vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Your responsibilities when you are using Container Registry 

Learn about the management responsibilities and terms and conditions that you have when you use IBM Cloud® Container Registry.

For a high-level view of the service types in IBM Cloud and the breakdown of responsibilities between the customer and IBM for each type, see [Shared responsibilities for IBM Cloud offerings](https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilities).

Review the following sections for the specific responsibilities for you and for IBM when you use IBM Cloud Container Registry. For the overall terms of use, see [IBM Cloud Terms and Notices](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-terms).



 Incident and operations management 

Incident and operations management includes tasks such as monitoring, event management, high availability, problem determination, recovery, and full state backup and recovery.



Table 1. Responsibilities for incident and operations
The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.

 Task IBM Responsibilities Your Responsibilities 

 Data incidents. It is the responsibility of IBM to inform you if your data is lost. 
 Ensure that the application is available. It is the responsibility of IBM to inform you if the application is not available. 
 Track events. It is the responsibility of IBM to ensure that IBM Cloud Activity Tracker is tracking events. It is your responsibility to monitor events by using IBM Cloud Activity Tracker to ensure that your application is being accessed only by users with the correct authority. It is also your responsibility to ensure that an Activity Tracker instance is set up to receive events. For more information, see [Auditing events for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-at_events). 







 Change management 

Change management includes tasks such as deployment, configuration, upgrades, patching, configuration changes, and deletion.



Table 2. Responsibilities for change management
The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task.
Why can't I log in to Container Registry? 

Logging in to IBM Cloud® Container Registry fails.

  What’s happening 

The [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) command fails.

  Why it’s happening 

The following alternatives are possible causes:



*  The container-registry CLI plug-in is out of date and needs updating.
*  Docker is not installed on your local computer, or is not running.
*  Your IBM Cloud login credentials expired.



  How to fix it 

You can fix this problem in the following ways:



*  Upgrade to the most recent version of the container-registry CLI plug-in, see [Updating the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_update).
*  Ensure that Docker is installed on your computer. If it is already installed, restart the Docker daemon.
*  Rerun the ibmcloud login command to refresh your IBM Cloud login credentials.
An end of support date is not available yet.



 Targeting the global registry 

You can target the global registry by running the [ibmcloud cr region-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_region_set) command.



1. To target the global registry, run the following command.

ibmcloud cr region-set global
2. To log your local Docker daemon into the global registry, run the [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) command.

Container Registry supports other clients as well as Docker. To log in by using other clients, see [Accessing your namespaces interactively](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive).









 Local regions 

Regional instances of Container Registry are available by using the [domain names](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_domain_name) that are shown in the following table.



Table 4. Domain names for local regions

 Local registry region Domain name Private domain name Deprecated domain name 

 ap-north jp.icr.io private.jp.icr.io Not applicable 
 ap-south au.icr.io private.au.icr.io registry.au-syd.bluemix.net 
 br-sao br.icr.io private.br.icr.io Not applicable 
 ca-tor ca.icr.io private.ca.icr.io Not applicable 
 eu-central de.icr.io private.de.icr.io registry.eu-de.bluemix.net 
 jp-osa jp2.icr.io private.jp2.icr.io Not applicable 
 uk-south uk.icr.io private.uk.icr.io registry.eu-gb.bluemix.net
For Container Registry, the server name is <region>.icr.io. For example, us.icr.io. For [Docker Hub](https://hub.docker.com/), the value is https://index.docker.io/v1/. 
 --username Enter the username to access the registry server. For Container Registry, it is iamapikey. For Docker Hub, it is your Docker ID. 
 --password Enter the password. For Container Registry, the password is your API key. For Docker Hub, you can use your Docker Hub password or an [access token](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryaccess-private-docker-hub). 









 Authorizing access to Container Registry with service ID 

Before you can add access to a service ID in a different account, you must first authorize access to the service ID.

When you create a service ID, you can restrict access to a regional IBM Cloud Container Registry or even a specific namespace within that IBM Cloud Container Registry account.



 Authorizing access to Container Registry with service ID from the console 

To pull or push images from or to IBM Cloud Container Registry, you must create a service ID, create an access policy for the service ID, and then create an API key to store the credentials.



