How-to guides

• 1: Manage Repository
• 2: Image and Tag Management
• 3: Managing Image Security Vulnerabilities
• 4: Managing Image Tag Deletion Policies
• 5: Using Container Registry with CLI

1 - Manage Repository

A repository is a logical management unit for images within a registry. By using a repository, you can set the default security policy for images generated underneath.

Create Repository

To create a repository, follow the steps below. ​

1. All Services > Container > Container Registry Click the menu. Go to the Service Home page of Container Registry.
2. Service Home page, click the Repository menu. Navigate to the Repository list page.
3. Click the Repository List page’s Create Repository button. It navigates to the Create Repository page.

• Repository list at the top of the page, click the Settings icon to select an existing registry, or click Create New to create a registry.

4. Enter the required information on the Create Repository page and select the detailed options.
   • Service Information Input Enter or select the required information in the area.

     Category	Required or not	Detailed description
     Registry Name	Required	Select the registry name to create the repository If no registry has been created, you can create a new one via the Create New button
     Repository Name	Required	Name of the repository to create Enter 3 to 30 characters using lowercase English letters, numbers, and the special character (-) (the start and end must be lowercase English letters or numbers)

     Table. Repository Service Information Input Items
   • Repository Basic Policy Input Enter or select the required information in the area.

     Category	Required	Detailed description
     Image Scan	Option	Automatic scanning of image vulnerabilities generated in the repository and setting scan exclusion policies Ability to set a default scan policy applied when an image is created in the repository If automatic scanning is set to Enabled, the image’s vulnerabilities are automatically checked when the image is pushed. In this case, the vulnerability scanning cost is charged If the scan exclusion policy is set to Enabled, you can specify the inspection targets and vulnerabilities to exclude during image scanning Option to exclude Language Package checks, Secret checks, and vulnerabilities without a Fix Version Excludable vulnerabilities: you can select one of the following levels Exclude vulnerabilities at or below the (None / Unknown / Negligible / Low / Medium / High / Critical) level
     Image Pull Restriction	Option	Policy settings for using the image Pull restriction feature generated in the repository and its limit values You can set the default Pull restriction policy applied when an image is created in the repository If you set the unscanned image Pull restriction to Enabled, pulling images that have not been vulnerability scanned is not allowed If you set the vulnerable image Pull restriction policy to Enabled, pulling images is not allowed when Critical or High level vulnerabilities exceeding the entered value are found. The input and selectable values for this policy are as follows Critical: 1 (default) ~ 9,999,999 High: 1 (default) ~ 9,999,999 Exclude vulnerabilities without a Fix Version If Enabled is selected, vulnerabilities without a Fix Version (when there is no patch version for the vulnerable package/library) are excluded from the Pull restriction policy
     Image lock status	Option	You can set a lock to prevent deleting or updating any images inside the repository If the repository’s image lock status is Lock, the individual image Lock/Unlock functions within the repository are disabled Changing the image lock status of a repository that is in Lock state to Unlock enables the individual image Lock/Unlock functions Pushing new images is allowed
     Image Tag Deletion	Option	You can set an automatic image deletion policy for images stored in the repository If you select Enabled for policy activation, the image deletion policy is applied Untagged Image automatic deletion, Old Image automatic deletion items set to Enabled will apply the respective image deletion policies Enter an automatic deletion period in the policy; the image will be automatically deleted after the specified period has passed since its initial push For detailed information on image tag deletion, see Image Tag Deletion Policy Management

     Table. Repository Basic Policy Input Items
   • Additional Information Input area, please enter or select the required information.

     Category	Required or not	Detailed description
     Explanation	Select	Repository description Enter repository description
     Tag	Select	Add Tag Up to 50 can be added per resource After clicking the Add Tag button, enter or select Key, Value values

     Table. Repository Additional Information Input Items

5. Summary Check the detailed information and estimated billing amount generated in the panel, and click the Create button.
   • When creation is complete, check the created resources on the Repository List page.

Check repository detailed information

Repository service can view and edit the full resource list and detailed information. Repository Detail page consists of Detailed Information, Tags, Work History tabs.

To view repository details, follow the steps below.

