UpCloud Managed Container Registry

Container Registry availability

UpCloud — Mon, 09 Nov 2026 10:08:54 +0000

Each registry is created in a region and stores its images there. Choose the region closest to the servers and clusters that pull from the registry. Region Location Private networks from APAC-1 SG-SIN1 SG-SIN1, AU-SYD1 US-1 US-CHI1 US-CHI1, US-NYC1, US-SJO1 EUROPE-1 FI-HEL2 FI-HEL2, DE-FRA1, DK-CPH1, ES-MAD1, FI-HEL1, NL-AMS1, NO-SVG1, PL-WAW1, SE-STO1, UK-LON1 More regions will be added during the beta. Private networks On the Pro plan, SDN Private Networks in any of the region's locations listed above can be attached to the registry. See Networking. Clients The registry endpoint is public by default, so clients in any UpCloud location or outside UpCloud can push and pull. Workloads in locations that aren't listed for the region pull from the registry over this public endpoint. To limit access, add their public IP addresses to the IP allowlist.

Container Registry plans

UpCloud — Mon, 09 Nov 2026 10:08:54 +0000

Each registry has a plan that sets its included storage and its limits. Starter Pro Included storage 25 GiB 250 GiB Repositories 25 500 Webhooks 2 500 Private networks Not available 5 IP allowlist entries 80 160 Requests per second 50 200 Storage above the included amount is billed per GiB. See Billing. Change plan Change the plan from the Settings tab of the registry in the Control Panel. Repository limit When a registry reaches its repository limit, pushes to new repositories are refused with error from registry: too many requests. Pushes to existing repositories keep working. Delete repositories you no longer need, or change to the Pro plan.

Container Registry billing

UpCloud — Mon, 09 Nov 2026 10:08:54 +0000

UpCloud Managed Container Registry is billed by plan, with storage beyond the plan's allowance billed by usage. How it works Each registry has a monthly plan price that includes a storage allowance: 25 GiB on Starter and 250 GiB on Pro. See Plans. Storage above the allowance is billed per GiB per month. Billing is per registry. There are no per-user or per-seat charges, and registry users are free. Pulling images has no data transfer charge, whether the client is in UpCloud or outside it. The Storage section of the registry's Settings tab shows the included storage, the storage used, and the additional storage you are billed for. Please refer to our pricing page for current rates in your currency. If you have any questions about pricing, please contact our Support team .

Container Registry access control

UpCloud — Mon, 09 Nov 2026 10:08:54 +0000

Every request to the registry is checked against the IP allowlist and then authenticated as a registry user, unless anonymous pulls are enabled. Registry users Registry users are separate from UpCloud account users. Each registry user has a username, a password, and a set of permissions, and authenticates to the registry with docker login or any OCI client that supports basic authentication. Permission Allows Read Pulling images and other artifacts, and listing the registry's repositories. Every user has it. Create Pushing new tags, including the first push to a new repository. Pushing an existing tag again with the same image also only needs Create. Update Pushing a different image to an existing tag, for example to move latest to a new build. Delete Deleting tags and images through the registry API. When you add a user, you choose one of these combinations: Read; Read, Create; Read, Delete; Read, Create, Update; Read, Create, Delete; or Read, Create, Update, Delete. Common choices are: Read for servers and Kubernetes clusters that only run images. Read, Create for CI pipelines that push a new tag for every build, such as the commit ID. Read, Create, Update for engineers, and for pipelines that also move tags such as latest. A push or delete that the user's permissions don't allow fails with denied: requested access to the resource is denied. To change a user's permissions, delete the user and add it again with the permissions it needs. The password is generated when the user is created and shown only once. To replace a lost or leaked password, select View next to the user and then Rotate password. The new password is also shown only once, and the old one stops working. Each registry also has a built-in upadmin user, marked Primary, which is created with the registry. Manage users from the Users tab of the registry in the Control Panel. IP allowlist The IP allowlist limits which IPv4 address ranges can reach the registry over the public internet. Add ranges in CIDR notation, such as 192.0.2.0/24, from the IP Allowlist tab. An empty list means no IP restriction. Requests from addresses outside the list are refused with 403 Forbidden and the body RBAC: access denied, even with valid credentials. The allowlist applies only to the public endpoint, so pulls through the private endpoint of an attached private network aren't restricted by it. The number of entries depends on the plan. See Plans. Anonymous pulls When Allow anonymous pulls is turned on in the Settings tab, anyone who can reach the registry can pull any image in it without logging in. This applies to every repository in the registry. Anyone can also list the registry's repositories and their tags. Pushes still require a registry user. To make only some images public, create a separate registry for them.

