vania-janet/multiturn-rag-retrieval-data huggingface dataset:
https://index.docker.io/v1/

The following snippet shows an example for IBM Cloud Registry. For more information about using the API key, see [Using client software to authenticate in automation](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_apikey_auth).

auths:
us.icr.io:
password: <apikey>
username: iamapikey





 The compose subsection 

It consists of an archive subsection. The archive subsection contains the Base64 encoded TGZ file archive of the docker-compose.yaml file. As the Hyper Protect Container Runtime image uses Docker Engine and Docker Compose to start the container, the information about the container must first be created by using a standard docker-compose file. This file is then archived and base64 encoded and the output of this is provided as the value to the archive subsection, within the compose section. For more information, see [Overview of Docker Compose](https://docs.docker.com/compose/).

The mount points specified under the volumes information of the docker-compose file might be aligned with the volume mount point that is specified in the workload section of the contract.

Executing a build as part of a docker compose file is not supported. Make sure your docker compose file doesn't have a build section.

Both "yaml" and "yml" formats are supported for docker-compose file. This is an example of a docker-compose file.

version: '3'
services:
nginx:
image: nginx@sha256:e73ba8654ba7fd1834e78a3d4e9d72ffaaa3372d42996af5c34ba3e1abc293e8
privileged: true
user: 0:0
restart: always
ports:
- 80:80
Registry: Choose and set up an [image registry](https://cloud.ibm.com/docs/containers?topic=containers-registry) so that developers can pull images from the registry in their app deployment YAML files.
2. CI/CD:



* Review available [options for automating app deployment](https://cloud.ibm.com/docs/containers?topic=containers-cicd).
* Set up toolchains with [IBM® Continuous Delivery Pipeline for IBM Cloud®](https://cloud.ibm.com/docs/containers?topic=containers-cicdcontinuous-delivery-pipeline).









 Add storage 

Plan and add highly available persistent storage based on your app requirements, the type of data that you want to store, and how often you want to access this data.



1. Storage basics: Start by understanding the [basics of Kubernetes storage](https://cloud.ibm.com/docs/containers?topic=containers-kube_concepts).
2. Requirements: Determine your [requirements for a storage solution](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan).
3. Choose a solution: Using your storage requirements, choose a storage solution by comparing [non-persistent](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan), [single-zone persistent](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan), or [multizone persistent](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan) storage.



Need help? Check out the troubleshooting page for your persistent storage solution.





 Add integrations 

Enhance cluster capabilities by integrating various external services and catalog services with your Kubernetes cluster.



1. Review supported integrations:



* [All supported integrations](https://cloud.ibm.com/docs/containers?topic=containers-supported_integrations)
Getting help and support for Container Registry 

If you experience an issue or have questions when you are using IBM Cloud® Container Registry, you can use the following resources before you open a support case.



*  Review the [FAQs](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_faq&interface=ui) in the product documentation.
*  Review the [troubleshooting documentation](https://cloud.ibm.com/docs/Registry?topic=Registry-ts_index&interface=ui) to troubleshoot and resolve common issues.
*  Check the status of the IBM Cloud platform and resources by going to the [Status page](https://cloud.ibm.com/status).



If you still can't resolve the problem, you can open a support case. For more information, see [Creating support cases](https://cloud.ibm.com/docs/get-support?topic=get-support-open-case). And, if you're looking to provide feedback, see [Submitting feedback](https://cloud.ibm.com/docs/overview?topic=overview-feedback).
For more information, [follow along with this example that uses an authorized service ID API key](https://cloud.ibm.com/docs/containers?topic=containers-registryother_registry_accounts).

To use a non-IBM Cloud registry such as Docker, see [Accessing images that are stored in other private registries](https://cloud.ibm.com/docs/containers?topic=containers-registryprivate_images).

Does the API key need to be for a service ID? What happens if I reach the limit of service IDs for my account?
: The default cluster setup creates a service ID to store IBM Cloud IAM API key credentials in the image pull secret. However, you can also create an API key for an individual user and store those credentials in an image pull secret. If you reach the [IAM limit for service IDs](https://cloud.ibm.com/docs/account?topic=account-known-issuesiam_limits), your cluster is created without the service ID and image pull secret and can't pull images from the icr.io registry domains by default. You must [create your own image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registryother_registry_accounts), but by using an API key for an individual user such as a functional ID, not an IBM Cloud IAM service ID.

