious users Schematics removes files from imported Git repositories.

When creating Schematics Workspaces or action IBM Cloud Schematics takes a copy of the Terraform, or Ansible template from your Git repository and stores in a secured location. Before the template files are saved, Schematics analyses the files and are removed, based on the following conditions:



* The allowed file extensions are .cer, .cfg, .conf, .crt, .der, .gitignore, .html, .j2, .jacl, .js, .json, .key, .md, .netrc, .pem, .properties, .ps1, .pub, .py, .service, .sh, .tf, .tf.json, .tfvars, .tmpl, .tpl, .txt, .yaml, .yml, .zip, _rsa, license.
* The allowed image extensions are .bmp, .gif, .jpeg, .jpg, .png, .so .tif, .tiff.
* The files that are removed are .asa, .asax, .exe, .php5, .pht, .phtml, .shtml, .swf, .tfstate, .tfstate.backup, .xap.
* All files that are larger than 500 KB are removed. This file size limit does not apply for the allowed image files.
* The folder name starts with a (period) . is treated as vulnerable.



The allowed extension list is continuously monitored and updated in every release.
If you're using Hyper Protect Crypto Services, see the [documentation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-startedget-started) for that service for corresponding instructions.



1. Provision the [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provisionprovision) service.
2. [Install the IBM Cloud Key Protect CLI plug-in](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-cli). You must use the Key Protect CLI to wrap the base64-encoded 32-byte standard data encryption key (DEK) that you intend to use to encrypt your Virtual Hard Drive (VHD) image with the root key.
3. [Create](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys) or [import](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keysimport-root-keys) a root key (CRK) in Key Protect. You will use your root key in the next step to wrap the data encryption key that you use to encrypt your image.
4. Identify the DEK that you want use to encrypt your image, and then [wrap it with your root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-referencekp-key-command). If you need to generate a DEK, you can use the [kp wrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-referencekp-key-command) command with no plain text parameter (-p) to generate the key and wrap it.
* ibmcloud is image-create my-ubuntu-16-amd64 --file cos://us-south/custom-image-vpc-bucket/customImage-0.qcow2 --os-name ubuntu-16-amd64 --encrypted-data-key eyJjaXBoZXJ0ZXh0IjoiSFVBS1VxTFFzUVhVRytTdElxTENDS3BjQjZ5Qm9HWlMxOVU9IiwiaXYiOiIxVXdNeTFTNG9odHVOWmJPIiwidmVyc2lvbiI6IjQuMC4wIiwiaGFuZGxlIjoiMWU5MzNkY2QtYjczMi00MDY3LWEyNTUtZDg5MzMxMTdmZGZmIn0= --encryption-key crn:v1:bluemix:public:kms:us-south:a/823bd195e9fd4f0db40ac2e1bffef3e0:2479bd12-1e8e-4506-88d9-bdb9512ac317:key:404f662d-1e18-40b1-aabf-d6c25bca22ea
* ibmcloud is image-create my-image-from-volume --source-volume r006-c95c2317-6336-45b4-b67d-087312895a4e
* ibmcloud is image-create my-image-from-volume --source-volume r006-c95c2317-6336-45b4-b67d-087312895a4e --encryption-key-volume crn:v1:bluemix:public:kms:us-south:a/823bd195e9fd4f0db40ac2e1bffef3e0:2479bd12-1e8e-4506-88d9-bdb9512ac317:key:404f662d-1e18-40b1-aabf-d6c25bca22ea
* ibmcloud is image-create my-image-from-volume --source-volume r006-c95c2317-6336-45b4-b67d-087312895a4e --deprecate-at "2023-03-01T00:45:00Z" --obsolete-at "2023-03-02T00:50:00Z"







 Command options
Protecting your image build 

You can now use Hyper Protect Secure Build to build a trusted container image within a secure enclave that is provided by IBM Cloud Hyper Protect Virtual Servers for VPC. For more information, see [Hyper Protect Secure Build](https://cloud.ibm.com/docs/vpc?topic=vpc-about-hpsb).

You can securely build your own image, which you can then use with [bring your own image](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-byoi).