1. All Services > Container > Container Registry Click the menu. Navigate to the Service Home page of Container Registry.
2. Click the Repository menu on the Service Home page. Navigate to the Repository list page.
3. Repository List page, click the resource (Repository) for which you want to view detailed information. You will be taken to the Repository Details page.
   • Repository Details page displays the repository’s status information and detailed information, and consists of Details, Tags, Activity History tabs.

     Category	Detailed description
     Repository Status	Display repository status Active: Available state Deleting: Deleting state Inactive: State not available due to failure during deletion (only deletion request possible) Editing: State where settings are being modified or sub-resources (images, tags) within the image are being deleted
     User Guide	Repository Usage Guide Commands to use images within the repository via CLI can be checked
     Delete Repository	Button to delete the repository

     Table. Status Information and Additional Functions

Detailed Information

Repository list page allows you to view detailed information of the selected resource and, if necessary, edit the information.

Tag

On the Repository list page, you can view the tag information of the selected resource, and you can add, modify, or delete it.

Work History

You can view the operation history of the selected resource on the Repository list page.

Delete Repository

To delete a repository, follow the steps below.

1. All Services > Container > Container Registry Click the menu. Navigate to the Service Home page of Container Registry.
2. On the Service Home page, click the Repository menu. Go to the Repository list page.
3. Click the resource (Repository) for which you want to view detailed information on the Repository List page. You will be taken to the Repository Details page.
4. On the Repository Details page, click Delete Repository.
5. Delete Repository In the popup window, please enter the Repository name.
6. If you enter the Repository name correctly, the Confirm button will be enabled. Click the Confirm button.
7. If termination is completed, check on the Repository list page whether the resource has been terminated.

2 - Image and Tag Management

Images are the logical management unit of tags. Users can efficiently manage image versions using tags.

Generate Image

To generate an image, the repository must be created first. For detailed information about creating a repository, refer to Repository Management.

• Images are created by pushing images or OCI standard artifacts using the CLI with the registry endpoint.
• To push an image via CLI, refer to the official documentation provided by the client tool you are using or Using CLI.

Check image detailed information

Image can view and edit the full resource list and detailed information. The Image detail page consists of Details, Tags, Delete Policy Test tabs.

To view the image details, follow the steps below.

1. All Services > Container > Container Registry menu, click. Go to the Service Home page of Container Registry.
2. Click the Image menu on the Service Home page. Navigate to the Image list page.
3. Image list at the top of the page, click the Settings icon to select the Registry name and Repository name where the Image for viewing detailed information is stored.
   • If there is no desired item, click Create New to register the Registry and Repository, then you can select it.
4. Click the resource (Image) to view detailed information on the Image List page. You will be taken to the Image Details page.
   • Image Details page displays the Image’s status information and detailed information, and consists of Detailed Information, Tags, Delete Policy Test tabs.

     Category	Detailed description
     Image Status	Represents the status of the image Active: Available state Deleting: Deleting state Inactive: State where deletion failed and not usable (only deletion request possible) Editing: State of modifying settings or deleting image sub-resources (tags)
     User Guide	CLI-based Image Usage Guide
     Image Delete	Button that deletes the image

     Table. Image status information and additional functions

Detailed Information

On the Image list page, you can view the detailed information of the selected resource and, if necessary, edit the information.

Delete Image

To delete the Image, follow the steps below.

1. All Services > Container > Container Registry Click the menu. Navigate to the Service Home page of Container Registry.
2. Click the Image menu on the Service Home page. It moves to the Image List page.
3. Image list Click the Settings icon at the top of the page and select the Registry name and Repository name where the Image to be deleted is stored.
4. Click the resource (Image) to delete on the Image List page. You will be taken to the Image Details page.
5. Click the Delete Image button on the Image Details page.
6. Image Delete when the popup appears, click the Confirm button.
7. After deletion is complete, check on the Image List page whether the resource has been deleted.

Check detailed image tag information

To view detailed image tag information, follow these steps.

1. All Services > Container > Container Registry Click the menu. Go to Container Registry’s Service Home page.
2. Click the Image menu on the Service Home page. Navigate to the Image list page.
3. Image List Click the Settings icon at the top of the page and select the Registry name and Repository name where the Image to view detailed information is stored.
4. Image List page, click the resource (Image) to view detailed information. Navigate to the Image Details page.
   • Image Details Click the Tags tab on the right side of the detailed information tab at the top of the page. Go to the Tags List page.

