Container Registry access control
Every request to the registry is checked against the IP allowlist and then authenticated as a registry user, unless anonymous pulls are enabled.
Registry users
Registry users are separate from UpCloud account users. Each registry user has a username, a password, and a set of permissions, and authenticates to the registry with docker login or any OCI client that supports basic authentication.
| Permission | Allows |
|---|---|
| Read | Pulling images and other artifacts, and listing the registry's repositories. Every user has it. |
| Create | Pushing new tags, including the first push to a new repository. Pushing an existing tag again with the same image also only needs Create. |
| Update | Pushing a different image to an existing tag, for example to move latest to a new build. |
| Delete | Deleting tags and images through the registry API. |
When you add a user, you choose one of these combinations: Read; Read, Create; Read, Delete; Read, Create, Update; Read, Create, Delete; or Read, Create, Update, Delete. Common choices are:
- Read for servers and Kubernetes clusters that only run images.
- Read, Create for CI pipelines that push a new tag for every build, such as the commit ID.
- Read, Create, Update for engineers, and for pipelines that also move tags such as
latest.
A push or delete that the user's permissions don't allow fails with denied: requested access to the resource is denied. To change a user's permissions, delete the user and add it again with the permissions it needs.
The password is generated when the user is created and shown only once. To replace a lost or leaked password, select View next to the user and then Rotate password. The new password is also shown only once, and the old one stops working. Each registry also has a built-in upadmin user, marked Primary, which is created with the registry.
Manage users from the Users tab of the registry in the Control Panel.
IP allowlist
The IP allowlist limits which IPv4 address ranges can reach the registry over the public internet. Add ranges in CIDR notation, such as 192.0.2.0/24, from the IP Allowlist tab. An empty list means no IP restriction.
Requests from addresses outside the list are refused with 403 Forbidden and the body RBAC: access denied, even with valid credentials. The allowlist applies only to the public endpoint, so pulls through the private endpoint of an attached private network aren't restricted by it.
The number of entries depends on the plan. See Plans.
Anonymous pulls
When Allow anonymous pulls is turned on in the Settings tab, anyone who can reach the registry can pull any image in it without logging in. This applies to every repository in the registry. Anyone can also list the registry's repositories and their tags. Pushes still require a registry user.
To make only some images public, create a separate registry for them.