To do this you use the IBM Cloud® Hyper Protect Virtual Servers Secure Build Server (SBS) functionality to sign your applications and also to sign and encrypt the registration definition for the deployment.

When you build your image securely, you can validate your build code and reassure your users of the integrity level of their applications.



 Deploying the Secure Build Server as a Hyper Protect Virtual Server 

To deploy the SBS:



1. Install the [CLI and the hpvs plug-in](https://cloud.ibm.com/docs/hpvs-cli-plugin).
2. Copy the following registration definition for the SBS into a file named secure_build.asc. This file is an encrypted and signed registration definition file. It contains metadata such as the repository name and the credentials to pull and deploy the SBS image on a Hyper Protect Virtual Servers instance:

-----BEGIN PGP MESSAGE-----
Comment: https://gopenpgp.org
Version: GopenPGP 2.5.0

wcFMAxpkEC0f/4+uAQ/9GcamI6ST3+6jXg2QrLXqzBD/P/U4ob5kcAQ4ZWnSP9mQ
aAnebaejgxX6uAuWJbwHJD0kxJKxbzGXzwtoFfztQNkXZxhvpj80/O1EH8sOSv4z
For information about creating secure execution-based images, [IBM Secure Execution for Linux](https://www.ibm.com/docs/en/linux-on-systems?topic=virtualization-introducing-secure-execution-linux).

For Linux images, the Ed25519 SSH key type can be used only if the SSH server for the operating system supports this key type. For more information, see [Getting started with SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys).

Complete the following steps to make sure that you can successfully deploy your own Linux custom image in the IBM Cloud VPC infrastructure environment. Keep in mind that you can't create an image from an encrypted boot volume (image from a volume) that is not 100 GB. The operation is blocked.



 Step 1 - Start with a single image file in qcow2 or VHD format 

If you're creating your own custom Linux-based image, begin with a single image file in qcow2 or VHD format. It might be helpful to begin with a cloud-enabled vendor image.

Kernel logs are important in debugging boot related issues. To ensure kernel logs are printed to the serial console, use the console=ttyS0 kernel command line argument. In addition, the nomodeset and nofb kernel parameters are used to resolve display-related issues during the boot process for older kernels that were released before mid 2021. The newer kernels use the video mode setting into the kernel.





 Step 2 - Check for virtio drivers 



1. Make sure that virtio drivers are installed on your operating system image, along with any code that is needed by virtio. Virtio network drivers are required to enable networking. Check whether virtio drivers are installed in the kernel, by running the following command:

grep -i virtio /boot/config-$(uname -r)

Look for VIRTIO_BLK and VIRTIO_NET in the output. If those lines are not present, then the virtio driver is not built into the kernel.
2.
Create an image with a POST /images request and pass the boot volume ID of the instance that you created in [Step 1](https://cloud.ibm.com/docs/vpc?topic=vpc-create-ifvifv-create-instance) as source volume. See the following example:

curl -X POST "$vpc_api_endpoint/v1/images?version=2021-05-20"
$iam_token" -d
{
"name": "test-ifv-boot-volume",
"source_volume": {
"id": "4fec84ef-baf9-405d-bf3b-9d5a60e068f7"
}
}

In the example response, source_volume indicates the boot volume that is used to create the image. Also, notice that the image encryption appears as none because the source volume used the default IBM-managed encryption. If you [used you own root key](https://cloud.ibm.com/docs/vpc?topic=vpc-create-ifvifv-use-crk), the response would show user-managed instead.

{
"created_at": "2021-05-20T00:05:13.873893Z",
"crn": "crn:[...]",
"encryption": "none",
"file": {},
"href": "https://us-south.iaas.cloud.ibm.com/v1/images/4fec84ef-baf9-405d-bf3b-9d5a60e068f7",
"id": "4fec84ef-baf9-405d-bf3b-9d5a60e068f7",
"name": "test-ifv-boot-volume",
"operating_system": {
"architecture": "amd64",
ibmcloud hpvs registration-create [--repository-name REPO-NAME] [--cr-username USER-NAME --cr-pwd-path FILE-PATH | --no-auth] [--allowed-env-keys ENV-KEYS | --no-env] [--image-key-id IMAGE-KEY-ID] [--fingerprint FINGERPRINT] [--image-key-public-path PUBLIC-KEY] [--registration-key-private-path PRIVATE-KEY-PATH] [--registration-key-public-path PUBLIC-KEY-PATH] [--gpg-passphrase-path PASS-PHRASE] [--cap-add CAPABILITIES] [--isv-secrets ISV-SECRETS | --no-isv-secrets]

If you enter the command without any parameters:

ibmcloud hpvs registration-create

You are prompted to enter all the parameters.

