Container Registry FAQ

No. The registry has its own users, separate from the users of your UpCloud account, so docker login and other OCI clients take a registry user's username and password. You add registry users and choose what each one can do from the registry's Users tab in the Control Panel. For the steps, see How to get started with UpCloud Container Registry.

Replace it with a new one. On the registry's Users tab, select View next to the user, then Rotate password, and confirm. The new password is shown only once, so copy it before you close the dialog. The old password stops working, so update every client that logs in as that user.

Delete the user on the registry's Users tab and add it again with the permissions it needs. Then update every client that logs in as that user with the new password. See Container Registry access control for what each permission allows.

Anonymous pulls apply to every repository in a registry, so put the images you want to make public in a registry of their own and turn on Allow anonymous pulls there, on the Settings tab. See Container Registry access control.

The error message tells you why:

• denied: requested access to the resource is denied: the registry user you're logged in as doesn't have the permission the push needs. Pushing a new tag, or the first image to a new repository, needs Create, and pushing a different image to a tag that already exists needs Update. Log in as a user that has those permissions, or add one. See Container Registry access control.
• error from registry: too many requests: the registry has reached the repository limit of its plan, so pushes to new repositories are refused, while pushes to existing ones keep working. Delete repositories you no longer need, or change the registry to the Pro plan. See Container Registry plans.

For other errors, see the troubleshooting section of How to get started with UpCloud Container Registry.

Right after a registry is created, its endpoint may not be in DNS yet, so clients fail with errors such as no such host. Wait until the endpoint resolves, for example until nslookup returns an address for it, and try again.

Servers and Kubernetes nodes get the route to the private endpoint from the network's DHCP. Those created after you attach the network have the route from the start, but those that were already running only get it when they next renew their DHCP lease, which they do on their own. Until then, connections to the private endpoint go out through the public interface and time out. To pick up the route straight away on a Cloud Server, renew the lease on its private network interface, for example with networkctl renew eth1 if eth1 is that interface. See Container Registry networking.

No. Pulling images has no data transfer charge, whether the client is in UpCloud or outside it. A registry is billed by its plan, plus any storage above the plan's allowance. See Container Registry billing.

Deleted images keep using storage until the registry's next garbage collection run, so the storage used on the Settings tab goes down after that run rather than straight away. See Container Registry repositories and tags.

A single push often uploads more than one manifest, for example an image index together with its platform and attestation manifests, and each manifest sends its own image.updated event. Only the manifest pushed with the tag has the tag as its reference, so to act once per push, check the reference against the tag you're interested in. See Container Registry webhooks.

No. Each event is delivered once, and a delivery that fails isn't sent again, so once your endpoint is back, catch up on what it missed. For a server that deploys each new image, that means running a deploy by hand, as described in How to deploy automatically with Container Registry webhooks.