The IONOS Cloud offers a managed container registry solution that you don't have to provision or host yourself. The container registry can be used as part of CI/CD workflows for container workloads.

Product Overview

DCD How-Tos

API How-Tos

Once you have created a Container Registry, you will want to create one or more tokens to provide (and control) access to your registry.

Create a Token

1. To create a Token for a Container Registry, go to Menu > Containers > Container Registry.

2. In the Container Registry Manager, select the Container Registry that you want to configure.

3. Click on the + Add in the Tokens section to create a new Token

4. Complete the following fields:

• Name This is a user-visible name for the token so that it can be easily identified

• Status Leave as Enabled. The token can be Disabled at a later date if required

• Expiry Date (if required)

• Scopes: Scopes define what actions the token has permission to perform and on which repositories. You must have at least one scope added (by clicking the Add scope button). You can have multiple scopes if the token needs different permissions per repository.

  • Name List the names of the repositories to which the token will have access. * can be used as a wildcard. * will provide access to all repositories

  • Actions Select the required Actions for the token (Pull, Push and/or Delete)

  • Type Choose either repository or registry. Use registry to get the list of repositories in the registry. Use repository to manage the contents of the repository(s)

  • Click Add scope and add further scopes if needed

5. Click Save

6. You are then presented with the details of the created credential and the Docker Login command using the newly created token.

Create a Container Registry

1. To create a Container Registry, go to Menu > Containers > Container Registry.

2. In the Container Registry Manager, click + Add to start creating a new container registry.

3. Provide an appropriate Name.

4. Choose the Location where you want your container registry to be run and the images to be stored.

5. Click Create Registry. Your Container Registry and storage will be created.

6. Your Container Registry will be ready to use when the status is updated to "Running".

The IONOS Cloud Container Registry is a universal repository manager with a recommended service for storing and managing custom container images and other artifacts in IONOS Cloud. Deploying and pulling images can be done using the Docker CLI or added directly to a Kubernetes deployment.

The IONOS Cloud Container Registry provides users with a dedicated registry or multiple registries based on their contracts, allowing them to host their own Docker images without the need for an external provider (such as Docker Hub).

A container registry is created to store and share custom images in the same regions where you deploy them. Container Registry is a high-performance platform for storing custom image containers. It can be used as part of CI/CD workflows for container workloads.

You can order and manage the Container Registry through the API. The API will allow integration into the Data Center Designer (DCD).

Features

The IONOS Cloud Container Registry allows you to manage compatible registries by offering the following:

• An authenticated registry where OCI-compliant artifacts (including Docker container images) can be stored and retrieved.

• Access via the Public Internet and secure by requiring authentication to view, push, or pull images. The Container Registry is maintained by IONOS Cloud on your behalf, which means that our experts will apply non-stop patches to the underlying infrastructure and Container Registry software.

• All images stored in the container registry are encrypted at rest.

• Each container registry can have many repositories.

Specifications

The IONOS Cloud Container Registry specifications are as follows:

Container Registry Characteristics

Our platform is responsible for providing the operations required to facilitate the distribution of images.

• The container registry is accessible from the public internet and maximally available (High availability setup) for pushing and pulling artifacts.

• The service is managed, including any components on which it is built.

• The container registry supports the Docker Registry HTTP API v2, which allows it to be integrated into an automated CI/CD pipeline.

• It also supports authentication tokens for use by robot accounts to be able to integrate into an automated CI/CD pipeline. You can create a one-time token to allow the CI/CD pipeline to push a new image.

• You can use the registry with Docker Registry HTTP API v2 compliant tools, e.g. Docker CLI.

• It is possible to use the same credentials to access all registries and repositories in the same IONOS Cloud account that the user has access to.

• All data in the registry will be encrypted at rest.

Regional Availability

The IONOS Cloud Container Registry is available in DE and FRA regions.

Benefits of Container Registry

Lets’ check out what IONOS Container Registry brings with itself:

• create a registry access token with limited or unlimited permissions

• create a temporary registry access token with limited or unlimited permissions

• support for docker tools

• login to registry

• push an image

• pull an image

• delete an image

Pricing

The following prices apply to IONOS Cloud Container Registry:

Limitations

There are the following few limitations when working with IONOS Container Registry APIs:

• You cannot choose your own encryption keys (Trust-No-One) to use when encrypting data at rest, the Container Registry platform manages the keys.