     Column	Detailed description
     Tags	Tag name of image Digest A single image Digest can have multiple tag names
     Digest	Image Digest value
     Size	Image Digest size
     Edit Timestamp	Image Digest(Tags) Edit Timestamp
     Inspection Date and Time	Image Digest (Tags) Vulnerability Inspection Date and Time
     Vulnerability Check Result	Image Digest (Tags) Vulnerability Check Result Summary of vulnerability count information and a view result button are displayed View Result button can be clicked to view detailed vulnerability analysis results for the image tags
     Status	Status for image Digest (Tags) Active: Normal usable state Deleting: Deleting state Inactive: Deletion failed and not usable (only delete request possible)
     Copy URL	Copy endpoint URL for using image Digest You can copy the private/public endpoint URL to use in commands for using image Digest
     More button	Menu to select delete, edit, vulnerability check, and detailed usage guide for image Digest (Tags) Delete: Delete the specified image Digest (Tags) Edit Tags: Tag name of the image Digest can be edited in the Tags edit window Vulnerability Check: Vulnerability check available for image Digest (Tags) Detailed Usage Guide: Can view a guide for using image Digest (Tags) based on CLI Tags Lock: Can set a lock so that selected image Tags cannot be deleted or updated Tags Unlock: Can remove the lock to allow selected image Tags to be deleted or updated

     Table. Tags list items

Detailed Information

Click the Tags of the image Digest whose details you want to view in the list of Tags in Image details. The detailed information window for the image Digest (Tags) will appear.

• If you check the information in the tag detail window and click Confirm, the window will close.

Delete image tags

To delete an image tag, follow these steps.

1. All Services > Container > Container Registry Click the menu. Navigate to the Service Home page of Container Registry.
2. Click the Image menu on the Service Home page. Go to the Image list page.
3. Click the Settings icon at the top of the Image List page and select the Registry name and Repository name where the Image to view detailed information is stored.
4. Click the resource (Image) to view detailed information on the Image List page. You will be taken to the Image Details page.

• Click the Tags tab on the right side of the detailed information tab at the top of the Image Details page. You will be taken to the Tags List page.

5. In the Tags list, select the checkbox located to the left of the tag you want to delete, then click Delete.
   • If you select checkboxes for multiple items, you can delete multiple tags at once, and you can select and delete up to 50 tags at a time.
   • You can delete tags one by one by clicking the Delete button inside the more options button located at the right end of the tag to be deleted.
6. Delete Tags When the popup window opens, click Confirm.
7. Once deletion is complete, check on the Tags list page whether the resource has been deleted.

Testing image tag deletion policy

To test the image tag deletion policy you set, follow the steps below.

1. All Services > Container > Container Registry menu, click. Navigate to the Service Home page of Container Registry.
2. Click the Image menu on the Service Home page. Navigate to the Image list page.
3. Image List Click the Settings icon at the top of the page and select the Registry name and Repository name where the Image to view detailed information is stored.
4. Click the resource (Image) to view detailed information on the Image List page. You will be taken to the Image Detail page.
   • Image Details Click the Delete Policy Test tab on the right of the Detailed Information tab at the top of the page. You will be taken to the Delete Policy Test tab page.
5. Delete Policy Test on the tab page, click the Policy Test button of the Delete Target Tags item. The delete policy test will be executed.
6. When the delete policy test execution notification popup opens, click the Confirm button.
   • When the test execution request is completed, the phrase Deletion policy test execution request has been completed is displayed.
7. Check the test results when the deletion policy test is completed.
   • Deleted Target Tags item shows the image tags (digests) that are subject to the deletion policy.

3 - Managing Image Security Vulnerabilities

By using the image security vulnerability inspection feature, you can manually or automatically check the OS package security vulnerabilities of images stored in the Container Registry and the Secrets included in the image. Users can identify and remove known vulnerabilities (CVE) and Secrets based on the inspection results to prevent the use of unsafe images.

Vulnerability Inspection Support Information

Supported OS

• Vulnerability inspection function supports checking libraries installed via package manager on the following OS.

Support Language

• The vulnerability inspection feature supports checks for the following Language.

Support Secret

• Vulnerability assessment feature supports the following types of Secrets included in the image.

Check Image Security Vulnerabilities (Manual)

To check image security vulnerabilities, follow the steps below.

