Docs

Container Registry

Tag immutability rule management

Creating tag immutability rules

CR offers tag immutability rules. This prevents pushed image tags from being overwritten by subsequent pushes, thereby mitigating the risk of accidental image tag overwrites.

tip

This operation is supported for Standard Edition instances only and is not supported for proxy cache registries.

Considerations

Image tags that match the tag immutability rule cannot be deleted manually or deleted through tag retention rules. If you need to delete a corresponding tag, modify or delete the tag immutability rule so that it no longer applies to the target image tag.

You can enable a maximum of 15 tag immutability rules. Once the limit is reached, no new rules can be created.

Procedure

Select the target region in the top navigation bar.

In the left navigation pane, click Instance list. Select an entry point depending on your instance type:

Standard instance: Click Standard instance. Find the target instance and click Enter instance.

Proxy repository: Click Proxy cache. Click the target domain name to enter the instance details page.

In the left navigation pane of the instance page, click Tag immutability.

On the Tag immutability page, click Create tag immutability rule.

Enter the rule configuration information.

tip

By default, all image tags in the repository except latest are immutable.

Configuration item	Description
Name	A custom name of the tag immutability rule.
Description	A custom description of the tag immutability rule.
Effective namespace	Select the namespace to which the rule applies. You can only select one namespace per rule.
OCI artifact repository	Filter the target OCI artifact repository and artifact version, two methods are supported: Match and Exclude . Separate multiple expressions with commas (,). The following matching methods are supported: Exact match: Exactly matches the specified name. Example: myrepo. Full match: Matches all repositories or versions. Enter *. Prefix match: Matches names that start with the specified characters. Example: repo. Suffix match: Matches names that end with the specified characters. Example: repo. Partial match: Matches names with specified beginning and ending characters and any characters in between. Example: rpo.
Version
Enable now	Specifies whether to enable the rule upon creation.

Click Confirm to complete the operation.

Last updated: 2026.09.23 14:37:23