Container Registry networking

UpCloud — Mon, 09 Nov 2026 10:08:54 +0000

Public endpoint Every registry has a public HTTPS endpoint in the form -.upcloudcr.com, shown as Registry endpoint on the registry's Overview tab. The endpoint has a publicly trusted TLS certificate, so no extra client configuration is needed. The endpoint is reachable over IPv4 on port 443. Right after the registry is created, it may not resolve in DNS yet. To restrict which addresses can use the public endpoint, use the IP allowlist. Private networks On the Pro plan, SDN Private Networks in the locations of the registry's region can be attached so that workloads on those networks reach the registry without traversing the public internet. Attach networks while creating the registry or later from the Networks tab. Up to five private networks can be attached. The network must be in one of those locations, listed on the Availability page, and have an SDN Router attached. See How to connect private networks using SDN Router. Attaching a network gives the registry a second, private endpoint with -private added to the name: my-registry-1b77d021-private.upcloudcr.com While the private endpoint is set up, the registry's status shows Setting up private access. The endpoint is ready to use when the network shows as Active on the Networks tab and the registry's status is back to Running. Use the private endpoint in image references on servers and clusters in the attached network. The public endpoint keeps working alongside it, subject to the IP allowlist. Registry credentials are matched by hostname, so log in or create Kubernetes image pull secrets for the private endpoint separately from the public one. For Managed Kubernetes, see How to use Container Registry with Managed Kubernetes.

Container Registry repositories and tags

UpCloud — Mon, 09 Nov 2026 10:08:54 +0000

Repositories A repository holds the versions of one image. It is created automatically the first time you push to it. The repository name is the part of the image reference between the registry endpoint and the tag: my-registry-1b77d021.upcloudcr.com/demo/hello-upcloud:1.0 └── repository ──┘ └┬┘ tag Repository names can be a single name, such as hello-upcloud, or include a prefix, such as demo/hello-upcloud. The number of repositories depends on the plan. See Plans. Supported formats The registry is OCI-compliant. It stores container images, including multi-platform image indexes and the attestation manifests that Docker Buildx adds, and other OCI artifacts such as Helm charts. To store and install a Helm chart, see How to use Container Registry with Managed Kubernetes. Tags and digests Each tag points to an image digest. Several tags can point to the same digest. The Repositories tab shows every tag with its digest, size, and last update time. Expand a tag to see each platform in a multi-platform image, with its own size and digest. To add a tag to an existing image without pushing it again, use Promote to… on a tag, or Tag a digest. The target tag must not exist yet. Delete tags, images and repositories From the repository view in the Control Panel: Delete tag removes one tag. The image stays available through its other tags. Delete image (all tags) removes the image and every tag pointing to it. Delete repository removes the repository and all of its tags. Deletion can't be undone. Pulls of a deleted tag return not found. Storage is reclaimed on the next garbage collection run.

Container Registry webhooks

UpCloud — Mon, 09 Nov 2026 10:08:54 +0000

Webhooks send registry events to an HTTP endpoint you control, so other systems can react to them, for example to deploy an image as soon as it's pushed. Each delivery is a JSON POST request in the CloudEvents format. Add webhooks from the Webhooks tab of the registry in the Control Panel. Every webhook receives all of the events below. Webhook settings Each webhook has the following settings: Name: identifies the webhook and can't be changed later. To rename a webhook, delete it and add it again. URL: the endpoint that receives the deliveries. Custom headers: optional headers sent with every delivery, for example to route events or tag them with an environment. Secret: sent with every delivery so that your endpoint can check that the request comes from the registry. Leave the field blank to generate a secret, or enter your own. The secret is shown once, right after you add the webhook, so copy it then and store it where your endpoint can read it. You can change a webhook's URL and custom headers later. If you lose the secret, delete the webhook and add it again to get a new one. Events Event type Sent when upcloud.container-registry.repository.created The first image or artifact is pushed to a new repository. upcloud.container-registry.image.updated A manifest is pushed to a repository. upcloud.container-registry.image.deleted A tag or an image is deleted, including when its repository is deleted. A single push often uploads more than one manifest, for example an image index together with its platform and attestation manifests, and each manifest sends its own image.updated event. Manifests pushed by digest have the digest as their reference, and the one pushed with the tag has the tag. Pulls don't send events, and neither does pushing a tag that hasn't changed. Deleting a repository sends an image.deleted event for each image in it. Delivery format Deliveries use CloudEvents 1.0 in binary mode, with the event attributes in ce- headers. The ce-type header holds the event type, and ce-source holds the registry endpoint. The JSON body names the repository, the tag or digest, and the registry user that made the change. This is the body of an image.updated event for a pushed tag, with the manifest and useragent values shortened: { "actor": { "name": "app-developer" }, "digest": "sha256:2aaa6fd9896fc5a1f1d502693bda2a2ac6fb7e6598d58ac11bd1587ebcb2cf14", "manifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.oci.image.index.v1+json\", ...", "mediaType": "application/vnd.oci.image.index.v1+json", "name": "demo/hello-upcloud", "reference": "1.1", "request": { "addr": "192.168.3.143:47712", "method": "PUT", "useragent": "docker/29.8.2 ..." } } An image.deleted event carries the same fields except manifest, and a repository.created event carries actor, name, and request only. Delivery The registry delivers webhooks over the public internet, so the endpoint must be reachable from outside your private networks. Every delivery carries the webhook's secret in an Authorization: Bearer header, so use an https:// URL and have your endpoint reject requests that don't carry the secret. Deliveries aren't signed. Each event is delivered once. If the endpoint returns an error, the delivery isn't sent again. Limits The number of webhooks depends on the plan. See Plans.

