ibm-cloud-docs/registry

Registry

registry's Issues

Podman login failure

Hi,

I think the documentation for podman login to CR has been updated,
ibmcloud iam oauth-tokens | sed -ne '/IAM token/s/.* //p' | podman login -u iambearer --password-stdin <registry> works good, however ibmcloud cr login --client podman I've been getting some issues from CLI

$ ibmcloud cr login --client podman
Incorrect Usage: flag provided but not defined: -client

NAME:
login - Log the local Docker client in to IBM Cloud Container Registry.

USAGE:
   ibmcloud cr login

Add link to the container-registry plugin-install page

Add a link on page https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli for easy traversal to the container-registry plugin-install page https://www.ibm.com/docs/en/filenet-p8-platform/5.5.x?topic=images-getting-access-container-cloud-roks

Add statement that resource groups are not supported

While its clear based on the documentation about how to limit access to the container registry by namespace in the following section:

https://cloud.ibm.com/docs/services/Registry?topic=registry-iam#access_roles_using

It does not mention that resource groups are not supported by the container registry. It would have helped to have that information as a note.

miss a login step on page Signing images for trusted content

Hi
when I following your guide https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontent to sign a server and push to my namespace , I got a following error message

ogon:~ spark$ skopeo --insecure-policy copy --sign-by [email protected] docker-daemon:s390x/nginx:1.21.5 docker://us.icr.io/secureimages_spark/s390x/nginx:1.21.5
Getting image source signatures
FATA[0014] trying to reuse blob sha256:d1eede0ec208346d7d74ec949de704c32a0d28165733cae99ae29f1946dc3ce2 at destination: unable to retrieve auth token: invalid username/password: unauthorized: The login credentials are not valid, or your IBM Cloud account is not active.

after implement login steps, the push action success, so you may miss a login steps

bogon:~ spark$ skopeo login us.icr.io/secureimages_xxxxx
Username: iamapikey
Password:
Login Succeeded!
bogon:~ spark$ skopeo --insecure-policy copy --sign-by [email protected] docker-daemon:s390x/nginx:1.21.5 docker://us.icr.io/secureimages_spark/s390x/nginx:1.21.5
Getting image source signatures
Copying blob a1e99e7c2a84 done
Copying blob d1eede0ec208 done
Copying blob 0d6e7e1905cc done
Copying blob ead8a9801eed done
Copying blob a3f85b75c5e5 done
Copying blob 5d81b92ab1c3 done
Copying config df807c7a02 done
Writing manifest to image destination
Signing manifest
Storing signatures
bogon:~ spark$ ibmcloud cr images
Listing images...

Question about container registry access

Regarding this page: https://cloud.ibm.com/docs/Registry?topic=Registry-user#user

The implication I get from reading this is that the container registry is only accessible from within my managed namespace or resource group:

Access to IBM Cloud Container Registry resources can be granted to the namespace resource by name, the resource group, or the entire service, that is, all namespaces in the account

What if I want anyone with an IBM Cloud account to access my container registry images?

Repository and digest are big

These instructions are nearly perfect. The thing I needed to understand is that although the repository and digest names/ids (the first and second columns of the output of the ibmcloud cr image-digests command) are big, they just need to be concatenated together with an @ sign between them to remove the corresponding image.

Add Knative as example for untagged images of Container Registry FAQ

In the Container Registry FAQ, there are two examples of why you might have untagged images. I would like to suggest to add Code Engine (Knative) as an example in either the first entry or as a separate entry if that makes no sense.

Background: For consistency reasons, when using IBM Cloud Code Engine, the underlying Knative implementation does resolve the image digest of a given image and uses the image with its digest internally. When someone overwrites the the image tag, Knative can reliably serve the original version since it is using the digest, however, this means that users most certainly have untagged images in their namespaces.

Idea: Extend the first entry in Do I need untagged images? to something like this:

The image was deployed by referencing the image by using the digest, for example IBM Code Engine does resolve and use an image digest when serving applications.

IBM container registry login with podman

Step 5:

1. ibmcloud cr login --client podman not working giving below result.

Result:

Incorrect Usage: flag provided but not defined: -client

NAME:
login - Log the local Docker client in to IBM Cloud Container Registry.

USAGE:
ibmcloud cr login

Docker toolbox is no longer supported

This page "https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started" step 3. Click on the "Docker Toolbox" link. It is no longer supported. Please updated this section.

C++ project