I see image pull secrets for the regional registry domains and all registry domains. Which one do I use?
: Previously, IBM Cloud Kubernetes Service created separate image pull secrets for each regional, public icr.io registry domain. Now, all the public and private icr.io registry domains for all regions are stored in a single all-icr-io image pull secret that is automatically created in the default Kubernetes namespace of your cluster.

For workloads in other Kubernetes namespaces in the cluster to pull container images from a private registry, you can now copy only the all-icr-io image pull secret to that Kubernetes namespace. Then, specify the all-icr-io secret in your service account or deployment.
* [Before you begin](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_vperegistry_vpe_prereqs)
* [Virtual private endpoints](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_vperegistry_vpe_endpoints)
* [Setting up a VPE for IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_vperegistry_vpe_endpoint_setup)



* [Configuring an endpoint gateway](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_vperegistry_endpoint-gateway-servicename)





[Securing your connection to Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private)



* [Using private network connections](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private_images)



* [Enabling service endpoint support for the account](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private_images_endpoints)
* [Considerations for private network connections](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private_images_considerations)
* [Pushing and pulling images](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private_images_push)



* [Enforcing access to your account over a private network](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private_account)



[Encrypting images for content confidentiality](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encryptregistry_encrypt)
For more information, see [Container Registry CLI stops returning security status results in lists by default from version 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_lists).





 8 July 2022 

Context-based restrictions
: You can use context-based restrictions to define and enforce access restrictions for IBM Cloud resources based on the network location of access requests.

For more information, see [Context-based restrictions](https://cloud.ibm.com/docs/Registry?topic=Registry-iam&interface=uiiam_cbr).





 5 July 2022 

Change to Container Registry private IP addresses in all regions
: If you are using Cloud Identity and Access Management (IAM) restricted IP address lists and you are connecting to Container Registry over the private network, your lists of allowed IP addresses must now include the private subnet and IP addresses of your own hosts. The IBM Cloud Container Registry private IP addressees also changed. This change also affects you if you have allowlists or a firewall rule.

For more information, see [Container Registry private IP addresses changed on 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_private_network) and [Using IAM IP address access restrictions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_iam_ip).

All accounts require IAM access policies
: To access IBM Cloud Container Registry, you must be using Cloud Identity and Access Management (IAM) access policies. You must ensure that you are using IAM access policies to manage access to the Container Registry service.

Policy-free authorization is discontinued in the following Container Registry regions:



* us-south (us.icr.io)
* uk-south (uk.icr.io)
* eu-central (de.icr.io)
* ap-south (au.icr.io)
* ap-north (jp.icr.io)



Other regions are unaffected because they already require IAM access policies for all accounts.
If you're using IAM authentication, this command enables fine-grained authorization. For more information, see [Managing IAM access for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam) and [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).

ibmcloud cr iam-policies-enable



 Prerequisites 

To find out about the required permissions, see [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).







 ibmcloud cr iam-policies-status 

Displays the IAM access policy status of the targeted IBM Cloud Container Registry account. For more information, see [Managing IAM access for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam) and [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).

From 5 July 2022, all accounts require IBM Cloud® Identity and Access Management (IAM) access policies. If you started to use IBM Cloud Container Registry before the availability of [IAM API key policies in Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-25feb2019) in February 2019, you must ensure that you are using IAM access policies to manage access to the Container Registry service. For more information, see [IAM access policies are required from 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_policy).

ibmcloud cr iam-policies-status





 ibmcloud cr image-digests (ibmcloud cr digests) 

Lists all images, including [untagged](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_untagged) images, in your IBM Cloud account.
For more information, see [Container Registry private IP addresses changed on 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_private_network) and [Using IAM IP address access restrictions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_iam_ip).





 20 April 2022 

Container Registry private IP addresses are changing from 23 June 2022
: By 23 June 2022, if you're using Cloud Identity and Access Management (IAM) restricted IP address lists and you're connecting to Container Registry over the private network, you must update your lists of allowed IP addresses to include the private subnet and IP addresses of your own hosts. The IBM Cloud Container Registry private IP addressees are also changing, which might require updates to your firewall configuration.

