vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Version change logs



* [23 April 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-april2320)



* Version change logs



* [22 April 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-april2220)



* Private network connection to registry



* [17 April 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-april1720)



* Version change log



* [16 April 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-april1620)



* Ingress ALB change log



* [13 April 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-april1320)



* Gateway appliance firewalls
* Version change logs



* [6 April 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-april0620)



* CLI change log
* Kubernetes cluster context



* [1 April 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-april0120)



* Istio add-on





* [March 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar20)



* [30 March 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar3020)



* Version change logs
* File storage classes



* [27 March 2020](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-mar2720)



* Tech overview
See [Setting up authorities for container registries](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryauthorities-registry).
* If you build multiple versions of the same container image, the latest version of the container image is downloaded and used when you run your job or deploy your application, unless a tag is specified for the image. If a tag is specified for the image, then the tagged image is used for the app or job.
* Build runs that are submitted with the CLI that do not reference a defined build configuration are not viewable from the console.
* Code Engine has quotas for build runs within a project. For more information about Code Engine limits, see [Limits and quotas for Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-limits).



Build runs that complete are ultimately automatically deleted. When you run a build run with a single CLI command such that it is not based on a build configuration, this build run is deleted after 1 hour if the build run is successful. If the build run is not successful, this build run is deleted after 24 hours. You can only display information about this build run with the CLI. You cannot view this build run in the console.



 Running a single build that pulls source from public repository with the CLI 

If your source is located in a public repository and you want to use a single command to build and output a container image, then use the buildrun submit command to create the container image without creating a reusable build configuration.

For the build output, you can choose automatic access and let Code Engine take care of building the image for you from your source and storing the image in IBM Cloud Container Registry. For this case, you do not need to specify a registry secret or the location of the image registry. Or, you can choose user-provided access and specify registry details along with a registry secret to access your built image in the registry.
Log in to IBM Cloud Container Registry by running the following command.

ibmcloud cr login

IBM Cloud Container Registry supports other clients as well as Docker. To log in by using other clients, see [Accessing your namespaces interactively](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_accessregistry_access_interactive).
5. Pull the image by running the following command.

docker pull <registry_region>.icr.io/namespace_b/hello-world
6. Push the image to namespace_b by running the following command.

docker push <registry_region>.icr.io/namespace_b/hello-world

This command fails because User B doesn't have the Writer role in namespace_b.
7. Tag the image with namespace_c by running the following command.

docker tag hello-world <registry_region>.icr.io/namespace_c/hello-world
8. Push the image to namespace_c by running the following command.

docker push <registry_region>.icr.io/namespace_c/hello-world

The command works because User B has the Writer role in namespace_c.
9. Pull from namespace_c by running the following command.

docker pull <registry_region>.icr.io/namespace_c/hello-world

The command works because User B has the Reader role in namespace_c.



6. Clean up:



1. Log back in to User A's account by running the following command.

ibmcloud login
2. List the policies for User B by running the following command.

ibmcloud iam user-policies <user.b@example.com>

Find the policies that you created and note the Policy IDs.
3. Delete the policies that you created by running the following command, where <Policy_ID> is the Policy ID.

ibmcloud iam user-policy-delete <user.b@example.com> <Policy_ID>
Why can't the cluster pull images from IBM Cloud Container Registry during creation? 

Virtual Private Cloud

Classic infrastructure

  What’s happening 

When you created a cluster, you received an error message similar to the following.

Your cluster can't pull images from the 'icr.io' domains because an IAM access policy could not be created. Make sure that you have the IAM Administrator platform access role to. Then, create an image pull secret with IAM credentials to the registry by running 'ibmcloud ks cluster pull-secret apply'.

  Why it’s happening 

During cluster creation, a service ID is created for your cluster and assigned the Reader service access policy to IBM Cloud Container Registry.

Then, an API key for this service ID is generated and stored in [an image pull secret](https://cloud.ibm.com/docs/containers?topic=containers-registrycluster_registry_auth) to authorize the cluster to pull images from IBM Cloud Container Registry.