1. All Services > Container > Container Registry Click the menu. Navigate to the Service Home page of Container Registry.
2. Click the Image menu on the Service Home page. Navigate to the Image list page.
3. Image list Click the Settings icon at the top of the page and select the Registry name and Repository name where the Image stored for checking detailed information is located.
4. Image List page, click the resource (Image) to check security vulnerabilities. Image Details page will be opened.

• Image Detail Click the Tags tab to the right of the detailed information tab at the top of the page. You will be taken to the Tags tab page.

5. Tags On the Tags tab page, click the More button located at the far right of the tag you want to check for security vulnerabilities, then click Vulnerability Check.
6. When the vulnerability check notification popup opens, click the Confirm button.
   • When the inspection starts, Vulnerability inspection will be conducted. is displayed.
   • When the inspection is finished, the Vulnerability Inspection Results item will display a summary of the inspection results and a View Results button. Clicking the View Results button will open a popup where you can see the detailed analysis results of Vulnerabilities by Image Digest (Tags).
     Reference

     • View Results button, when clicked, shows the detailed analysis results of vulnerabilities for the image tag.
       • If a red exclamation mark icon (!) appears in the inspection date/time field after a vulnerability check, it means the vulnerability check list for the Container Registry service has been updated. Click Vulnerability Check as a new vulnerability item check is required for the image Digest (Tags), so we recommend rechecking.

Check image security vulnerability assessment results

To check the vulnerability assessment results, follow the steps below.

1. All Services > Container > Container Registry Click the menu. Navigate to the Service Home page of Container Registry.
2. Click the Image menu on the Service Home page. Navigate to the Image list page.
3. Image List Click the Settings icon at the top of the page and select the Registry name and Repository name where the Image to view detailed information is stored.
4. On the Image List page, click the resource (Image) to check for security vulnerabilities. You will be taken to the Image Details page.

• Image Detail Click the Tags tab on the right side of the detailed information tab at the top of the page. It will navigate to the Tags tab page.

5. Tags on the tab page, click the View Results button of the Vulnerability Assessment Results item of the tag to check the vulnerability assessment results.
6. Vulnerabilities by Image Tags Check the results in the popup window where you can view the detailed analysis results.

Check inspection results by vulnerability unit

Image Tag-specific Vulnerabilities detail page’s Vulnerabilities tab allows you to view image security vulnerability assessment results by vulnerability.

Vulnerability tab allows you to view the list of all discovered vulnerabilities.

Check inspection results by package unit

Image Tag Vulnerabilities detailed page, when you click the Package tab, you are taken to the package-specific vulnerability page. In the Package tab, you can view the image security vulnerability check results by package.

Package tab allows you to view the full package list, as well as the list of packages with discovered vulnerabilities and the list of packages without discovered vulnerabilities.

Check results by secret unit

Image Tag Vulnerabilities on the detail page, click the Secret tab to go to the secret-specific vulnerability page. You can view the image security vulnerability scan results by secret.

In the Secret tab, you can view the full list of secret files, as well as the lists of files with discovered vulnerabilities and files without discovered vulnerabilities.

4 - Managing Image Tag Deletion Policies

The user can register and manage the image tag deletion policy.

Managing image tag deletion policies

The image tag deletion policy refers to the policy that automatically deletes an image when a certain period of time has passed since it was first pushed to the repository. If the image tag deletion policy is enabled, the image tags (digest) stored in the Container Registry will be automatically deleted according to the set deletion policy.

Support deletion policy information

Describes policy information that supports deleting image tags.

Support Policy

It supports a policy that allows you to set automatic deletion and period for image tags (digest).

Set the image tag (digest) deletion policy

To set the image tag (digest) deletion policy, follow these steps.

1. Click All services > Container > Container Registry menu. It moves to the Service Home page of Container Registry.
2. Service Home page, click the Image menu. It moves to the Image list page.
3. Click the gear button at the top of the Image 목록 page. The Registry/Repository 설정 popup window opens.
4. Registry/Repository settings In the popup window, select the Registry name and Repository name where the Image to be set for the deletion policy is stored, and click the OK button.
5. Image list page, click the resource (Image) to set the deletion policy. Move to the Image details page.
6. Image Detail page’s Detail Info tab, click the Edit icon of the Delete Image Tag item. The Edit Delete Image Tag popup window will open.
7. Image Tag Deletion Modification In the popup window, enter and select the necessary information and activation status, and click the Confirm button.
   • Delete policy activation is set to Use, the image tag (digest) will be automatically deleted according to the set delete policy.
   • Select the deletion policy to apply and enter the period from when the image was first pushed to the repository to when it will be automatically deleted.
8. When the update notification popup window opens, click the Confirm button.
   • When the modification is complete, Image tag deletion modification was successful message will be displayed.