 Step 1 Create or identify a service ID and authorize it to the IBM Cloud Container Registry service 



1. Launch [Access (IAM) Overview](https://cloud.ibm.com/iam/overview).
2. Select Service IDs.
3. If you have a Service ID that you want to use, select it. If not, select Create, enter a name and description, and click Create.
4. From the Service ID page, from the Access policies section, select Assign access.
5. From the Assign service ID additional access section,



1. Select Container Registry for type of access. Click Next.
2. Select the type of access: All resources or Specific resources.
(https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-add-namespace) for assistance.







 Build and push an image 

To [build a container image and push it to IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_images_registry_images_creating), you require an application and a

Dockerfile. To get the application and the Dockerfile, and the other artifacts that you require, clone the [GitHub repository](https://github.com/IBM/registry-va-workflow) that is associated with this tutorial. For the rest of this tutorial, ensure that you run all commands from the directory of the cloned repository.



1. To build the image, run the following command:

docker build -t us.icr.io/<my_namespace>/hello-world:1 .

Docker must be running on your computer or the docker commands fail. IBM Cloud Container Registry supports other clients as well as Docker. To log in by using other clients, see [Accessing your namespaces interactively](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive).
2. Log your local Docker daemon into IBM Cloud Container Registry by running the [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login) command:

ibmcloud cr login

If you have a problem when you try to log in, see [Why can't I log in to Container Registry?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-login) for assistance.
3. Push the image by running the following command:

docker push us.icr.io/<my_namespace>/hello-world:1
4. Confirm that your image uploaded successfully by running the following command:

ibmcloud cr images
* [Updating the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_update)



* [Updating container-registry CLI plug-in version 1.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_update_v1)
* [Updating container-registry CLI plug-in version 0.1](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_update_v0)



* [Uninstalling the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_uninstall)
* [Planning namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_setup_cli_namespace_plan)



* [User permissions for working with namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_setup_cli_namespace_plan_perm)



* [Setting up a namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_setup)
* [Assigning existing namespaces to resource groups](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_namespace_assign)
* [Removing namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_remove)







 Setting up Container Registry as a private registry on Red Hat OpenShift
jp-osa jp2.icr.io 
 uk-south uk.icr.io 
 us-south us.icr.io 



For more information about how to use IBM Cloud Container Registry in a Continuous Delivery pipeline, see [Using a private image registry](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-custom_docker_imagesprivate_image_registry).

Examples of how to authenticate automatically with the registry are provided for the following clients:



* [Buildah](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_apikey_auth_example_other_buildah)
* [Docker](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_apikey_auth_docker)
* [Podman](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_apikey_auth_example_other_podman)
* [Skopeo](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_apikey_auth_other_example_skopeo)





 Using Buildah to authenticate with the registry 

You can use Buildah to authenticate with the registry so that you can push and pull images to and from the registry.

Use the API key and [domain](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_apikey_auth) to log in to the registry by running the following Buildah command, replace <apikey> with the API key and <registry_domain> with the domain:

buildah login -u iamapikey -p <apikey> <registry_domain>





 Using Docker to authenticate with the registry 

You can use Docker to authenticate with the registry so that you can push and pull images to and from the registry.
For example, IBM Cloud Container Registry and Docker Hub are container registries. A container registry can be public or private. A container registry that is public does not require credentials to access. In contrast, accessing a private registry does require credentials.

You must be within the context of a [project](https://cloud.ibm.com/docs/cli?topic=cli-clicli-project) before you use registry commands.

For more information about accessing registries, see [Adding access to a private container registry](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registry).

To see CLI help for the registry commands, run ibmcloud ce registry -h.

Beginning with CLI version 1.42.0, defining and working with secrets in the CLI is unified under the secret command group. See [ibmcloud ce secret](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-secret-create) commands. Use the --format option to specify the category of secret, such as basic_auth, generic, ssh, tls, or registry. While you can continue to use the registry command group, take advantage of the unified secret command group. To create a secret to access a container registry, use the [ibmcloud ce secret create --format registry](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-secret-create) command. To learn more about working with secrets in Code Engine, see [Working with secrets](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secret).



 ibmcloud ce registry create 

Create an image registry access secret.

ibmcloud ce registry create --name NAME (--password PASSWORD | --password-from-file PASSWORD_FILE | --password-from-json-file) [--email EMAIL] [--output OUTPUT] [--quiet] [--server SERVER] [--username USERNAME]



 Command Options 

-n, --name
If you do not do this step, you must run ibmcloud login, ibmcloud cr login, docker pull, and docker push commands with sudo or as root.