  How to fix it 

To successfully assign the Reader service access policy to the service ID during cluster creation, you must have the Administrator platform access policy to IBM Cloud Container Registry.

Steps:



1.  Make sure that the account owner gives you the Administrator role to IBM Cloud Container Registry.

ibmcloud iam user-policy-create <your_user_email> --service-name container-registry --roles Administrator
2.  [Use the ibmcloud ks cluster pull-secret apply command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_cluster_pull_secret_apply) to re-create an image pull secret with the appropriate registry credentials.
Log in to IBM Cloud.

ibmcloud login

If you have a federated ID, use ibmcloud login --sso to log in to the IBM Cloud CLI. Enter your username and use the provided URL in your CLI output to retrieve your one-time passcode. If you have a federated ID, the login fails without the --sso and succeeds with the --sso option.
2. Target the region for which you want to upgrade the plan.

ibmcloud cr region-set

For more information, see [ibmcloud cr region-set](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_region_set) and [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).
3. Upgrade to the standard plan.

ibmcloud cr plan-upgrade standard

If you have an IBM Cloud lite plan, you must upgrade to an IBM Cloud Pay-as-you-go or Subscription account before you run ibmcloud cr plan-upgrade.

For more information, see [ibmcloud cr plan-upgrade](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan_upgrade).







 Terms that are used in IBM Cloud Container Registry 

Information about the terms that are used in IBM Cloud Container Registry.

To learn more about Docker-specific terms, see [Docker glossary](https://docs.docker.com/glossary/).



 Container image 

A file system and its execution parameters that are used within a container runtime to create a container. The file system consists of a series of layers, which are combined at run time, that are created as the container image is built by successive updates. The container image does not retain state as the container runs.

Container images are stored in a repository that is stored in a namespace.





 Digest 

Digests are used as immutable references to various objects in the registry such as image manifests, layers, and configuration items.
* [ibmcloud cr login](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_login__example)



* [ibmcloud cr manifest-inspect](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_manifest_inspect)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_manifest_inspect_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_manifest_inspect_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_manifest_inspect_example)



* [ibmcloud cr namespace-add](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_add)



* [Prerequisites](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_add_prereq)
* [Command options](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_add_option)
* [Example](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_add_example)
* [27 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept2719)



* IBM Cloud Object Storage supported in VPC clusters



* [24 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept2419)



* CLI change log
* Ingress ALB change log
* Managing cluster network traffic for VPC clusters
* Customizing PVC settings for VPC Block Storage



* [19 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept1919)



* Sending custom Ingress certificates to legacy clients



* [16 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept1619)



* CLI change log
* IBM Cloud Activity Tracker events
* Version change logs



* [13 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept1319)



* Entitled software
* script update command



* [12 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept1219)



* Ingress ALB change log



* [5 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept0519)



* Ingress ALB change log



* [4 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept0419)



* CLI change log
* IAM allowlists



* [3 September 2019](https://cloud.ibm.com/docs/containers?topic=containers-containers-relnotescontainers-sept0319)
container-registry.exemption.list [ibmcloud cr exemption-list](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_list) List your Vulnerability Advisor exemption policies for security issues.<br><br>[ibmcloud cr exemption-types](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_types) List the types of security issues that you can exempt. Reader, Manager 
 container-registry.exemption.manager [ibmcloud cr exemption-add](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_add) Create a Vulnerability Advisor exemption policy for a security issue.<br><br>[ibmcloud cr exemption-rm](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_exemption_rm) Delete a Vulnerability Advisor exemption policy for a security issue. Manager 
 container-registry.namespace.create [ibmcloud cr namespace-add](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_add) Create a namespace.<br><br>[ibmcloud cr namespace-assign](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcliic_cr_namespace_assign) Assign a namespace to a resource group. Manager 
 container-registry.namespace.delete [ibmcloud cr namespace-rm](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_namespace_rm) Remove a namespace. Manager 
 container-registry.plan.get [ibmcloud cr plan](https://cloud.ibm.com/docs/Registry?topic=Registry-containerregclibx_cr_plan) Display your pricing plan. Manager
* [Authorizing access to Container Registry with service ID](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryauthorize-cr-service-id)



