> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/containers/private-container-registry/faqs.md).

# FAQ

Private Container Registry is a fully managed service provided by <code class="expression">space.vars.ionos\_cloud</code> that allows you to provision one or more dedicated Docker registries, enabling you to securely store and manage your own container images without relying on external providers like Docker Hub. The service is hosted in Germany and is compliant with GDPR.

## General

### What is the IONOS CLOUD Private Container Registry?

<code class="expression">space.vars.ionos\_cloud</code> Private Container Registry is a fully managed service that allows you to provision one or more dedicated Docker registries. It enables you to securely host and manage your own container images within your infrastructure, eliminating the need for external providers like Docker Hub.

### How to create a Private Container Registry?

You can create a Private Container Registry using the [<mark style="color:blue;">DCD</mark>](/cloud/containers/private-container-registry/dcd-how-tos/create-container-registry.md) or the [<mark style="color:blue;">IONOS CLOUD APIs</mark>](/cloud/containers/private-container-registry/api-howtos/create_registry.md).

### What are the main benefits of IONOS CLOUD Private Container Registry?

For a complete list of benefits, see [<mark style="color:blue;">Features and Benefits</mark>](/cloud/containers/private-container-registry/overview/features-and-benefits.md).

### Can I get admin credentials for the Private Container Registry?

Yes, for more information, see [<mark style="color:blue;">Create Registry Token</mark>](/cloud/containers/private-container-registry/api-howtos/create_token.md).

### How can I access the Docker Registry HTTP API V2?

You can find more information in the [<mark style="color:blue;">Docker Documentation</mark>](https://docs.docker.com/) or also refer to the [<mark style="color:blue;">Docker Registry HTTP API V2</mark>](https://distribution.github.io/distribution/spec/api) documentation.

### What are the limitations of Private Container Registry?

For a complete list of limitations, see [<mark style="color:blue;">Limitations</mark>](/cloud/containers/private-container-registry/overview/limitations.md).

### Can repositories be public?

Although you can access all Private Container Registries via the public internet, you cannot configure the repositories for public access. You must always use an authentication token with the appropriate permissions to connect.

## Common Vulnerability and Exposure Report (CVE)

### What is vulnerability scanning?

Vulnerability scanning is an add-on feature for your Private Container Registry that analyzes known software in your container images against known security vulnerabilities (or CVEs) that may put your infrastructure, applications or data at risk.

### What is a CVE?

CVE stands for Common Vulnerability and Exposure Report, which lists disclosed information regarding security vulnerabilities in publicly released software.

### How are vulnerabilities scored?

We review multiple sources of information for any given CVE. These sources may independently score the risk differently. Hence, we constantly expose the highest score reported by the sources.

The Common Vulnerability Scoring System (CVSS) is used for calculating the severity of a CVE based on many factors (base, temporal and environmental).

CVSS assessment produces a number between 0-10 with 10 being the most severe rating. A CVSS qualitative rating systems helps simplify CVE severity classification, as follows:

| **Rating** | **Description** |
| ---------- | --------------- |
| 0.0        | None            |
| 0.1 - 3.9  | Low             |
| 4.0 - 6.9  | Medium          |
| 7.0 - 8.9  | High            |
| 9.0 - 10.0 | Critical        |

### Does vulnerability scanning detect all vulnerabilities?

The threat landscape is ever-changing, and we cannot guarantee that all vulnerabilities are detected.

New CVEs are published constantly, and existing CVEs may be revised over time, either increasing, or decreasing in severity.

### If an image in my Private Container Registry reports no vulnerabilities, is it guaranteed to be immune to vulnerabilities?

The threat landscape is ever-changing. New vulnerabilities are identified in software constantly, but only when they are publicly published can they be detected in your images.

Vendors and security researchers may choose not to announce certain vulnerabilities and exploits when they are first identified. This is usually the case if the vulnerability is particularly straightforward to exploit and is of high consequence. This gives software vendors time to analyze and fix or mitigate the issue.

### What is the meaning of fixable?

Sometimes, a CVE may show up in your reports as being fixable. It means that the affected software is vulnerable only in specific versions of a package; the vendor may have released an updated version that fixes the vulnerability, or there may be other mitigations that the software vendor suggests to limit or negate the vulnerability.

### How do I fix a CVE?

The answer to this varies on a case-by-case basis. For more information, see [<mark style="color:blue;">What is the meaning of fixable?</mark>](#what-is-the-meaning-of-fixable). Upgrading to the latest version of a software package may resolve the issue. Review the CVE details for a specific vulnerability and recommendations, if available, to determine the steps to resolve the issue.

At certain times, there may be no fix or mitigation available. In these situations, analysis of the risk and awareness can assist with managing information security risks your business is exposed to. For more information, see [<mark style="color:blue;">How can I reduce my exposure to Vulnerabilities</mark>](#how-can-i-reduce-my-exposure-to-vulnerabilities).