IBM Cloud Container Registry supports other clients as well as Docker. To log in by using other clients, see [Accessing your namespaces interactively](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive).

You can now [set up your own namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespace&interface=uiregistry_namespace_setup) in IBM Cloud Container Registry.





 Updating the container-registry CLI plug-in 

You might want to update the container-registry CLI plug-in periodically to use new features.



 Updating container-registry CLI plug-in version 1.0 

To update version 1.0 of the Container Registry CLI, run the following command:

ibmcloud plugin update container-registry





 Updating container-registry CLI plug-in version 0.1 

To update version 0.1 of the Container Registry CLI, run the following command, where <version_number> is the number of the version of the CLI.

Version 0.1 of the Container Registry CLI is deprecated, see [All releases of Container Registry plug-in 0.1 are deprecated](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes15sep2022_v0).

ibmcloud plugin install container-registry -v <version_number>

For example, to update the CLI to version 0.1.584, run the following command:

ibmcloud plugin install container-registry -v 0.1.584







 Uninstalling the container-registry CLI plug-in 

If you no longer need the container-registry CLI plug-in, you can uninstall it.

To uninstall the container-registry CLI plug-in, run the following command:
For more information, see [Managing IAM access with Cloud Identity and Access Management](https://cloud.ibm.com/docs/Registry?topic=Registry-iamiam), [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser), and [Granting access to Container Registry resources tutorial](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_accessiam_access).





 7 August 2018 

Exemption policies available in Vulnerability Advisor
: If you want to manage the security of an IBM Cloud organization, you can use your policy setting to determine whether an issue is exempt or not. You can use Portieris to ensure that deployment is allowed only from images that contain no security issues after accounting for any issues that are exempted by your policy.

For more information, see [Setting organizational exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_managing_policy).





 25 July 2018 

IBM Cloud Activity Tracker available for Vulnerability Advisor
: Use the IBM Cloud Activity Tracker service to track how users and applications interact with the Container Registry service in IBM Cloud.

For more information, see [Auditing events for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-at_events).





 12 July 2018 

Vulnerability Advisor API version 3
: Version 3 of the API changes the behavior of the API endpoints that are used to list exemptions. You must check that your use of the API does not rely on the behavior of version 2.

For more information, see [Vulnerability Advisor for IBM Cloud Container Registry](https://cloud.ibm.com/apidocs/container-registry/va).





 31 May 2018 

Use Helm for Passport Advantage images
: Import IBM software that is downloaded from [IBM Passport Advantage Online for customers](https://www.ibm.com/software/passportadvantage/pao_customer.html) and packaged for use with Helm into your Container Registry namespace.





 21 March 2018 

Container Scanner
For more information, see [Accessing IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_access). For more information about Registry token deprecation, see [IBM Cloud Container Registry Deprecates Registry Tokens for Authentication](https://www.ibm.com/cloud/blog/announcements/ibm-cloud-container-registry-deprecates-registry-tokens-for-authentication).

Ingress change logs
: Updated the [Ingress ALB change log](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog) for versions 0.48.1_1541_iks, 0.47.0_1540_iks, and 0.43.0_1539_iks. Version 0.45.0_1482_iks is removed.

ALB OAuth Proxy
: Updated the version change log for the [ALB OAuth Proxy add-on](https://cloud.ibm.com/docs/containers?topic=containers-alb-oauth-proxy-changelog).





 16 August 2021 

Worker node versions
: Worker node fix pack update change log documentation is available. For more information, see [Version change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog).





 12 August 2021 

Istio add-on change log
: [Version 1.9.7](https://cloud.ibm.com/docs/containers?topic=containers-istio-changelog196) of the Istio managed add-on is released.





