FAQ

Private Container Registry is a fully managed service provided by IONOS CLOUD that allows you to provision one or more dedicated Docker registries, enabling you to securely store and manage your own container images without relying on external providers like Docker Hub. The service is hosted in Germany and is compliant with GDPR.

IONOS CLOUD Private Container Registry is a fully managed service that allows you to provision one or more dedicated Docker registries. It enables you to securely host and manage your own container images within your infrastructure, eliminating the need for external providers like Docker Hub.

You can create a Private Container Registry using the DCD or the IONOS CLOUD APIs.

For a complete list of benefits, see Features and Benefits.

Yes, for more information, see Create Registry Token.

You can find more information in the Docker Documentation or also refer to the Docker Registry HTTP API V2 documentation.

For a complete list of limitations, see Limitations.

Although you can access all Private Container Registries via the public internet, you cannot configure the repositories for public access. You must always use an authentication token with the appropriate permissions to connect.

Vulnerability scanning is an add-on feature for your Private Container Registry that analyzes known software in your container images against known security vulnerabilities (or CVEs) that may put your infrastructure, applications or data at risk.

CVE stands for Common Vulnerability and Exposure Report, which lists disclosed information regarding security vulnerabilities in publicly released software.

We review multiple sources of information for any given CVE. These sources may independently score the risk differently. Hence, we constantly expose the highest score reported by the sources.

The Common Vulnerability Scoring System (CVSS) is used for calculating the severity of a CVE based on many factors (base, temporal and environmental).

CVSS assessment produces a number between 0-10 with 10 being the most severe rating. A CVSS qualitative rating systems helps simplify CVE severity classification, as follows:

The threat landscape is ever-changing, and we cannot guarantee that all vulnerabilities are detected.

New CVEs are published constantly, and existing CVEs may be revised over time, either increasing, or decreasing in severity.

The threat landscape is ever-changing. New vulnerabilities are identified in software constantly, but only when they are publicly published can they be detected in your images.

Vendors and security researchers may choose not to announce certain vulnerabilities and exploits when they are first identified. This is usually the case if the vulnerability is particularly straightforward to exploit and is of high consequence. This gives software vendors time to analyze and fix or mitigate the issue.

Sometimes, a CVE may show up in your reports as being fixable. It means that the affected software is vulnerable only in specific versions of a package; the vendor may have released an updated version that fixes the vulnerability, or there may be other mitigations that the software vendor suggests to limit or negate the vulnerability.

The answer to this varies on a case-by-case basis. For more information, see What is the meaning of fixable?. Upgrading to the latest version of a software package may resolve the issue. Review the CVE details for a specific vulnerability and recommendations, if available, to determine the steps to resolve the issue.

At certain times, there may be no fix or mitigation available. In these situations, analysis of the risk and awareness can assist with managing information security risks your business is exposed to. For more information, see How can I reduce my exposure to Vulnerabilities.

While it is important to be aware of vulnerabilities in your software, it is not always immediately possible to resolve them. For more information, see How can I reduce my exposure to Vulnerabilities.

The vulnerability scanning service monitors for changes in published CVE reports. Images held in your Private Container Registry that have been pushed or pulled recently (in the past 30 days) are rescanned as new information on vulnerabilities becomes available.

This also means that your vulnerability reports will be updated to reflect criticality changes if a vulnerability is reclassified. For example, if a particular vulnerability is downgraded in severity from Critical to High, your reports will be updated to reflect this.

For more information, see How are vulnerabilities scored?.

Not all containers and their packages can be scanned successfully. If your image shows a Last Scan time and Unknown vulnerability status, the scanning engines may be unable to process the image. We monitor for these situations and regularly review the scanning techniques to ensure these are kept to a minimum.

Sometimes, an image may display an Unknown vulnerability status and lack a Last Scan time. It can occur when the repository name is less than two characters long or exceeds 255 characters. While it is technically allowed to name a repository with a single character, such names do not meet the scanning engine's requirements. To address this issue, push your image again using a repository name between 2 and 255 characters.

It is also possible that the scanning of your container may still need to be completed. If your vulnerability report for an image does not show the Last Scan time, check again later when the scanning is complete.

Typically, scanning an image takes only a few seconds, but this depends on many factors, such as the size of the image, the number of layers, and the number, and types of packages installed.

Yes, vulnerability scanning is non-blocking, and your image can be pulled at any time.

Maintaining good container hygiene practices helps to reduce your exposure:

Several software installation guides recommend using curl-pipe-bash. Example: curl https://source-reposotory.tld/install.sh | bash

We recommend that you avoid this method. You may review the install.sh script at the first build, but if a malicious actor can modify that script later, your container build could be compromised.

No, container vulnerability scanning is a read-only operation. The content of your image remains unchanged.

Storage metrics do not always drop immediately after garbage collection finishes. This behavior typically happens for one of three reasons:

Test the deletion by attempting to pull the specific image manifest using its digest. If the deletion succeeded, the Private Container Registry will reject the request and return a 404 Not Found error:

Allow up to 24 hours after the garbage collection process completes for the underlying cloud infrastructure to sync and update your billing dashboard metrics.

Your Private Container Registry typically remains in read-only mode for one of two reasons:

Wait a few minutes and refresh the DCD. If the issue persists, contact IONOS CLOUD Support.

You can verify if an image is still referenced by using the API to fetch its manifest with the following command:

When you request a manifest deletion, the endpoint returns an HTTP 202 status to confirm it accepted the request. Any subsequent calls you make to this endpoint return an HTTP 404 status.