### If a vulnerability scanner flags unfixable CVEs, what steps can I take to mitigate the risk?

While it is important to be aware of vulnerabilities in your software, it is not always immediately possible to resolve them. For more information, see [<mark style="color:blue;">How can I reduce my exposure to Vulnerabilities</mark>](#how-can-i-reduce-my-exposure-to-vulnerabilities).

### How can I tell if older images in my Private Container Registry are susceptible to newly published CVEs?

The vulnerability scanning service monitors for changes in published CVE reports. Images held in your Private Container Registry that have been **pushed** or **pulled** recently (in the past 30 days) are rescanned as new information on vulnerabilities becomes available.

This also means that your vulnerability reports will be updated to reflect criticality changes if a vulnerability is reclassified. For example, if a particular vulnerability is downgraded in severity from **Critical** to **High**, your reports will be updated to reflect this.

For more information, see [<mark style="color:blue;">How are vulnerabilities scored?</mark>](#how-are-vulnerabilities-scored).

### Why do some of my images report "Unknown" for vulnerability status?

Not all containers and their packages can be scanned successfully. If your image shows a **Last Scan** time and **Unknown** vulnerability status, the scanning engines may be unable to process the image. We monitor for these situations and regularly review the scanning techniques to ensure these are kept to a minimum.

Sometimes, an image may display an **Unknown** vulnerability status and lack a **Last Scan** time. It can occur when the repository name is less than two characters long or exceeds 255 characters. While it is technically allowed to name a repository with a single character, such names do not meet the scanning engine's requirements. To address this issue, push your image again using a repository name between 2 and 255 characters.

It is also possible that the scanning of your container may still need to be completed. If your vulnerability report for an image does not show the Last Scan time, check again later when the scanning is complete.

### How long does vulnerability scanning take?

Typically, scanning an image takes only a few seconds, but this depends on many factors, such as the size of the image, the number of layers, and the number, and types of packages installed.

### Can I still pull my image whilst scanning is performed?

Yes, vulnerability scanning is non-blocking, and your image can be pulled at any time.

### How can I reduce my exposure to vulnerabilities?

Maintaining good container hygiene practices helps to reduce your exposure:

* Ensure that your container build process updates operating system packages for your container.
* Regularly rebuild and redeploy your container images.
* Reduce your surface area: Analyze your images and include only the software and libraries required for your application to function.
* Change your base image: Sometimes, switching to a different base image may help. Example: Alpine.
* Consider distroless or scratch images for your bases.
* Review your supply chain when using third-party dependencies.

### Is `curl-pipe-bash` a safe installation method?

Several software installation guides recommend using `curl-pipe-bash`. Example: `curl https://source-reposotory.tld/install.sh | bash`

We recommend that you avoid this method. You may review the `install.sh` script at the first build, but if a malicious actor can modify that script later, your container build could be compromised.

### Does vulnerability scanning modify my images?

No, container vulnerability scanning is a read-only operation. The content of your image remains unchanged.

## Garbage collection

### Why did storage not decrease after garbage collection?

Storage metrics do not always drop immediately after garbage collection finishes. This behavior typically happens for one of three reasons:

* **Shared layers:** The deleted image shared layers with other active images in your Private Container Registry. Garbage collection only deletes layers that no other manifest references.
* **Active references:** Active workloads or CI/CD pipelines are still referencing the image layers.
* **System delays:** The storage subsystem requires time to calculate the changes and sync them to the backend billing infrastructure.

### How do I verify that the Private Container Registry actually deleted an image manifest?

Test the deletion by attempting to pull the specific image manifest using its digest. If the deletion succeeded, the Private Container Registry will reject the request and return a **404 Not Found** error:

```bash
docker pull <registry>/<repository>@<digest>
```

### How long does it take for billing metrics to reflect freed storage space?

Allow up to 24 hours after the garbage collection process completes for the underlying cloud infrastructure to sync and update your billing dashboard metrics.

### Why is my Private Container Registry still in read-only mode?

Your Private Container Registry typically remains in read-only mode for one of two reasons:

* **Active Garbage Collection:** The garbage collection process is still running. You can check the current status in the Data Center Designer (DCD).
* **Interrupted Process:** A previous garbage collection process failed to complete or was interrupted.

Wait a few minutes and refresh the DCD. If the issue persists, contact [<mark style="color:blue;">IONOS CLOUD Support</mark>](https://docs.ionos.com/cloud/support/general-information/contact-information).

### How do I know if an image is still referenced?

You can verify if an image is still referenced by using the API to fetch its manifest with the following command:

```bash
curl -H "Authorization: Bearer <token>" \
  "https://<registry-url>/v2/<repository>/<image>/manifests/<digest>"
```

* `HTTP 200`: Manifest exists and is actively referenced.
* `HTTP 404`: Manifest is deleted or does not exist.

When you request a manifest deletion, the endpoint returns an `HTTP 202` status to confirm it accepted the request. Any subsequent calls you make to this endpoint return an `HTTP 404` status.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ionos.com/cloud/containers/private-container-registry/faqs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.