Filtering patterns

Filtering patterns are Ant-style templates that allow you to restrict user access to artifacts in the registry based on artifact path. There are two types of patterns:

• Include patterns, which describe allowed paths to artifacts.
• Exclude patterns, which describe prohibited paths to artifacts.

An artifact will be accessible to the user if its path matches at least one include pattern and does not match any exclude patterns.

You specify the patterns when creating or updating the registry.

DockerDocker

<repository> can consist of several segments (e.g., library/nginx, traefik/whoami, or team/service/sidecar) and must contain only digits, lowercase Latin letters, ., _, and -.

Description	Include pattern	Exclude pattern
To restrict access to a repository	["**"]	["<repository>/**"]
To restrict access to Docker images with a specified tag	["**"]	["<repository>/<tag>"]
To restrict access to Docker images with a specified hash	["**"]	["<repository>/sha256:<hash>"]
To restrict access to Docker images with the latest tag	["**"]	["**/latest"]
To allow access to a Docker image	["<Docker image>/**"]	[]

MavenMaven

All separator characters in the path must be replaced with /, e.g., use com/example/mylib/1.0.0 instead of com.example:mylib:1.0.0.

Description	Include pattern	Exclude pattern
To restrict access to a project group	["**"]	["<group>/**"]
To restrict access to an artifact	["**"]	["<group>/<artifact>/**"]
To restrict access to a version	["**"]	["<group>/<artifact>/<version>/**"]
To restrict access to a file	["**"]	["<group>/<artifact>/<version>/<file>"]
To restrict access to snapshots	["**"]	["**/*-SNAPSHOT/**"]
To grant access to two project groups only	["<group-1>/**", "<group-2>/**"]	[]

NPMNPM

The patterns are applied to the path in <package>/<file> format, e.g., for express@4.18.0, the path is express/express-4.18.0.tgz.

Description	Include pattern	Exclude pattern
To restrict access to a package	["**"]	["<package>/**"]
To restrict access to a version	["**"]	["<package>/*-<version>.tgz"]
To restrict access to major version 2	["**"]	["<package>/<package>-2.*.tgz"]
To restrict access to a namespace (scope)	["**"]	["@<namespace>/**"]
To restrict access to a package in a namespace	["**"]	["@<namespace>/<package>/**"]
To grant access to one namespace only	["@<namespace>/**"]	[]
To grant access to two packages only	["<package-1>/**", "<package-2>/**"]	[]

NuGetNuGet

The patterns are applied to the path in <package>/<version> format, e.g., for Newtonsoft.Json@13.0.3, the path is newtonsoft.json/13.0.3. The path does not include the .nupkg file name: the name is found separately (<package>.<version>.nupkg) at the storage level. This is why filtering works with version-level, not individual file-level granularity.

Description	Include pattern	Exclude pattern
To restrict access to a package	["**"]	["<package>/**"]
To restrict access to a version	["**"]	["<package>/<version>"]
To restrict access to major versions 2	["**"]	["<package>/2.*"]
To grant access to two packages only	["<package-1>/**", "<package-2>/**"]	[]

PyPIPyPI

The patterns are applied to the path in <package>/<version>/<file> format, e.g., requests/2.31.0/requests-2.31.0.tar.gz.

Description	Include pattern	Exclude pattern
To restrict access to a package	["**"]	["<package>/**"]
To restrict access to a version	["**"]	["<package>/<version>/**"]
To restrict access to a file	["**"]	["<package>/<version>/<file>"]
To restrict access to major versions 2	["**"]	["<package>/2.*/**"]
To grant access to two packages only	["<package-1>/**", "<package-2>/**"]	[]

BinaryBinary

The patterns are applied to the path in <package>/<version>/<file> format. <package> may contain several segments, e.g., tools/cli.

Description	Include pattern	Exclude pattern
To restrict access to a package	["**"]	["<package>/**"]
To restrict access to a version	["**"]	["<package>/<version>/**"]
Prohibiting file download	["**"]	["<package>/<version>/<file>"]
To restrict access to a namespace	["**"]	["<namespace>/**"]
To grant access to two packages only	["<package-1>/**", "<package-2>/**"]	[]

GoGo

The patterns are applied to the path in <module>/<version>/<file> format.

Specifics:

• The version prefix, v, gets removed, i.e., v1.5.2 becomes 1.5.2, so you should use foo/bar/1.5.2/** instead of foo/bar/v1.5.2/**.
• The suffixes of the module's major versions get removed (/v2, /v3, and so on). For the registry.yandex.cloud.net/foo/bar/v2@v2.1.0 module, the path should be foo/bar/2.1.0.
• The path does not include the registry.yandexcloud.net prefix.

Description	Include pattern	Exclude pattern
To restrict access to a module	["**"]	["<module>/**"]
To restrict access to a version	["**"]	["<module>/<version>/**"]
To restrict access to a file	["**"]	["<module>/<version>/<file>"]
To restrict access to major version 2.x.x	["**"]	["<module>/2.*/**"]
To restrict access to pre-release versions	["**"]	["<module>/*-*/**"]
To restrict access to namespaces, e.g., myorg/cli and myorg/server	["**"]	["myorg/**"]
To grant access to two modules only	["<module-1>/**", "<module-2>/**"]	[]

DebianDebian

A Debian registry stores artifacts in three independent namespaces:

• pool/: Binary packages (.deb), with paths formatted as pool/<component>/<architecture>/<package_name_first_letter>/<package>/<version>/<package>_<version>_<architecture>.deb, e.g., pool/main/amd64/n/nginx/1.18.0-6.1/nginx_1.18.0-6.1_amd64.deb.
• dists/: Repository metadata, e.g., dists/<distribution>/Release, dists/<distribution>/InRelease, dists/<distribution>/<component>/binary-<arch>/Packages, etc.
• uploads/: Buffer for the files you are uploading before they reach pool/. The path is uploads/<file>.

The patterns apply to the storage path which is not always the same as the URL.

Description	Include pattern	Exclude pattern
To restrict access to a distribution	["**"]	["dists/<distribution>/**"]
To restrict access to a non-free component	["**"]	["pool/non-free/**", "dists/*/non-free/**"]
To restrict access to an i386 architecture	["**"]	["pool/*/i386/**", "dists/*/*/binary-i386/**"]
To restrict access to a package	["**"]	["pool/*/*/*/<package>/**"]
To restrict access to a version	["**"]	["pool/*/*/*/<package>/<version>/**"]