If image is in ICR, the fingerprint of the gpg key that was used to sign the image must be provided when you are prompted for the "Fingerprint", and path to the public key with which it is signed needs to be provided when you are prompted for the "Path to the file containing the image public key".

If the container registry does not require authentication, set the -no-auth parameter to prevent prompting. If no environment parameters are required, set the -no-env parameter, for example:

ibmcloud hpvs registration-create --no-env --no-auth



 Command options 

--repository-name REPO-NAME
: Is the fully qualified name for the repository.

--cr-username USER-NAME
: Is the username for the login on the container repository. It can be any string of 4 - 30 characters.

--cr-pwd-path FILE-PATH
: Is the path to the file that contains the container repository password.

To ensure there are no trailing spaces in the file path, you can specify it as vi -b file_name , :set noeol, :wq.

--no-auth
: Is the parameter that must be set if the image does not require authorization to download.
For more information, see [Managing your API keys](https://cloud.ibm.com/docs/account?topic=account-userapikeyuserapikey). 
 crkCrn Specify the [Cloud Resource Name (CRN)](https://cloud.ibm.com/docs/account?topic=account-crn) for the root key that you used to wrap your data encryption key. To locate and copy your root key CRN, go to the [Key Protect service instance ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/resources), hover over your root key, click the ellipsis (...) on the far right side of the screen, then select the "View CRN" option and click the copy icon. 
 wrappedDek Specify the cipher text that is associated with your wrapped data encryption key that you used to encrypt your image. For more information, see [Wrapping keys by using the API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keyswrap-keys).
To create secure execution based custom images by using the Cloud Object Storage option, see [Preparing the workload](https://www.ibm.com/docs/en/linux-on-systems?topic=tasks-prepare-workload). For information about creating secure execution based images, see [IBM Secure Execution for Linux](https://www.ibm.com/docs/en/linux-on-systems?topic=overview-introducing-secure-execution-linux).

The IBM Wazi as a Service (Wazi aaS) custom image can be created only by using IBM Wazi Image Builder, which is a separately orderable product from [IBM Passport Advantage](https://www.ibm.com/software/passportadvantage/). There are additional requirements to order and use Wazi Image Builder. The image cost is the premium applied to cover the cost of technologies that allows for z/OS dev and test images to run on IBM Z hardware in IBM’s cloud infrastructure as a service layer. The z/OS Wazi aaS custom image must meet the following requirements:



* qcow2 format
* z/OS 2.4 or z/OS 2.5 operating system
* See [Hardware and software requirements](https://www.ibm.com/docs/en/wazi-aas/1.0.0?topic=builder-hardware-software-requirements) for required PTF fixes on z/OS and other IBM software products to allow them to run as a guest of IBM Z Hypervisor as a Service (zHYPaaS).



For more information, see [Bringing your own image with Wazi Image Builder](https://www.ibm.com/docs/en/wazi-aas/1.0.0?topic=bringing-your-own-image-wazi-image-builder).



 Requirements 

All custom images must meet the following requirements：



* Contain a single file or volume
* Is in qcow2 or vhd format
* Is cloud-init enabled
* The operating system is supported as a [stock image](https://cloud.ibm.com/docs/vpc?topic=vpc-about-imagesstock-images)
However, for unsigned images, a digest is required. Complete the following steps to get the digest:



1. Log in to the container registry dashboard.
2. Open the image.
3. Click Tag, and then click Digest.



After you get the digest, add this digest in the docker-compose.yaml file. The following is an example:

services:
<imagename>:
image: s390x/redis@sha256:db467ab5c53bdeef65762a7534e26fecb94a0f218bd38afd2eaba1a670c472b1





 Images described by Pod descriptors 

Container images described by Pod descriptors can be validated by RedHat Simple Signing.