For more information, see [Container Registry private IP addresses changed on 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_private_network).





 1 March 2022 

Amendment to the minimum supported Docker version for Container Registry
: From 1 March 2022, the minimum version of Docker Engine that is supported by Container Registry is v17.07, or later.





 9 February 2022 

All accounts will require IAM access policies from 5 July 2022
: From 5 July 2022, to access IBM Cloud Container Registry, you must be using Cloud Identity and Access Management (IAM) access policies. If you started to use Container Registry before the availability of [IAM API key policies in Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-25feb2019) in February 2019, you must now ensure that you're using IAM access policies to manage access to the Container Registry service.

Policy-free authorization will be discontinued in the following Container Registry regions:



* us-south (us.icr.io)
* uk-south (uk.icr.io)
* eu-central (de.icr.io)
* ap-south (au.icr.io)
Setting up Terraform for Container Registry 

Terraform on IBM Cloud® enables predictable and consistent provisioning of IBM Cloud services so that you can rapidly build complex, multitiered cloud environments that follow Infrastructure as Code (IaC) principles. Similar to using the IBM Cloud CLI or API and SDKs, you can automate the provisioning, update, and deletion of your IBM Cloud® Container Registry instances by using HashiCorp Configuration Language (HCL).

Are you looking for a managed Terraform on IBM Cloud solution? Try out [IBM Cloud Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-getting-started). With Schematics, you can use the Terraform scripting language that you are familiar with, but you don't need to worry about setting up and maintaining the Terraform command line and the IBM Cloud Provider plug-in. Schematics also provides pre-defined Terraform templates that you can install from the IBM Cloud catalog.



 Installing Terraform and creating a Container Registry namespace 

Before you begin, ensure that you have the [required access](https://cloud.ibm.com/docs/Registry?topic=Registry-iam) to create and work with IBM Cloud Container Registry resources.



1. To install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform, follow the [Terraform on IBM Cloud getting started tutorial](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to provision, update, or delete Container Registry resources.
2. Create a Terraform configuration file that is named main.tf. In this file, you add the configuration to create a Container Registry namespace and to assign a user an IAM

access policyin Identity and Access Management (IAM) for that namespace by using HashiCorp Configuration Language (HCL). For more information, see the [Terraform Language Documentation](https://developer.hashicorp.com/terraform/language).
If the IBM_CLOUD_API_KEY secret environment variable is not provided, 401 errors appear in the logs. For more information about this replacement, see the [IBM Cloud® Container Registry is Deprecating Container Builds](https://www.ibm.com/cloud/blog/announcements/ibm-cloud-container-registry-deprecating-container-builds) blog post.





 Tekton pipelines 

The Continuous Delivery service includes several Tekton tasks that you can reference within your pipelines to build container images. These tasks are stored in the [Open Toolchain Tekton Catalog](https://github.com/open-toolchain/tekton-catalog/tree/master/container-registry):



* [icr-containerize](https://github.com/open-toolchain/tekton-catalog/blob/master/container-registry/README.mdicr-containerize): Builds and pushes an image to the [IBM Cloud® Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started). This task depends on [Buildkit](https://github.com/moby/buildkit) to build the container image.
* [icr-execute-in-dind](https://github.com/open-toolchain/tekton-catalog/blob/master/container-registry/README.mdicr-execute-in-dind): Runs Docker commands such as build and inspect, against a Docker engine that is running as a sidecar container. Then, it pushes the resulting image to the IBM Cloud® Container Registry.
* [icr-execute-in-dind-cluster](https://github.com/open-toolchain/tekton-catalog/blob/master/container-registry/README.mdicr-execute-in-dind-cluster): Runs Docker commands such as build and inspect, against a Docker engine that is running in a Kubernetes cluster. If a Docker DinD isn't available on the build cluster, a new one is deployed.
* default storage provider
* image registry, including the registry namespace and pull secret
* domain to be used for the auto-generated certificates and the enablement of the [Kaniko image builder](https://access.redhat.com/articles/3630111kaniko).



The default domain for Red Hat® OpenShift® on IBM Cloud® clusters on IBM Cloud is <region>.containers.cloud.ibm.com. You can see your region with the command oc project.

