Docs

Container Registry

Robot account management

Creating robot accounts

Robot accounts are only affected by the instance status and are not affected by changes to IAM users. This topic describes how to create a robot account.

tip

This operation applies only to Standard Edition instances.

Limits

Each root user can create up to 20 robot accounts. Creation fails if this limit is exceeded.

Background

The availability of accounts associated with individual users (such as IAM users) can be affected by personnel changes. Events like employee departure or role changes can cause the corresponding IAM user to be unavailable, leading to failures in related tasks. One example is an image pull task in a CI/CD automation system that relies on an IAM user.

Using robot accounts created at the instance level, which are not associated with IAM users, can effectively prevent issues in such scenarios.

warning

When you push or pull images via Docker, ensure you use Docker version 1.19 or later to avoid failures.

Procedure

Select the target region in the top navigation bar.

In the left navigation pane, click Instance list. Select an entry point depending on your instance type:

Standard instance: Click Standard instance. Find the target instance and click Enter instance.

Proxy repository: Click Proxy cache. Click the target domain name to enter the instance details page.

In the left navigation pane of the instance details page, click Robot account.

On the Robot account page, click Create robot account.

Configure robot account parameters.

warning

We recommend that you set a specific expiration time or regularly reset the password to prevent account leakage.

Configuration item	Description
username	Customize the name of the robot account.
Password	Set the login password of the robot account. You can use an auto-generated password or enter one manually. Automatic generation: After you complete the configuration and click Confirm, the password is automatically generated. The automatically generated password is displayed only once. Save it properly. Manual input: Enter a password manually. The password must contain upper and lower case letters, and at least one digit or special character. The length must be 8 to 20 characters.
Description	Customize the description of the robot account.
Expiration time	Set a validity period for the robot account. Never expire: No expiration time. The account will not expire. Specified days: The account expires after the specified number of days. Unit: day.
Permission configuration	You can configure robot account permissions by namespace and project. Permission scopes: Specify namespace: Select the namespace to be authorized. Specify project: Select the project to be authorized. The namespace associated with the project will be authorized. All namespaces (including new ones): Both existing and new namespaces are authorized. Authorization level: Read only: Allows viewing resources but no operations in the target namespace. The account can pull images from, but cannot push images to, the target namespace. Read-write: Allows all read and write operations in the namespace. The account can push images to and pull images from the namespace.

Click Confirm to complete the operation.

What to do next

Use robot account to push and pull images

After creating a robot account, you can use the account name and password of the robot account to log in to the CR instance in CI/CD pipelines, automation scripts, or container clusters. Then, you can push or pull images. This topic provides sample commands for reference. For complete operation instructions, see Pushing and pulling artifacts.

Use the robot account to log in to the CR instance.

docker login [instance-name]-[region].cr.volces.com --username [robot-account-name] --password [robot-account-password]

Push or pull images.

Pushing Images
Pulling Images

After logging in successfully, execute the following commands to push the local image to the CR instance.

# Tag the local image
docker tag [local-image-name]:[tag] [instance-name]-[region].cr.volces.com/[namespace]/[repository-name]:[tag]

# Push image
docker tag [local-image-name]:[tag] [instance-name]-[region].cr.volces.com/[namespace]/[repository-name]:[tag]

If the system displays information similar to the following, it indicates that you have successfully pushed the image.

Last updated: 2026.09.23 14:37:24