• There is no way to grant repository access permissions to push, pull and/or delete from a specific repository.

• Any unauthenticated user will not be able to access the registry contents.

Each Container Registry has the option to configure the Garbage Collection schedule. By default, Garbage Collection is disabled because each customer will choose a schedule based upon their needs.

Configure Garbage Collection (DCD)

Garbage Collection frees up storage space for image layers data that are no longer referenced. This is necessary if, for example, all your images use the same base operating system image. Garbage Collection ensures that layers are not referenced by other images before deletion.

The duration of Garbage Collection will increase based on the volume of deleted repositories or tags and the total number of repositories and tags to be checked.

1. To configure Garbage Collection for a Container Registry, go to Menu > Containers > Container Registry.

2. In the Container Registry Manager, select the Container Registry that you want to configure.

3. Click on the edit icon.

4. Select the day and time that you want Garbage collection to run on a weekly basis.

The IONOS Cloud Container Registry service allows you to manage Docker and OCI compatible registries for use by your managed Kubernetes clusters. Use a container registry to make sure you have a private registry to effectively support pulling images.

Quick Links:

To create a container registry, you should be aware of available locations where you can create your container registry.

Request

curl --location \
    --request GET \
    'https://api.ionos.com/containerregistries/locations' \
--header 'Authorization: Basic am9obkBleGFtcGxlLmNvbTphYmMxMjM=' \
--data-raw ''

Response

200 OK - Successfully received the locations of a registry

{
   "id": "locations",
   "type": "collection",
   "href": "",
   "items": [
       {
           "id": "de/fra"
       }
   ]
}

Response Fields

Once you have fetched your required information, you can now create a new registry. For the registry, you can alter the days and time. You can also update the location based on the available container registry locations.

We assume the following prerequisites:

• A location for container registry

• An available name for the registry

With the POST request, you can create a container registry.

Request

curl --location  \
--request POST 'https://api.ionos.com/containerregistries/registries' \
--header 'Authorization: Basic am9obkBleGFtcGxlLmNvbTphYmMxMjM=' \
--header 'Content-Type: application/json' \
--data-raw '{
  "properties": {
    "garbageCollectionSchedule": {
      "days": [
        "Saturday",
        "Sunday"
      ],
      "time": "19:30:00+00:00"
    },
    "location": "de/fra",
    "name": "demo"
  }
}'

Input Parameters

You can update the limit value to get specific registries based on the limit value being passed.

Response

200 OK - Successfully showed the list of registries

{
   "id": "709y8e3c-d5c8-4359-8f85-c200fb89e87c",
   "type": "registry",
   "href": "",
   "metadata": {
       "createdBy": "sample@ionos.com",
       "createdByUserId": "a7af0375-1c1d-4387-9ef1-6eu95d30e74a",
       "createdDate": "2022-10-07T14:30:06Z",
       "state": "New"
   },
   "properties": {
       "name": "demo",
       "location": "de/fra",
       "garbageCollectionSchedule": {
           "days": [
               "Sunday",
               "Saturday"
           ],
           "time": "19:30:00+00:00"
       },
       "storageUsage": {
           "bytes": 0
       },
       "hostname": ""
   }
}

Response Fields

400 Bad Request - The request made is invalid or corrupted

{
 "httpStatus": 400,
 "messages": [
   {
     "errorCode": "123",
     "message": "ad velit dolor dolore laboris"
   },
   {
     "errorCode": "123",
     "message": "tempo
   }
 ]
}

This section shows you how to create a registry token. We assume the following prerequisite:

• A container registry

In this guide, we used test named repository to create registry tokens. Therefore, it is important that the you know your container registry name.

