Questions and answers about Container Registry
latest
tag missing or why is it assigned to a Docker image that was not the last one pushed?
Why is the The reason is that you specified a different tag when pushing the Docker image.
The Docker client assigns the latest
tag automatically if the Docker image is created and pushed without a tag. You can also specify the latest
tag explicitly.
Warning
The tag latest
doesn't mean that the Docker image was the latest one pushed.
We don't recommend overwriting tags. Use a unique tag for each Docker image version. This way you can use the same Docker image version on all your VMs with identical specifications and more easily identify causes of problems.
I encountered an error. What should I do?
See Troubleshooting in Container Registry. It lists common errors and ways to solve them.
Can I get logs of my operations with services?
Yes, you can request log records about your resources from Nebius AI services. For more information, see Data requests.
What does the "Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock" error mean?
You are not running commands as a root
user.
You can use sudo
or configure non-root access
How do I diagnose Credential Helper performance?
-
Check under which OS user and on which host the CLI commands are run. This must be the user that the Credential Helper is configured for and on whose behalf the
ncp container registry configure-docker
command was run. The corresponding line must appear in the file/home/<user>/.docker/config.json
. If you are working on a virtual machine, make sure you have the Credential helper configured there as well. -
Check if the Credential Helper is displayed in
PATH
when running commands. During authentication in Container Registry using the Credential Helper, Docker accesses thedocker-credential-yc
binary file. Make sure this binary file is available inPATH
for the user working with Docker. For example, if Docker is used withsudo
, thenconfigure-docker
must be run withsudo
, too. You can check this with theecho cr.ai.nebius.cloud | docker-credential-ncp get
command or withecho cr.ai.nebius.cloud | sudo docker-credential-ncp get
if you're running commands withsudo
. If everything is working, you'll get a response in the format{"Username":"iam","Secret":"***<iam-token>***"}
. -
If the commands run in interactive mode but fail in non-interactive mode, check the
.bashrc
file. Theyc
anddocker-credential-yc
programs are installed in a directory that is not usually available in the defaultPATH
. In this case, the following lines are added to the.bashrc
file:# The next line updates PATH for Nebius AI CLI if [ -f '/home/<user>/nebius-cloud/path.bash.inc' ]; then source '/home/<user>/nebius-cloud/path.bash.inc'; fi
The top section of the
.bashrc
file contains a condition preventing its commands from running non-interactively. That is why the commands can run when connecting to the VM manually, but fail to run when doing so via SSH.