vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Create a custom image](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-byoibyoi_create).
2. [Creating a registration definition file by using the CLI](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-byoibyoi_regdef_cli).
3. [Use your OCI image to provision a Hyper Protect Virtual Server](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-byoibyoi_provision).





 Prerequisites 



* Your custom Linux-based image must meet these requirements:



* In the OCI Image format. Hyper Protect Virtual Servers supports only Linux-based OCI Images, which are built for the IBM LinuxONE and IBM Z platform (s390x architecture).
* Upload the OCI image to a container registry. You can use the following container registries:



* The [IBM Cloud® Container Registry](https://cloud.ibm.com/kubernetes/catalog/registry). You must use Red Hat signing when using IBM Cloud® Container Registry (ICR). Follow the steps listed in [Signing images for trusted content](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontent).

The Notary v1 service that supports Docker Content Trust and docker trust commands in Container Registry is discontinued from 1 November 2021. For more information, see [Release notes for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-01nov2021). Any existing ICR images that were signed by using DCT, must be re-signed by using Red Hat.
* [Docker Hub](https://hub.docker.com/) where the images are and signed by using [Docker Content Trust](https://docs.docker.com/engine/security/trust/content_trust/).
: Yes, you can [edit the existing IAM policy of the service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidsupdate_serviceid) that restricts the Reader service access role to that regional registry or a registry resource such as a namespace. Before you can customize registry IAM policies, you must [enable IBM Cloud IAM policies for IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).

Want to make your registry credentials even more secured Ask your cluster admin to [enable a key management service provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) in your cluster to encrypt Kubernetes secrets in your cluster, such as the image pull secret that stores your registry credentials.

Can I pull images in a Kubernetes namespace other than default?
: Not by default. By using the default cluster setup, you can deploy containers from any image that is stored in your IBM Cloud Container Registry namespace into the default Kubernetes namespace of your cluster. To use these images in any other Kubernetes namespaces or other IBM Cloud accounts, [you have the option to copy or create your own image pull secrets](https://cloud.ibm.com/docs/containers?topic=containers-registryother).

Can I pull images from a different IBM Cloud account?
: Yes, create an API key in the IBM Cloud account that you want to use. Then, in each namespace of each cluster that you want to pull images from the IBM Cloud account, create a secret that holds the API key. For more information, [follow along with this example that uses an authorized service ID API key](https://cloud.ibm.com/docs/containers?topic=containers-registryother_registry_accounts).

To use a non-IBM Cloud registry such as Docker, see [Accessing images that are stored in other private registries](https://cloud.ibm.com/docs/containers?topic=containers-registryprivate_images).

Does the API key need to be for a service ID?
Setting up the Container Registry CLI and namespace 

To manage your Docker images in IBM Cloud® Container Registry, you must install the container-registry CLI plug-in and create a

namespacein aresource group.

Do not put personal information in your container images, namespace names, description fields, or in any image configuration data (for example, image names or image labels).

To add and remove namespaces, you must have the Manager role at the account level, see [Access roles for configuring IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).

Before you begin, install the IBM Cloud CLI, see [Getting started with the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).



 Installing the container-registry CLI plug-in 

Install the container-registry CLI plug-in so that you can use the command line to manage your namespaces and Docker images in IBM Cloud Container Registry.



1. Install the container-registry CLI plug-in by running the following command:

ibmcloud plugin install container-registry

For more information about installing plug-ins, see [Extending IBM Cloud CLI with plug-ins](https://cloud.ibm.com/docs/cli?topic=cli-plug-ins).
2. Optional: [Configure your Docker client to run commands without root permissions](https://docs.docker.com/engine/install/linux-postinstall/). If you do not do this step, you must run ibmcloud login, ibmcloud cr login, docker pull, and docker push commands with sudo or as root.



IBM Cloud Container Registry supports other clients as well as Docker. To log in by using other clients, see [Accessing your namespaces interactively](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive).
The existing registry.bluemix.net domain names are deprecated, but you can continue to use them until the end of support date. An end of support date is not available yet.

For more information, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions) and [Introducing New IBM Cloud Container Registry Domain Names](https://www.ibm.com/cloud/blog/announcements/introducing-new-ibm-cloud-container-registry-domain-names).

Signatures apply to the whole image name, which includes the domain name. If you're using content trust, you must add new signatures so that you can use content trust under the new domain name.