With the POST request, you get the registry token. You will need to provide registry ID:

Request

curl --location  \
--request POST 'https://api.ionos.com/containerregistries/registries/:789f8e3c-d5c8-4359-8f85-c200fb89e97c/tokens' \
--header 'Authorization: Basic am9obkBleGFtcGxlLmNvbTphYmMxMjM=' \
--header 'Content-Type: application/json' \
--data-raw '{
  "properties": {
    "name": "test",
    "expiryDate": null,
    "scopes": [
      {
        "name": "*",
        "actions": [
          "pull", "push", "delete"
        ],
        "type": "repository"
      }
    ]
  }
}'

Response

200 OK - Successfully showed the list of registries

{
    "id": "8fb592e4-494c-11ed-b878-0242ac120002",
    "type": "token",
    "href": "",
    "metadata": {
        "createdBy": "sample@sample.com",
        "createdByUserId": "8hb792e4-494c-11ed-b878-0242ac120002",
        "createdDate": "2022-10-08T15:56:04Z",
        "state": "enabled"
    },
    "properties": {
        "name": "test",
        "scopes": [
            {
                "actions": [
                    "pull",
                    "push",
                    "delete"
                ],
                "name": "*",
                "type": "repository"
            }
        ],
        "expiryDate": null,
        "status": "enabled",
        "credentials": {
            "username": "test",
            "password": "148g592e4-494c-11ed-b878-0242ac120002"
        }
    }
}

Response Fields

409 - Conflict

{
   "httpStatus": 409,
   "messages": [
       {
           "errorCode": "0",
           "message": "already exists: name is not available"
       }
   ]
}

Docker CLI

If you want to push your local images to docker repository, you need to login to it using:

docker login [OPTIONS] [SERVER]

You need to enter the following options to login:

• Hostname

• Username

• Password

For more information, refer to the the Docker Commands.

You can push the images to your registry by providing all required information. You can query registries and look at images manifest, discover tags, delete layers and delete manifest etc. In the Docker API calls:

• You can use the name of registry

• Authenticate the API calls with a token

To know more, explore the Docker Documentation. On the other hand, DCD uses an easy to opt passthrough feature which as discussed uses Basic Auth feature, so you dont need to use a separate authentication method for Data Center Designer (DCD).

The IONOS Cloud Container Registry service allows you to manage Docker and OCI compatible registries for use by your managed Kubernetes clusters. Use a container registry to make sure you have a private registry to effectively support pulling images.

Quick Links:

ContainerRegistry API - OpenAPI Specification

Endpoint: https://api.ionos.com/containerregistries

To make authenticated requests to the API, you must include a few fields in the request headers. Please find relevant descriptions below:

Request parameter headers

Examples

We use curl in our examples, as this tool is available on Windows 10, Linux and macOS. Please refer to our blogpost about curl on Windows if you encounter any problems:

Once you have all the information about the available locations, you can check out the name of existing registries. The name you choose should be available and must not be already in use.

You can retrieve all the existing registries to check out the available names.

Request

curl --location  \
--request GET 'https://api.ionos.com/containerregistries/registries?limit=5' \
--header 'Authorization: Basic am9obkBleGFtcGxlLmNvbTphYmMxMjM=''  \
--data-raw ''

Query Parameters:

You can update the limit value to get specific registries.

Response

200 OK - Successfully showed the list of registries

{
   "id": "registries",
   "type": "collection",
   "href": "",
   "items": [
       {
           "id": "34341cbe-c06a-4f5f-8773-4ae677d85ba8",
           "type": "registry",
           "href": "",
           "metadata": {
               "createdBy": "samplel@ionos.com",
               "createdByUserId": "7ee77dcf-093f-48e6-9a14-161c73568589",
               "createdDate": "2022-09-05T17:44:52Z",
               "state": "Running"
           },
           "properties": {
               "name": "tue1608es",
               "location": "es/vit",
               "maintenanceWindow": {
                   "days": [
                       "Monday"
                   ],
                   "time": "01:23:00+00:00"
               },
               "garbageCollectionSchedule": {
                   "days": [
                       "Sunday",
                       "Saturday"
                   ],
                   "time": "19:30:00+00:00"
               },
               "storageUsage": {
                   "bytes": 0,
                   "updatedAt": "2022-09-05T17:46:06Z"
               },
               "hostname": "tue1608es.cr.es-vit.ionos.com"
           }
       }
   ],
   "limit": 5,
   "nextPageToken": "",
   "_links": {
       "next": "",
       "self": "/registries?limit=5",
       "previous": ""
   }
}

Response Fields

You can get the information for a particular container registry. At this point, a hostname will be allocated to your registry. The registry hostname becomes a part of your image or your manifest or the repository name.