Container Registry limitations

UpCloud — Mon, 09 Nov 2026 10:08:54 +0000

Beta service UpCloud Managed Container Registry is in beta. It is fully functional, but standard UpCloud SLAs do not apply during the beta period, and features, limits, and pricing may change before general availability. Region During the beta, registries can be created in a limited number of regions, with more being added. See Availability. Features not yet available The following features are shown on the Settings tab but can't be turned on yet: Vulnerability (CVE) scanning Server-side search Tag retention by age Keeping the latest N tags per repository IPv4 only The registry endpoint is reachable over IPv4 only. Private networks SDN Private Networks are available on the Pro plan only. See Networking.

Container Registry FAQ

UpCloud — Mon, 09 Nov 2026 10:08:54 +0000

Users and access Can I log in to the registry with my UpCloud account? No. The registry has its own users, separate from the users of your UpCloud account, so docker login and other OCI clients take a registry user's username and password. You add registry users and choose what each one can do from the registry's Users tab in the Control Panel. For the steps, see How to get started with UpCloud Container Registry. I've lost a registry user's password. What do I do? Replace it with a new one. On the registry's Users tab, select View next to the user, then Rotate password, and confirm. The new password is shown only once, so copy it before you close the dialog. The old password stops working, so update every client that logs in as that user. How do I change a registry user's permissions? Delete the user on the registry's Users tab and add it again with the permissions it needs. Then update every client that logs in as that user with the new password. See Container Registry access control for what each permission allows. Can I make only some images public? Anonymous pulls apply to every repository in a registry, so put the images you want to make public in a registry of their own and turn on Allow anonymous pulls there, on the Settings tab. See Container Registry access control. Why does my push fail? The error message tells you why: denied: requested access to the resource is denied: the registry user you're logged in as doesn't have the permission the push needs. Pushing a new tag, or the first image to a new repository, needs Create, and pushing a different image to a tag that already exists needs Update. Log in as a user that has those permissions, or add one. See Container Registry access control. error from registry: too many requests: the registry has reached the repository limit of its plan, so pushes to new repositories are refused, while pushes to existing ones keep working. Delete repositories you no longer need, or change the registry to the Pro plan. See Container Registry plans. For other errors, see the troubleshooting section of How to get started with UpCloud Container Registry. Networking My new registry's endpoint doesn't resolve. Why? Right after a registry is created, its endpoint may not be in DNS yet, so clients fail with errors such as no such host. Wait until the endpoint resolves, for example until nslookup returns an address for it, and try again. I attached a private network, but my servers time out on the private endpoint. Why? Servers and Kubernetes nodes get the route to the private endpoint from the network's DHCP. Those created after you attach the network have the route from the start, but those that were already running only get it when they next renew their DHCP lease, which they do on their own. Until then, connections to the private endpoint go out through the public interface and time out. To pick up the route straight away on a Cloud Server, renew the lease on its private network interface, for example with networkctl renew eth1 if eth1 is that interface. See Container Registry networking. Billing and storage Am I charged for pulling images? No. Pulling images has no data transfer charge, whether the client is in UpCloud or outside it. A registry is billed by its plan, plus any storage above the plan's allowance. See Container Registry billing. I deleted images, but my storage usage hasn't gone down. Why? Deleted images keep using storage until the registry's next garbage collection run, so the storage used on the Settings tab goes down after that run rather than straight away. See Container Registry repositories and tags. Webhooks Why does one push send several webhook events? A single push often uploads more than one manifest, for example an image index together with its platform and attestation manifests, and each manifest sends its own image.updated event. Only the manifest pushed with the tag has the tag as its reference, so to act once per push, check the reference against the tag you're interested in. See Container Registry webhooks. My endpoint was down during a push. Will the registry send the event again? No. Each event is delivered once, and a delivery that fails isn't sent again, so once your endpoint is back, catch up on what it missed. For a server that deploys each new image, that means running a deploy by hand, as described in How to deploy automatically with Container Registry webhooks.