Troubleshooting and frequently asked questions on CloudFerro Cloud
A failed login, push, or pull can stop your work without making the cause clear. Similar symptoms can come from credentials, project policies, or storage limits.
Matching the message to the table below helps you narrow down the cause and choose what to check next. The frequently asked questions also clarify token access, scans, quota changes, and other service behavior.
Identify where the failure occurs
Portal access: confirm the portal address, organization, and region. If Container Registry is missing or access is denied, ask the organization administrator to check service availability and your product role.
Client login: check the registry endpoint, full token user name, secret, and expiry. A portal password is not the registry token secret.
Upload: after login succeeds, check Push permission, the target project, available quota, and whether the tag is protected. A proxy cache project does not accept uploads.
Download: check the full container image address and the token’s project, then inspect any vulnerability or signature policy named in the error.
Use the exact message in the table below to choose the next check.
Troubleshooting
Symptom or message |
Likely cause |
What to do |
|---|---|---|
unauthorized / UNAUTHORIZED on push or pull |
Not logged in, wrong user name, wrong or expired secret, or an anonymous pull from a private project |
Log in again with the full name robot$<project>+<name> in single quotes. Check the token expiry. |
docker login fails although the secret is correct |
The shell expanded $ in the user name |
Quote the user name: -u ‘robot$my-project+ci-push’. |
Push refused (denied or unauthorized to access repository) although login succeeded |
The token has Pull only, or the target is a proxy cache project |
Use a token with Push. Push to a standard project. |
DENIED: adding X of storage resource, which when updated to current usage of Y will exceed the configured upper limit of Z. |
The project quota is full |
Delete unused artifacts or run tag retention, then push again. |
PRECONDITION: … configured as immutable |
The tag is protected by an immutability rule |
Push a new tag. Change the rule only if overwriting is really intended. |
Pull refused because of vulnerabilities |
Prevent vulnerable images from running is on |
Review the report and fix the affected container image. If an exception is needed, ask the project administrator to assess the CVEs before changing the allowlist or policy. |
Pull refused for an unsigned container image |
Cosign or Notation enforcement is on |
Sign the artifact by digest and pull again. |
Container image path not found, or pushed to the wrong place |
The registry host or project is missing in the path |
Use registries.waw4-1.cloudferro.com/<project>/<repository>:<tag>. |
NOT SCANNED after a push |
Scan on push is off |
Turn on Automatically scan images on push or run Scan vulnerabilities. |
Resource not found on the Vulnerabilities tab |
The artifact has no scan report yet |
Follow Manual scan. |
Project delete refused |
Immutable tags in the project |
Remove the tag immutability rules and delete again. |
Project name rejected |
Uppercase letters, a leading or trailing separator, or repeated separators |
Follow the rules in Create a project. |
Quota value rejected |
Outside 10-100 GiB |
Enter a value in the range. |
API: 403, code raas.resource_group.restricted or raas.resource_group.suspended |
The organization’s resource group is restricted or suspended |
Contact support about the account status. See Get help. |
Blank page in the project view |
Temporary portal loading problem |
Reload the page. |
FAQ
Which registry host do I use?
registries.waw4-1.cloudferro.com for the waw4-1 region. The container image path is
<host>/<project>/<repository>:<tag>.
Can I log in with my portal user name and password in docker login?
Use an access token. It is the supported way for CLI tools and CI/CD.
Can a token be limited to one repository?
No. A token covers the whole project. Use separate projects when applications or teams must have access to different sets of repositories. Within one project, you can create separate tokens for each application or team.
I lost the token secret. Can I see it again?
No. Rotate the token or create a new one, then update the systems that use it.
Can I change the project quota later?
The quota is chosen when the project is created. If you need to change an existing project’s quota, contact support to confirm the available options. See Get help.
Does a scan block my push?
No. Scanning runs after the push. Prevent vulnerable images from running and signature enforcement can block pulls. Pulls can also fail because of authentication or access problems.
Is the SBOM generated automatically?
Yes, on push, when scanning on push is on. Otherwise select Generate SBOM.
Can I convert an existing project into a proxy cache?
No. Create a new project with Proxy cache turned on.
Are my container images copied to other regions?
No. Registry replication is not part of the service.
Is there a separate registry web UI?
No. Use My Portal, the Management API, or Terraform.
If the checks above do not resolve the issue, collect the exact error text and the failed operation. Do not include token secrets or signing private keys.
Get help
For help with access or account problems, use Helpdesk and Support.
My Portal also provides Tickets for support requests. Include the portal domain, organization, region, project and repository where relevant, the time of the failure, the steps that led to it, and the displayed message. State whether the failure happened in the portal or in a container client. This helps route the request to the portal or Container Registry team.
What to do next
Recheck client credentials with Access tokens and logging in on CloudFerro Cloud.
Review vulnerability and signature settings in Scan and sign container images on CloudFerro Cloud.
Review tag protection and cleanup rules in Tag immutability and retention on CloudFerro Cloud.