For more information about command-line parameters, see [Command-Line Parameters of the SAP Data Hub Installer](https://help.sap.com/viewer/e66c399612e84a83a8abe97c0eeb443a/2.7.latest/en-US/fe5f71216f0e465c929e93ecd48e5a14.html){. external}.





 SAP Data Hub installation 



1. Log in to the IBM Cloud® Container Registry.

ibmcloud cr login
2. Use the following command using parameters from previous steps. You will be entering your S-UserID and password.

./install.sh --namespace sdh --registry de.icr.io/sdh_cr_os --pv-storage-class ibmc-block-bronze 
--cert-domain eu-de.containers.cloud.ibm.com --image-pull-secret sdh-de-icr-io --enable-kaniko yes



The installation and the initialization of all pods may take a while to complete.







 Provide the Modeler's Access Credentials for the IBM Cloud Container Registry 

After installation has finished and the SAP Data Hub Launchpad is available, log in to SAP Data Hub, and provide the proper credentials for the Modeler in System Management.

Use the following commands to provide the modeler's access credentials to the IBM Cloud® Container Registry.



1.
For more information, see [IAM access policies are required from 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_policy).

If you're using IAM authentication, this command enables fine-grained authorization. For more information, see [Managing IAM access for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam) and [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).

ibmcloud cr iam-policies-enable



 Prerequisites 

To find out about the required permissions, see [Access roles for configuring Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).







 ibmcloud cr iam-policies-status 

Displays the IAM access policy status of the targeted IBM Cloud Container Registry account. For more information, see [Managing IAM access for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam) and [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).

From 5 July 2022, all accounts require IBM Cloud® Identity and Access Management (IAM) access policies. If you started to use IBM Cloud Container Registry before the availability of [IAM API key policies in Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_release_notesregistry-25feb2019) in February 2019, you must ensure that you are using IAM access policies to manage access to the Container Registry service. For more information, see [IAM access policies are required from 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_policy).

ibmcloud cr iam-policies-status





 ibmcloud cr image-digests (ibmcloud cr digests)
Securing your connection to Container Registry 

You can use private network connections to securely route your data in IBM Cloud® Container Registry.

If you use cloud-based services for production workloads, you can use a secure private connection so that you ensure that you adhere to any compliance regulations. You can use IBM Cloud service endpoints to connect to IBM Cloud services over the private IBM Cloud network.

Service endpoints make it easier to securely route network traffic between different IBM Cloud services and your registry over the private IBM Cloud network. This network routing ensures that your data doesn't go over the public internet.

To learn more about IBM Cloud service endpoints, see [Secure access to services by using service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview).



 Using private network connections 

You must set up your account with the correct authority so that you can set up a private network connection for pushing and pulling images.

IBM Cloud Container Registry is a multi-tenant offering and you are, therefore, not required to create your own service endpoints to connect to the registry over private connections.



 Enabling service endpoint support for the account 

To connect to IBM Cloud services over a private network, you must meet the following criteria.



* You must be able to access the classic infrastructure.
* You must enable [virtual routing and forwarding](https://cloud.ibm.com/docs/direct-link?topic=direct-link-overview-of-virtual-routing-and-forwarding-vrf-on-ibm-cloud) (VRF) and connectivity to service endpoints for your account.
* You must also have a billable account.



To enable your IBM Cloud account to use virtual routing and forwarding (VRF) and service endpoints, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).





 Considerations for private network connections 



* Private domain names aren't used by the container-registry CLI plug-in.
Notifications about Container Registry 

Notifications about changes that affect IBM Cloud® Container Registry and Vulnerability Advisor.



  Notifications topics 

Notifications about changes.



*  [Upcoming public networking changes for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_wildcard_domains&interface=ui).
*  [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4).
*  [Changes to Container Registry VPE gateways from 11 November 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_vpe).
*  [Changes to private IP addresses from 15 December 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_ip_address).
*  [Container Registry CLI stops returning security status results in lists by default from version 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_lists).
*  [Container Registry private IP addresses changed on 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_private_network).
*  [IAM access policies are required from 5 July 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_policy).
*  [Minimum supported Docker version from 1 March 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_docker).