Troubleshooting
Common issues you may hit anywhere in Container Registry, grouped by where they happen in the workflow. If your issue isn't listed, contact your Tenant Owner or Sales.
Activating the service
| Issue | Cause | Resolution |
|---|---|---|
| The Active button is not visible | You are not the Tenant Owner. | Select a tenant where you hold the Owner role, or ask the Tenant Owner to activate the service. |
| Can't find the login credentials after activating | The login credentials, tag, and push commands are only shown by hovering the ⓘ icon on the activation result screen. | Hover the ⓘ icon again, or get fresh credentials from Container Registry > Get Token. |
See Activate the service.
Managing repositories, artifacts, and tags
| Issue | Cause | Resolution |
|---|---|---|
| Deleted a Repository, Artifact, or Tag by mistake and can't get it back | Deletion is permanent by design — there is no undo. | Confirm you no longer need the resource before clicking Delete next time. Push the image again if you still need it. |
See Manage repositories.
Managing retention rules
| Issue | Cause | Resolution |
|---|---|---|
| Deleted a Retention Rule and it's gone | Deleting a Retention Rule is permanent and the rule no longer applies to later runs. | Confirm before deleting. Create a new rule if you need the same criteria again. |
| Can't set a different run time for individual Retention Rules | One Schedule applies to every Retention Rule in the Policy — you cannot configure separate schedules per rule. | Use a single shared Schedule for all rules, or run a specific rule manually with RUN NOW or DRY RUN instead. |
See Manage retention rules & runs.
Managing robot accounts
| Issue | Cause | Resolution |
|---|---|---|
| Deleted a Robot Account and CI/CD stopped working | Deleting a Robot Account is permanent, and any CI/CD pipeline using it immediately loses access. | Confirm before deleting. Create a new Robot Account and update your CI/CD configuration if access is still needed. |
| Lost the Robot Account Username or Token after creation | The Username and Token are displayed only once, right after creation. | Use ACTION REFRESH SECRET to generate a new Token, then update it wherever the Robot Account is used. |
docker login, docker pull, or docker push returns "unauthorized to access repository" | The Robot Account is disabled, deleted, or its Token has expired. | Re-enable the account, create a new one, or refresh the secret, then update the credentials wherever this Robot Account is used. |
| CI/CD fails to authenticate after refreshing a Robot Account secret | The old secret is still configured in the pipeline or system. | Update the new secret in every pipeline and system that uses this Robot Account right away. |
See Create a robot account and Manage robot accounts.
Managing service package & quota
| Issue | Cause | Resolution |
|---|---|---|
| Can't downgrade to a lower Service Plan | Container Registry supports upgrades only — downgrading is not supported. | Contact Sales if your plan needs no longer match a higher tier. |
| The Service Plan you need isn't listed under Update Type | Self-service upgrade only lists standard plans. | Contact Sales for assistance with a higher or custom Service Plan. |
See Manage service package & quota.
Pulling images into a cluster with kubectl
| Issue | Cause | Resolution |
|---|---|---|
ImagePullBackOff, Events show 401 Unauthorized | --docker-server doesn't match the host in the image name, or the credentials are wrong. | Decode the Secret and compare its auths block against the image name's host prefix. |
ImagePullBackOff, Events show not found | The image name or tag is wrong. | Check that the image exists on the registry. |
| The Secret looks correct but the Pod still fails | The Pod doesn't reference imagePullSecrets, or it's in a different namespace than the Secret. | Add imagePullSecrets to the Pod template, and confirm the Secret and Pod share a namespace. |
Error from server (AlreadyExists) | The Secret already exists — kubectl create doesn't overwrite it. | Pipe the command through kubectl apply instead so it's safe to re-run. |
The auths block is empty after decoding the Secret | Docker is storing the credential in an OS keychain ("credsStore" in config.json) instead of the auths block. | Re-create the Secret with kubectl create secret docker-registry directly. |
Password is correct but the pull still returns 401 | The shell altered a special character in the password. | Wrap the password in single quotes and re-create the Secret. |
Error from server (Forbidden) | Missing RBAC permission. | Run kubectl auth can-i create secret -n <namespace> to confirm. |