Storage and cleanup
Everything stored under your Registry Namespace counts: every tag of every repository. The Usage panel on the Overview tab reads the current figure live, and a background measurement runs once an hour. That hourly figure is the one billing and the storage cap act on.
The allowance
| Tier | Included storage | Above the allowance |
|---|---|---|
| Free | 1 GB (1,024 MB) | Pushes are blocked |
| Paid | 1 GB (1,024 MB) | €0.015 per GB per month |
A paid registry has no hard ceiling. It keeps accepting pushes and the storage beyond the first gigabyte is billed by usage.
When a free registry fills up
The status on the Overview tab changes to Storage full and the page explains: Your free storage allowance is used up. New pushes are blocked, pulls keep working. Delete images to get back under the limit.
Pulls are left working on purpose. The cap is about stored bytes, so writes are what have to stop, and a pull secret that suddenly failed would take your running workloads down at the next pod restart, which is a far larger consequence than the overage that caused it.
To recover, delete images until you are under the cap. The next hourly measurement puts the registry back to Active by itself. Nothing else clears the state, so a registry left over the cap stays read-only.
Deleting images
On the Overview tab, open a repository under Repositories to see its tags. You can delete a single tag or the whole repository, and both are permanent. Deletion works even while the registry is over its cap, which is what makes recovery possible.
Cleanup rules
The Cleanup Rules tab applies retention automatically. Each rule names a repository, a type and a value:
| Rule type | The value is | What it deletes |
|---|---|---|
| Keep last N tags | how many tags to keep | tagged images beyond the N most recently updated |
| Delete tags after N days | an age in days | tags not updated for that long |
| Delete untagged after N days | an age in days | manifests with no tag, older than that |
Repository is * by default, which covers every repository in the registry, including ones you create later. A single repository name restricts the rule to that one.
Keep Patterns and Delete Patterns are comma-separated glob patterns matched against the tag, for example v*,latest,main. A tag matching a keep pattern is never deleted. If any delete pattern is set, only tags matching one of them are eligible at all. Patterns do not apply to untagged manifests, so a Delete untagged rule removes everything old enough regardless of what you typed.
Rules run once a day, at 03:00 UTC. Creating one deletes nothing immediately.
Delete tags after N days counts age, not use
Age is measured from the last push, not the last pull. A tag that has not been rebuilt for N days is deleted even when it is the exact tag your production deployment is running, and the next pod restart then fails to pull. Before enabling a rule of this type, protect your release tags with a Keep Patterns entry such as v*,latest,main.
The list only shows rules for all repositories
The Cleanup Rules tab lists rules whose Repository is *. A rule you create for one named repository is saved and does run on schedule, but it never appears in that list, which makes it easy to create a second copy by accident and leaves no way to edit or delete it from the portal.
A Keep last N tags rule depends on the registry reporting when each tag was last updated. If those timestamps are unavailable for a repository, the rule skips that repository for that run rather than guess which tags are newest, so an occasional run can delete nothing.
What's next
- Access tokens for the credentials pushes and pulls use
- Container registry for the Registry Namespace and a first push