Preparing for Container Registry

Find out about the prerequisites you have to meet before you can use Container Registry.

Before you can push and pull Docker images to and from Oracle Cloud Infrastructure Registry (also known as Container Registry):

• You must have access to an Oracle Cloud Infrastructure tenancy. The tenancy must be subscribed to one or more of the regions in which Container Registry is available (see Availability by Region).
• You must have access to the Docker CLI (for example, to push and pull images on a local machine, you'll need to have installed Docker on the local machine).
• You must either belong to a group to which a policy grants the appropriate permissions, or belong to the tenancy's Administrators group. See Policies to Control Repository Access.
• You must have an Oracle Cloud Infrastructure auth token. If you don't have an auth token already, see Getting an Auth Token.

To configure a pull-through cache repository, you need:

• Permission to create a container repository in the selected region.

• An Upstream URL identifying a supported upstream Container Registry endpoint in a different OCI region within the same OCI realm, followed by the upstream tenancy namespace and repository path. When the top-level capability is enabled, this URL identifies an upstream path prefix. See Creating a Repository for URL formats and examples.

• The username of an upstream identity authorized to pull images from the configured upstream path.

• The OCID of a secret in OCI Vault containing that upstream identity's authentication credential.

• An IAM policy in your tenancy allowing the Container Registry pull-through resource principal to read that secret from OCI Vault.

For more information, see Using Pull-Through Cache Repositories.