Storage and cleanup
Everything stored under your Registry Namespace counts: every tag of every repository. The Usage panel on the Overview tab reads the current figure live, and a background measurement runs once an hour. That hourly figure is the one billing and the storage cap act on.
The allowance
| Tier | Included storage | Above the allowance |
|---|---|---|
| Free | 1 GB (1,024 MB) | Pushes are blocked |
| Paid | 1 GB (1,024 MB) | €0.015 per GB per month |
A paid registry has no hard ceiling. It keeps accepting pushes and the storage beyond the first gigabyte is billed by usage.
When a free registry fills up
The status on the Overview tab changes to Storage full and the page explains: Your free storage allowance is used up. New pushes are blocked, pulls keep working. Delete images to get back under the limit.
Pulls are left working on purpose. The cap is about stored bytes, so writes are what have to stop, and a pull secret that suddenly failed would take your running workloads down at the next pod restart, which is a far larger consequence than the overage that caused it.
To recover, delete images until you are under the cap. The next hourly measurement puts the registry back to Active by itself. Nothing else clears the state, so a registry left over the cap stays read-only.
Deleting images
On the Overview tab, open a repository under Repositories to see its tags. You can delete a single tag or the whole repository, and both are permanent. Deletion works even while the registry is over its cap, which is what makes recovery possible.
Cleanup rules
The Cleanup Rules tab applies retention automatically. Each rule names a repository, a type and a value:
| Rule type | The value is | What it deletes |
|---|---|---|
| Keep last N tags | how many tags to keep, 1 to 1000 | tagged images beyond the N most recently updated |
| Delete tags after N days | an age in days, 1 to 3650 | tags not updated for that long |
| Delete untagged after N days | an age in days, 1 to 3650 | manifests with no tag, older than that |
Repository is * by default, which covers every repository in the registry, including ones you create later. A repository name restricts the rule to exactly that repository: nested repositories such as my-app/worker need a rule of their own, unlike token scopes. Names are relative to your namespace, the way the portal lists them under Repositories. A name that starts with <your-slug>/ is read as already including it. Picking a repository from the list in the create dialog always targets the right one.
Keep Patterns and Delete Patterns are comma-separated glob patterns matched against the tag, for example v*,latest,main. A tag matching a keep pattern is never deleted. If any delete pattern is set, only tags matching one of them are eligible at all. Patterns do not apply to untagged manifests, so a Delete untagged rule removes everything old enough regardless of what you typed.
Rules run once a day, at 03:00 UTC. Creating one deletes nothing immediately.
Delete tags after N days counts age, not use
Age is measured from the last push, not the last pull. A tag that has not been rebuilt for N days is deleted even when it is the exact tag your production deployment is running, and the next pod restart then fails to pull. Before enabling a rule of this type, protect your release tags with a Keep Patterns entry such as v*,latest,main.
A Keep last N tags rule depends on the registry reporting when each tag was last updated. If those timestamps are unavailable for a repository, the rule skips that repository for that run rather than guess which tags are newest, so an occasional run can delete nothing.
What's next
- Access tokens for the credentials pushes and pulls use
- Container registry for the Registry Namespace and a first push