For more information about signing images, see [Signing images for trusted content](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontentregistry_trustedcontent).

Adding IAM API key policies to control access to resources
: The new cluster image pull secrets for the icr.io domains are authorized by using an Cloud Identity and Access Management (IAM) API key. Therefore, if you want more control over access to your Container Registry resources, you can add IAM access policies. For example, you can change the API key policies in the cluster's pull secret so that images are pulled from a certain registry region or namespace only.

For more information, see [Understanding how to authorize your cluster to pull images from a registry](https://cloud.ibm.com/docs/containers?topic=containers-registrycluster_registry_auth).

New region in ap-north
: A new region is available in ap-north. You can use the new region by using the domain name jp.icr.io.

For more information, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).





 21 February 2019 

Automating access to your namespaces
: Using tokens to automate pushing and pulling Docker images to and from your namespaces is deprecated.
You can use [Tekton pipelines](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-pipeline_container_imagespipeline_tekton_images) instead.

For more information, see [IBM Cloud Container Registry is Deprecating Container Builds](https://www.ibm.com/cloud/blog/announcements/ibm-cloud-container-registry-deprecating-container-builds).





 27 August 2020 

Setting exemption policies by digest
: When you want to set up an exemption policy, you can set the scope by namespace, repository, digest, or tag. You can set an exemption policy by running the [ibmcloud cr exemption-add](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add) command.

For more information, see [Setting organizational exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_managing_policy).





 12 August 2020 

Using UAA tokens is discontinued
: From 12 August 2020, UAA tokens are no longer accepted for authentication. At the moment, registry tokens continue to be accepted, but their use is deprecated.

For more information, see [Announcing End of IBM Cloud Container Registry Support for UAA Tokens](https://www.ibm.com/cloud/blog/announcements/announcing-end-of-ibm-cloud-container-registry-support-for-uaa-tokens).





 30 July 2020 

New access roles are required for Vulnerability Advisor exemption policies
: If you want to manage your Vulnerability Advisor exemption policies for security issues, depending on the task that you want to complete, you might have to update your access role.

For more information, see [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).





 29 July 2020 

You can set permissions so that access to resources within a namespace can be configured at the resource group level
* [19 November 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-19nov2020)



* [You can use Portieris to enforce container image security](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes19nov2020_portieris)



* [21 October 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-21oct2020)



* [Find out about the usage on your account by using platform metrics](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes21oct2020_metrics)



* [6 October 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-06oct2020)



* [Container Registry container builds are deprecated](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes06oct2020_build)



* [27 August 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-27aug2020)



* [Setting exemption policies by digest](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes27aug2020_digest)



* [12 August 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-12aug2020)



* [Using UAA tokens is discontinued](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notes12aug2020_tokens)



* [30 July 2020](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-30jul2020)
Frequently asked questions about Container Registry and Vulnerability Advisor 

Frequently asked questions (FAQs) about IBM Cloud® Container Registry and Vulnerability Advisor.



 Frequently asked questions about Container Registry 



 How do you list public images? 

To list public images, run the following ibmcloud commands to target the global registry and list the public images that are provided by IBM:

ibmcloud cr region-set global

ibmcloud cr images --include-ibm





 What tools can I use to build and push images? 

You can use Docker and non-Docker tools to build and push images to the registry. You can use non-Docker tools that support

OCI container imageformat and protocol. To log in by using other clients, see [Accessing your namespaces interactively](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive).





 How many namespaces can you have? 

You can have 100 registry

namespacesin each region.





 Can I rename a namespace? 

You can't rename a

namespace. If you want to change the name of the namespace, you must create a namespace with the new name and transfer its data. To transfer its data, you can copy the contents of the existing namespace into the namespace that you created.

If you don't want to transfer data manually, you can create a script for this action by using the [ibmcloud cr image-tag](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_tag) command. For example, you can use the following script, where <old_namespace> is the existing namespace and <new_namespace> is the namespace that you created:

IMAGES=$(icr images --restrict <old_namespace> --format "{{ .Repository }}:{{ .Tag }}")

for i in $IMAGES ; do
new=$(echo $i | sed "s|/<old_namespace>/|/<new_namespace>/|1")
Analyzing logs for Container Registry 

IBM Cloud® Container Registry generates platform services logs that are displayed in your logging instances.

