FAQ about Container Registry

Why is the tag missing or not set on the most recently uploaded Docker image?Why is the latesttag missing or not set on the most recently uploaded Docker image?

The reason is that you specified a different tag when pushing the Docker image.

The Docker client automatically assigns the latest tag if a Docker image is built and pushed without a tag. You can also specify the latest tag explicitly.

We recommend using a unique tag for each Docker image version rather than overwriting existing tags. This allows you to use the same Docker image version on all VMs with the same specification, making troubleshooting easier.

How do I make a registry public?How do I make a registry public?

You can grant the container-registry.images.puller role for your registry to the All users public group.

I got an error. What should I do?I got an error. What should I do?

See Troubleshooting in Container Registry for a list of common errors and fixes.

Can I get logs of my operations in Yandex Cloud?Can I get logs of my operations in Yandex Cloud?

Yes, you can request information about operations with your resources from Yandex Cloud logs. Do it by contacting support.

What does this error mean: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock?What does this error mean: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock?

You are not running commands as the root user.

You can use sudo or configure non-root access.

How do I diagnose Credential Helper performance?How do I diagnose Credential Helper performance?

• Check which operating system user and host are used to run the CLI commands. This must be a user with a Credential Helper configured on whose behalf the yc container registry configure-docker command was run. The relevant entry should appear in the /home/<user>/.docker/config.json file. If using a virtual machine, make sure a credential helper is configured there as well.

• Check whether a credential helper is available in the PATH environment variable when running commands. During authentication to Container Registry via a credential helper, Docker accesses the docker-credential-yc binary file. Make sure this binary file is available in the PATH environment variable for the user working with Docker. For example, if you are using Docker with sudo, then configure-docker should also be called with sudo. You can check it using the following command: echo cr.yandex | docker-credential-yc get or echo cr.yandex | sudo docker-credential-yc get, if the commands are called using sudo. If everything works, the output will look as follows: {"Username":"iam","Secret":"***<IAM_token>***"}.

• If the commands work in interactive mode but fail in non-interactive mode, check the .bashrc file. The yc and docker-credential-yc programs are installed into a directory that is not normally accessible in the default PATH. The following lines get written into the .bashrc file:

  # The next line updates PATH for Yandex Cloud CLI
  if [ -f '/home/<user>/yandex-cloud/path.bash.inc' ]; then source '/home/<user>/yandex-cloud/path.bash.inc'; fi
  

  The top section of the .bashrc file contains a condition stating that the commands listed there must not run non-interactively. Due to this condition, the commands can run when you access the VM manually but fail to run over SSH.

What does this error mean: Error response from daemon: pull access denied for <cr.yandex/registry_ID/Docker_image_ID>, repository does not exist or may require 'docker login': denied: Permission denied ; requestId = <request_ID>"?What does this error mean: Error response from daemon: pull access denied for <cr.yandex/registry_ID/Docker_image_ID>, repository does not exist or may require 'docker login': denied: Permission denied ; requestId = <request_ID>"?

The IP address sending the Docker image pull request has no PULL permissions.

Add allow rules for this IP address in the registry settings, or remove all rules and try again.