 10 August 2021 

Ingress change logs
: Updated the [Ingress ALB change log](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog) for versions 0.48.1_1465_iks, 0.47.0_1480_iks, and 0.45.0_1482_iks.
Container Registry CLI change log 

In this change log, you can learn about the most recent changes, improvements, and updates for the IBM Cloud® Container Registry CLI.

For more information about how to update the Container Registry CLI, see [Updating the container-registry CLI plug-in](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespaceregistry_cli_update).

Version 0.1 of the Container Registry CLI is deprecated, see [All releases of Container Registry plug-in 0.1 are deprecated](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes15sep2022_v0).



 Version 1.1.0 

Version 1.1.0 of the CLI was released on 7 July 2023.

This release has the following changes:



* Fixes a Vulnerability Advisor versioning defect that affected some commands.







 Version 1.0.11 

Version 1.0.11 of the CLI was released on 19 June 2023.

This release has the following changes:



* The backup default Vulnerability Advisor version is now version 4.
* Vulnerability remediations.
* Updated translations.







 Version 1.0.8 

Version 1.0.8 of the CLI was released on 5 April 2023.

This release has the following changes:



* Vulnerability remediations.
* Updated translations.
* Updated error messages.







 Version 0.1.587 

Version 0.1.587 of the CLI was released on 26 January 2023.

This release has the following changes:



* Vulnerability remediations.







 Version 1.0.6 

Version 1.0.6 of the CLI was released on 25 January 2023.

This release has the following changes:



* Vulnerability remediations.







 Version 1.0.5 

Version 1.0.5 of the CLI was released on 5 December 2022.

This release has the following changes:



* Vulnerability remediations.
* Updated translations.
If you started to use IBM Cloud Container Registry before the availability of [IAM API key policies in Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-25feb2019) in February 2019, you must ensure that you are using IAM access policies to manage access to the Container Registry service. For more information, see [IAM access policies are required from 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_policy).

ibmcloud cr iam-policies-status





 ibmcloud cr image-digests (ibmcloud cr digests) 

Lists all images, including [untagged](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_untagged) images, in your IBM Cloud account. This command returns the [digest](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_digest) in its long format. When you're using the digest to identify an image, always use the long format.

If you want to list tagged images only, run the [ibmcloud cr image-list](https://cloud.ibm.com/docs/cli?topic=cli-containerregclibx_cr_image_list) command.

You can refer to an image by using a combination of the Repository column (repository) and the Digest column (digest) separated by an at (@) symbol to create the image name in the format repository@digest. You can also refer to the image name by using a combination of the content of the Repository column (repository) and one of the tags in the Tags column (tag) separated by a colon (:) to create the image name in the format repository:tag.

From version 1.0.0 of the container-registry plug-in, you can choose whether to run the ibmcloud cr vulnerability-assessment command in either version 3 (the default) or version 4 of Vulnerability Advisor.
* namespace: Is the [namespace created](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgs_registry_namespace_add) in the IBM Cloud Container Registry, see also step 4 of this procedure.
* name: Is the unique name for the repository (one repository can have multiple images that differ by the tag).
* tag: Is the unique tag for the image.





3. After you create your image, check for vulnerable components. Most containers are built by using a collection of open source components that can suffer from known vulnerabilities. It is your responsibility to use scanning tools to identify if any of the components you include in the build are vulnerable. Scan the components before you distribute the image, for example, with [Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=va-va_index).
4. Push the image to the container registry you choose. You can use Docker Hub (with Docker Content Trust enabled), or ICR. To push the image to ICR, you must first sign the image using Red Hat signing. For more information, see [Sign your image by using Red Hat simple signing](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-byoisign_image_redhat).
5. Follow the [backup instructions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontenttrustedcontent_backupkeys) to back up your keys after you push the image.







 Sign your image by using Red Hat simple signing 

You must provide the "Fingerprint" and the "Path to the public key" that you used when you signed the image by using Red Hat signing when you run the hpvs registration-create command, and are prompted for the "Fingerprint", and the "Path to the file containing the image public key".

Complete the following steps to sign the images:



1. Create a batch file and add the following content to it:

Key-Type: RSA
Key-Length: 4096