* [Authorizing access to Container Registry with service ID from the console](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryauthorize-console-service-id)
* [Authorizing access to Container Registry with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryauthorize-cr-cli)



* [Considerations for images in your registry](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryconsiderations-registry)







 Accessing private code repositories 

[Accessing private code repositories](https://cloud.ibm.com/docs/codeengine?topic=codeengine-code-repositoriescode-repositories)



* [Create code repository access](https://cloud.ibm.com/docs/codeengine?topic=codeengine-code-repositoriescreate-code-repo)



* [Choosing an SSH key for code repository](https://cloud.ibm.com/docs/codeengine?topic=codeengine-code-repositorieschoose-ssh-key)
* [Adding private repository access from the console](https://cloud.ibm.com/docs/codeengine?topic=codeengine-code-repositoriesadd-repo-access-ce-console)
* [Adding private repository access with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-code-repositoriescreate-code-repo-console)
For more information about Container Registry regions, see [IBM Cloud Container Registry regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).



 What access permissions are required for Code Engine managed access to IBM Cloud Container Registry? 

The user of this Integrations page must have the following IBM Cloud® Identity and Access Management (IAM) access policies that are assigned to your user account to successfully configure registry access for all users of the project. If you don't have sufficient permissions to perform these actions, you can use this page to help you understand the required permissions and actions you can take.



* Service: Container Registry



* Resources: Select from resource group, region, or access management tags.
* Resource group access:Viewer
* Roles and actions:Administrator platform access and Reader, Writer, and Manager service access



* Service: Code Engine



* Resources: The resource group of this Code Engine project
* Resource group access:Viewer
* Roles and actions:Operator platform access and Writer service access





For Code Engine to automatically generate a service ID for accessing images in Container Registry in a specific location, Code Engine sets up this service ID with the Administrator role for the IAM Identity service that is scoped to this service ID. Additionally, Code Engine grants the Manager role for the IBM Cloud Container Registry service that is scoped to the specified location (region). These roles and permissions are required so that Code Engine can use this service ID to access Container Registry on behalf of the user of the respective Code Engine project.

When Code Engine configures this service ID with the Administrator platform access and Manager service access to IBM Cloud Container Registry, the access is scoped to only this service ID.

For more information about Code Engine requirements for accessing images in a container registry, see [Accessing container registries](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registry).





 What's the relationship between the service ID and the registry secret? 

When you configure default registry access for a specific location, you can view details about what Code Engine does for you, including information about the service ID and its access policies, API key, and registry secret.
Why am I getting Access denied errors for a resource? 

You have a valid IAM API key or OAuth token, but you still get Access denied errors for a specific resource in IBM Cloud® Container Registry.

  What’s happening 

When you try to access Container Registry, you get the following message:

You are not authorized to access the specified resource.

  Why it’s happening 

The following alternatives are possible causes:



*  The API key that is used to access Container Registry has insufficient permissions.
*  Context-based restriction rules are in place.



  How to fix it 

You can fix this problem in the following ways:



*  Confirm that the API key that you are using has suitable permissions for the resource that you are trying to access. Contact the owner of the resource for help. For more information, see [Managing IAM access](https://cloud.ibm.com/docs/Registry?topic=Registry-iam&interface=ui).
*  Check whether context-based restriction rules are in place. If so, these rules prevent you from accessing resources outside the defined allowed contexts. Adjust the allowed context or rerun your pull from within an allowed context. For more information, see [Context-based restrictions](https://cloud.ibm.com/docs/Registry?topic=Registry-iam&interface=uiiam_cbr).

To confirm whether a context-based restriction rule caused the Access denied error, check IBM Cloud Activity Tracker for the resource that is being accessed. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitorenabled-access).
Why am I getting Access denied errors about insufficient scope? 