For more information about how to configure logging instances to receive platform services logs, see [Configuring IBM Cloud service logs](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-config_svc_logs).

Most of the time when you work with IBM Cloud Container Registry you are pushing, pulling, or managing images. These interactions output results that either you or your automation, tools, or runtime receive; IBM Cloud Container Registry doesn't generate platform logs for them. IBM Cloud Activity Tracker provides a comprehensive list of events for auditing these interactions, see [Auditing events for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-at_events).

IBM Cloud Container Registry generates platform services logs that are displayed in your logging instances for the following specific cases:



* When IBM Cloud Container Registry runs scheduled retention policies for namespaces in your account.
* When IBM Cloud Container Registry calculates your account's registry traffic and average storage usage per hour for a region.





 Locations of platform services logs 

IBM Cloud Container Registry generates platform logs that are displayed in your logging instances. The following tables list the locations where the automatic collection of Container Registry service logs is enabled.



Table 1. The automatic collection of Container Registry service logs in the Americas locations

 Locations in Americas Are platform services logs available? 

 Dallas (us-south) Yes 
 Sao Paulo (br-sao) Yes 
 Toronto (ca-tor) Yes 





Table 2. The automatic collection of Container Registry service logs in the Asia Pacific locations

 Locations in Asia Pacific Are platform services logs available? 

 Osaka (jp-osa) Yes 
 Sydney (au-syd) Yes 
 Tokyo (jp-tok) Yes 





Table 3. The automatic collection of Container Registry service logs in the Europe locations

 Locations in Europe Are platform services logs available? 

 Frankfurt (eu-de) Yes 
 London (eu-gb) Yes 





Table 4. The automatic collection of Container Registry service logs for Global

 Location for Global Are platform services logs available?
* [How can I do TLS termination with LoadBalancer and Ingress services?](https://cloud.ibm.com/docs/containers?topic=containers-securitytls-termination-lb)



* [Persistent storage](https://cloud.ibm.com/docs/containers?topic=containers-securitystorage)
* [Monitoring and logging](https://cloud.ibm.com/docs/containers?topic=containers-securitymonitoring_logging)
* [Image and registry](https://cloud.ibm.com/docs/containers?topic=containers-securityimages_registry)
* [Container isolation and security](https://cloud.ibm.com/docs/containers?topic=containers-securitycontainer)



* [Should I set up a single-tenant or a multi-tenant cluster?](https://cloud.ibm.com/docs/containers?topic=containers-securitysingle-tenant-or-multi)



* [Storing personal information](https://cloud.ibm.com/docs/containers?topic=containers-securitypi)
* [Kubernetes security bulletins](https://cloud.ibm.com/docs/containers?topic=containers-securitysecurity_bulletins)



[Architecture and dependencies of the service](https://cloud.ibm.com/docs/containers?topic=containers-service-archservice-arch)



* [Classic cluster](https://cloud.ibm.com/docs/containers?topic=containers-service-archarchitecture_classic)



* [Non-VRF or VRF-enabled account with public cloud service endpoint only](https://cloud.ibm.com/docs/containers?topic=containers-service-archno-vrf-public-endpoint)
* [VRF-enabled account with private and public cloud service endpoints](https://cloud.ibm.com/docs/containers?topic=containers-service-archvrf-both-endpoints)
Troubleshooting Container Registry 

Answers to common troubleshooting questions about how to use IBM Cloud® Container Registry.



 Troubleshooting topics 

The following troubleshooting topics are available to help you:



 Troubleshooting CLI login 

Troubleshoot logging in problems.



* [Why can't I log in to Container Registry?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-login)
* [Why does the Container Registry login keep expiring?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-login-expire)
* [Why do commands fail saying that I'm not logged in?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-login-cloud)
* [Why do cr commands fail saying they’re not registered?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-login-error)
* [Why is Docker login on my Mac failing?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-docker-mac)







 Troubleshooting pull and push errors 

Troubleshoot pull and push problems.



* [Why can't I push or pull a Docker image?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-push-pull-docker)
* [Why is pulling images so slow?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-pull-performance)
* [Why am I getting Authorization required errors?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-auth-req)



* [Why am I getting an Unauthorized error when I'm using Code Engine?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-unauthorized-ce)



* [Why am I getting Access denied errors?]
As of 17 August 2021, the Registry subnets are no longer published. When you access IBM Cloud Container Registry over the public internet, you must not have any allowlist restrictions that are based on IP addresses in place. If you have any concerns about opening your allowlist, you can configure private access to IBM Cloud Container Registry by using the private IBM Cloud network, see [Securing your connection to Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_private).