Image tag (digest) deletion policy test

To test the image tag (digest) deletion policy, follow these steps.

1. Click All services > Container > Container Registry menu. It moves to the Service Home page of Container Registry.
2. On the Service Home page, click the Image menu. It moves to the Image list page.
3. Click the gear button at the top of the Image 목록 page. The Registry/Repository 설정 popup window will open.
4. Registry/Repository Settings In the popup window, select the Registry name and Repository name where the Image to be set for the deletion policy is stored, and click the Confirm button.
5. On the Image List page, click the resource (Image) to test the deletion policy. It moves to the Image Detail page.
6. Image Detail page, click the Deletion Policy Test tab. Move to the Deletion Policy Test tab page.
7. Deletion Policy Test tab page, to test the deletion policy set, click the Policy Test button at the bottom of the deletion target Tags.
8. When the deletion policy test notification popup window opens, click the Confirm button.
   • When the test run application is completed, the phrase The deletion policy test run application has been completed will be displayed.
   • After the test is completed, the image tags (digest) that are the target of the deletion policy will be displayed in the Deletion Target Tags section.

5 - Using Container Registry with CLI

This explains how to log in to the Container Registry using the CLI command and manage Container images and Helm charts.

Managing Container Images with CLI

You can log in to the Container Registry and push or pull container images using the CLI command.

Logging in to Container Registry

The user can log in to the Container Registry using the authentication key.

Logging in with an authentication key

Logs in using the AccessKey and SecretKey of the authentication key and the registry endpoint.

• Registry endpoint : Container Registry details page can be found.
• Private endpoint : [registryname-registryid].scr.private.[region].[offering].samsungsdscloud.com

1 docker login <registry_endpoint>
2 Username: <accessKey>
3 Password: <secretKey>

Pushing Images

To push an image to the registry, please refer to the following command.

1 docker push [registryname]-[registryid].scr.private.[region].[offering].samsungsdscloud.com/[repository]/[image:tag]

Image Pulling

To pull an image from the registry, please refer to the following command.

1 docker pull [registryname]-[registryid].scr.private.[region].[offering].samsungsdscloud.com/[repository]/[image:tag]

Managing Helm Charts with CLI

You can log in to the Container Registry using the CLI command and push or pull the Helm chart.

Logging in to Container Registry

The user can log in to the Container Registry using the authentication key.

Logging in with an authentication key

Logs in using the AccessKey, SecretKey of the authentication key and the registry endpoint.

• Registry endpoint : Container Registry details page can be found.
• Private endpoint : [registryname-registryid].scr.private.[region].[offering].samsungsdscloud.com

1 helm registry login <registry_endpoint>
2 Username: <accessKey>
3 Password: <secretKey>

Chart Push

To push a chart to the registry, please refer to the following command.

1 helm push [hello-world-0.1.0].tgz oci://[registryname]-[registryid].scr.private.[region].[offering].samsungsdscloud.com/[mychart]

As shown in the example, writing and executing the command will save (upload) the chart to the mychart repository with the hello-world image and apply the 0.1.0 tag.

To push charts to a registry, you need the LoginContainerRegistry permission for the registry you want to use and the PushRepositoryImages permission for the repository. For more information about policy and permission settings, see Management > IAM > Policy.

Chart Pulling

To pull charts from the registry, please refer to the following command.

1 helm pull oci://[registryname]-[registryid].scr.private.[region].[offering].samsungsdscloud.com/[mychart/hello-world] -version [0.1.0]

As shown in the example, writing and executing the command downloads the chart saved with the tag 0.1.0 in the hello-world image in the mychart repository.

To pull charts from a registry, you need the LoginContainerRegistry permission for the registry you want to use and the PullRepositoryImages permission for the repository. For more information about policy and permission settings, see Management > IAM > Policy.