With the GET request, you can fetch the registry information by ID. The registryId must be provided. You can get it through GET Registries API call.

Request

curl --location  \
    --request GET 'https://api.ionos.com/containerregistries/registries/:789f8e3c-d5c8-4359-8f85-c200fb89e97c' \
    --header 'Authorization: Basic am9obkBleGFtcGxlLmNvbTphYmMxMjM=' \
--data-raw ''

Path parameters:

Response

200 OK - Successful operation

{
   "id": "8fb59000-494c-11ed-0242ac120002,
   "type": "registry",
   "href": "",
   "metadata": {
       "createdBy": "sample@test.com",
       "createdByUserId": "a5af0375-1c1d-4387-9ef1-6ee95d30e54a",
       "createdDate": "2022-10-07T14:30:06Z",
       "state": "Running"
   },
   "properties": {
       "name": "demo",
       "location": "de/fra",
       "garbageCollectionSchedule": {
           "days": [
               "Sunday",
               "Saturday"
           ],
           "time": "19:30:00+00:00"
       },
       "storageUsage": {
           "bytes": 0,
           "updatedAt": "2022-10-07T14:40:20Z"
       },
       "hostname": "demo.cr.de-fra.test.com"
   }
}
 

Response Fields

400 Bad Request - The request made is invalid or corrupted

{
 "httpStatus": 400,
 "messages": [
   {
     "errorCode": "123",
     "message": "ad velit dolor dolore laboris"
   },
   {
     "errorCode": "123",
     "message": "tempor"
   }
 ]
}

404 Not Found - The server did not find anything matching the request

{
 "httpStatus": 400,
 "messages": [
   {
     "errorCode": "123",
     "message": "ad velit dolor dolore laboris"
   },
   {
     "errorCode": "123",
     "message": "tempor"
   }
 ]
}

Once you have created a repository using the and performed all operations you can delete the repository completely. Since does not allow to delete the entire repository, you can use IONOS Container Registry's API call for deleting the repository.

To delete your repository, the registryId and repository name for the repository to be deleted must be provided.

You can get registryId through .

Delete the repository using the following curl command:

Request

Path parameters

Response

204 - No Content

The request was successfully fulfilled and there is no content in the body.

To delete your container registry, destroying all container image data stored in it. The registryId must be provided. You can get it through .

Delete the registry using the following curl command:

Request

Path parameter

Response

204 - No Content

The request was successfully fulfilled and there is no content in the body.

404 Bad Request - Not Found

This way you can delete the registry completely.

What is the IONOS Container Registry?

IONOS Cloud Container Registry is a managed service that provides users with a dedicated Docker registry or multiple registries as part of their contract. This enables them to host their own Docker images without the need for an external provider (such as Docker Hub).

How to create a Container Registry?

Refer to the workflow.

What are the main benefits of the IONOS Container Registry?

IONOS Container Registry is private and requires authentication to access it. It resides in the same infrastructure as your other IONOS Cloud infrastructure. Any unauthenticated user will not be able to access the registry contents. IONOS Container Registry software ensures that everything being used is up-to-date and resilient. You don't need to use mK8s capacity to run and manage your Container Registry.

Can I get admin credentials for the container registry?

Refer to the workflow.

How can I access the Docker Registry HTTP API V2?

Refer to the and go to the documentation.

What are the limits for the IONOS Container Registry?

The following are a few limitations of the IONOS Container Registry:

• You cannot choose your encryption keys (Trust-No-One) when encrypting data at rest; the Container Registry platform manages the keys.

• There is no way to grant repository access permissions to push, pull and/or delete from a specific repository.

• There is no security scanning service so that you can receive feedback when the artifacts are exposed to a security risk.

• An unauthenticated user will not be able to access the registry contents.

• To have a registry, you need authentication and authorization, and the registry's contents must not be accessible to unauthenticated users.

Can repositories be public?

All container registries are available on the public internet but cannot be accessed without a token with the correct rights.

To delete your token, the registryId and tokenId to be deleted must be provided.

You can get registryId through and .

Delete the information about the token using the following curl command:

Request

Path parameters:

Response

204 - No Content

The action was successful and the response body is empty.

400 Bad Request - The request made is invalid or corrupted

404 Bad Request - Not Found

This way you can delete a particular token.