If the image is referenced by a digest, the service allows its usage without additional checks.

Images without a digest need a GPG key to be validated. The key is transferred in base64 encoded binary format that can be created. For example:

gpg --export ${KEY_ID} | busybox base64 -w0

This key is conveyed via the rhs subsection of the images section. This section is a map with the image identifier as the key and the GPG key in the publicKey field:

Example:

images:
rhs:
OCI-image-identifier:
publicKey: abcdef







 The workload - volumes subsection 

The volumes section needs to be provided in the contract only if a data volume is attached to the instance at the time of creation. The information provided in this section is used to mount the attached data volume (provided by the user) and is later encrypted using the "seeds" provided in the workload and env sections. You can provide any path of your choice for the "mount" field. The path provided by the user is used internally to mount the data volume. The mount path provided in the contract must match the path provided under the volumes section of the docker-compose.yaml file, so that all the data associated with the container workload is stored in this data volume.
* To use an encrypted storage class, NetApp Volume Encryption (NVE) must be enabled on your storage system by using either the NetApp ONTAP onboard key manager or a supported (off-box) third-party key manager, such as IBM 's TKLM key manager. To enable the onboard key manager, run the netapp1::> security key-manager onboard enable command. For more information about configuring encryption, see the [ONTAP 9 Security and Data Encryption documentation](https://docs.netapp.com/us-en/ontap/security-encryption/index.html).



Review the Satellite storage classes for NetApp ONTAP-NAS. You can describe storage classes in the command line with the oc describe sc <storage-class-name> command.



NetApp ONTAP-NAS storage class reference.

 Storage class name Type File system IOPs Encryption Reclaim policy 

 sat-netapp-file-goldDefault ONTAP-NAS NFS no QoS limits Encryption disabled. Delete 
 sat-netapp-file-gold-encrypted ONTAP-NAS NFS no QoS limits Encryption enabled. Delete 
 sat-netapp-file-silver ONTAP-NAS NFS User defined QoS limit. Encryption disabled. Delete 
 sat-netapp-file-silver-encrypted ONTAP-NAS NFS User defined QoS limit. Encryption enabled. Delete 
 sat-netapp-file-bronze ONTAP-NAS NFS User-defined QoS limit. Encryption disabled. Delete 
 sat-netapp-file-bronze-encrypted ONTAP-NAS NFS User-defined QoS limit. Encryption enabled. Delete 







 Getting help and support for NetApp ONTAP-NAS 

If you run into an issue with NetApp Trident, you can visit the [NetApp support page](https://netapp-trident.readthedocs.io/en/stable-v20.04/support/support.html).
To avoid possible retrieval or use of the wrong image by name, specify the image ID instead. For more information, see [image data source](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/is_image).





 Deleting a custom image in a private catalog 

A custom image can't be deleted, reused for a different version, or reused for a different product offering while that custom image is managed from a private catalog.

Deleting the private catalog that contains product offerings directly does not remove the offerings immediately. The custom images that are managed by the private catalog continue to be managed by the catalog for 7 days beyond the date that you deleted the private catalog.

If you want to immediately reuse or delete the custom image, make sure that you first remove that custom image from the associated version in the private catalog product offering or delete the product offering.

To delete a published or shared custom image from the private catalog, see the tutorial [Deprecating a private product](https://cloud.ibm.com/docs/account?topic=account-deprecate-product&interface=ui). To delete the entire private catalog, see the tutorial [Deleting a private catalog by using the console](https://cloud.ibm.com/docs/account?topic=account-restrict-by-user&interface=uidelete-private-catalog-ui).





 Instance groups and private catalog 

You can use a custom image in a private catalog to create an instance group. However, you must first create a service-to-service policy to globalcatalog-collection.instance.retrieve before you can create the instance group. For more information, see [Using a custom image in a private catalog with an instance group](https://cloud.ibm.com/docs/vpc?topic=vpc-private-catalog-image-instance-group&interface=ui).

The information about which custom image that is in a private catalog that was used for provisioning an instance doesn't persist across all IBM Cloud VPC resources. Information about the custom image in a private catalog isn't available on Snapshot for VPC or Image from Volume.