You have a valid IAM API key or OAuth token, but you still get Access denied errors about insufficient scope in IBM Cloud® Container Registry.

  What’s happening 

When you try to access Container Registry, you get the following message:

Insufficient scope

  Why it’s happening 

You might see this message if you are trying to access Container Registry by using a client such as Docker. The following alternatives are possible causes:



*  The API key that is used to access Container Registry has insufficient permissions.
*  Context-based restriction rules are in place.



  How to fix it 

You can fix this problem in the following ways:



*  Confirm that the API key that you are using has suitable permissions for the resource that you are trying to access. Contact the owner of the resource for help. For more information, see [Managing IAM access](https://cloud.ibm.com/docs/Registry?topic=Registry-iam&interface=ui).
*  Check whether context-based restriction rules are in place. If so, these rules prevent you from accessing resources outside the defined allowed contexts. Adjust the allowed context or rerun your pull from within an allowed context. For more information, see [Context-based restrictions](https://cloud.ibm.com/docs/Registry?topic=Registry-iam&interface=uiiam_cbr).

To confirm whether a context-based restriction rule caused the Access denied error, check IBM Cloud Activity Tracker for the resource that is being accessed. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitorenabled-access).
Why am I getting Access denied errors over a private network? 

You have a valid IAM API key or OAuth token, but you still get Access denied errors over a private network in IBM Cloud® Container Registry.

  What’s happening 

When you try to access Container Registry, you get the following message:

You must access this account over the private network.

  Why it’s happening 

You attempted to access Container Registry over the public network, but the account is set to allow only private network traffic.

  How to fix it 

Check the account settings for private only traffic. If private-only traffic is enabled, ensure that you are accessing Container Registry from the private network. For more information, see [Using private network connections](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_privateregistry_private_images).
Why am I getting Access denied errors? 

You have a valid IAM API key or OAuth token, but you still get Access denied errors in IBM Cloud® Container Registry.

When you try to access Container Registry, you get one of the following messages.

You are not authorized to access the specified resource.
:   For more information, see [Why am I getting Access denied errors for a resource](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-resource).

Insufficient scope
:   You might see this message if you are trying to access Container Registry by using a client such as Docker. For more information, see [Why am I getting Access denied errors about insufficient scope](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-scope).

Your account has exceeded its pull traffic quota for the current month.
:   For more information, see [Why am I getting Access denied errors about my quota](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-quota).

Your account has exceeded its image storage quota for the current month.
:   For more information, see [Why am I getting Access denied errors about my quota](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-quota).

You must access this account over the private network.
:   For more information, see [Why am I getting Access denied errors over a private network](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-private).

Status code 403 Forbidden
:   You might see this message if you are using IBM Cloud Code Engine. For more information, see [Why am I getting a Forbidden error when I'm using Code Engine](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-forbidden-ce).

ImagePullBackoff
:   You might see this status when you start containers in Kubernetes. For more information, see [Why do images fail to pull from registry with ImagePullBackOff or authorization errors](https://cloud.ibm.com/docs/Registry?topic=Registry-ts-app-image-pull).
* Administrator platform access role for Container Registry in the console (container-registry in the API or CLI) at the Account level.
* Administrator platform access role for Cloud Object Storage in the console (cos in the API or CLI) for the standard instance that you want to use to back up the internal registry images in a VPC cluster.
* Viewer platform access role to IAM Identity Service for account management access.
* Viewer platform access role for the resource group access.



More information about assigning permissions
: 

* To understand how access works and how to assign users roles in IBM Cloud IAM, see [Setting up access to your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess-checklist).
* To create clusters, see [Preparing to create clusters at the account level](https://cloud.ibm.com/docs/containers?topic=containers-clusters&interface=ui).
* For permissions that you might set up for different types of users such as auditors, see [Example use cases and roles](https://cloud.ibm.com/docs/openshift?topic=openshift-usersexample-iam).