In addition to the following regional subdomains, you must also allow traffic from your worker nodes to port 443 on all subdomains of icr.io in case of redirection to other subdomains for delivery optimization. You must allow: TCP port 443 FROM <each_worker_node_publicIP> TO .icr.io. If you use the deprecated domain names, you must allow those too.



Table 2. Addresses for Container Registry traffic

 IBM Cloud Kubernetes Service region Registry address 

 Global registry across IBM Cloud Kubernetes Service regions icr.io Deprecated: registry.bluemix.net 
 AP North jp.icr.io 
 AP South au.icr.io Deprecated: registry.au-syd.bluemix.net 
 EU Central de.icr.io Deprecated: registry.eu-de.bluemix.net 
 Osaka jp2.icr.io 
 Sao Paolo br.icr.io 
 Toronto ca.icr.io 
 UK South uk.icr.io Deprecated: registry.eu-gb.bluemix.net 
 US South us.icr.io Deprecated: registry.ng.bluemix.net 







 Allow outgoing network traffic from worker node to IAM 

Allow outgoing network traffic from your worker node to IBM Cloud Identity and Access Management (IAM). Your allowlist must be Layer 7 to allow the IAM domain name. IAM does not have specific IP addresses that you can allow. If your allowlist does not support Layer 7, you can allow all HTTPS network traffic on port 443.
ibmcloud iam user-policy-create <user_email> --service-name container-registry --region <region> --roles <roles> [--resource-type namespace --resource <namespace_name>]

The following table details actions that are mapped to operations on the service and to the service access roles for using Container Registry.



Table 5. Service actions and operations for using Container Registry

 Action Operation on service Role Status 

 container-registry.image.delete docker trust revoke Delete the signature for a container image.<br><br>[ibmcloud cr image-prune-untagged](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_image_prune_untagged) Delete all untagged images in your Container Registry account.<br><br>[ibmcloud cr image-rm](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_rm) Delete one or more container images.<br><br>[ibmcloud cr image-untag](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_image_untag) Remove a tag, or tags, from each specified container image in Container Registry.<br><br>[ibmcloud cr retention-policy-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_policy_set) Set a policy to clean up your namespaces by retaining only container images that meet your criteria.<br><br>[ibmcloud cr retention-run](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_retention_run) Clean up your namespaces by retaining only container images that meet your criteria. Writer, Manager<br><br>To run ibmcloud cr retention-run and ibmcloud cr retention-policy-set you must have Manager, or both Reader and Writer.
Accessing Container Registry 

To access your IBM Cloud® Container Registry namespaces so that you can push and pull images, use IBM Cloud® Identity and Access Management (IAM).

All accounts require IAM access policies. To set up and manage IAM access policies, see [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).

Access to IBM Cloud Container Registry is either [automated](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_automating), which typically uses [API keys](https://cloud.ibm.com/docs/account?topic=account-manapikey), or [interactive](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive), which typically uses bearer tokens.

If you have an IAM access policy, but you are getting Access denied errors, see [Why am I getting Access denied errors?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-access-denied) for assistance.

If you want to use your container images in Kubernetes deployments, see [Using an image pull secret to access images in other IBM Cloud accounts or external private registries from nondefault Kubernetes namespaces](https://cloud.ibm.com/docs/containers?topic=containers-registryother).



 Accessing your namespaces in automation 

You can use service ID API keys to automate the pushing and pulling of container images to and from your namespaces.

API keysare linked to user IDs or service IDs in your account and you can use them across IBM Cloud®. You can use an API key in the CLI or as part of automation to authenticate as your user or service identity. A [user API key](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_user_apikey_create) is associated with a user and their access policies.
Upcoming public networking changes for Container Registry 

Users that use the public network to access IBM Cloud® Container Registry are advised to use a wildcard domain, such as .icr.io, in their firewalls rules. The use of a wildcard domain accommodates future changes that might issue a redirect for certain requests such as an image layer download for traffic optimization.

This advice is a change from existing advice that states that you must allow only the public domain of the Container Registry that you are using.