Your responsibilities when you are using Container Registry

Learn about the management responsibilities and terms and conditions that you have when you use IBM Cloud® Container Registry.

For a high-level view of the service types in IBM Cloud and the breakdown of responsibilities between the customer and IBM for each type, see Shared responsibilities for IBM Cloud offerings.

Review the following sections for the specific responsibilities for you and for IBM when you use IBM Cloud Container Registry. For the overall terms of use, see IBM Cloud Terms and Notices.

Incident and operations management

Incident and operations management includes tasks such as monitoring, event management, high availability, problem determination, recovery, and full state backup and recovery.

Table 1. Responsibilities for incident and operations
The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.
Task	IBM Responsibilities	Your Responsibilities
Data incidents.	It is the responsibility of IBM to inform you if your data is lost.	Not applicable
Ensure that the application is available.	It is the responsibility of IBM to inform you if the application is not available.	Not applicable
Track events.	It is the responsibility of IBM to ensure that IBM Cloud Activity Tracker is tracking events.	It is your responsibility to monitor events by using IBM Cloud Activity Tracker to ensure that your application is being accessed only by users with the correct authority. It is also your responsibility to ensure that an Activity Tracker instance is set up to receive events. For more information, see Auditing events for Container Registry.

Change management

Change management includes tasks such as deployment, configuration, upgrades, patching, configuration changes, and deletion.

Table 2. Responsibilities for change management
The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.
Task	IBM Responsibilities	Your Responsibilities
Provisioning.	It is the responsibility of IBM to provision the service.	Not applicable
Deprovisioning.	It is the responsibility of IBM to deprovision the service.	Not applicable
Update package versions.	Not applicable	It is your responsibility to update package versions inside container images. You can use Vulnerability Advisor to identify the required updates. For more information, see Managing image security with Vulnerability Advisor.

Identity and access management

Identity and access management includes tasks such as authentication, authorization, access control policies, and approving, granting, and revoking access.

Table 3. Responsibilities for identity and access management
The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.
Task	IBM Responsibilities	Your Responsibilities
Authentication	It is the responsibility of IBM to implement authentication.	Not applicable
Process access policies	It is the responsibility of IBM to ensure that the policies are processed.	Not applicable
Set up access policies	Not applicable	It is your responsibility to set up access policies. For more information, see Creating policies.
Access to back-end resources	It is the responsibility of IBM to access to back-end resources.	Not applicable
Access to namespaces	Not applicable	It is your responsibility to set up access to namespaces. For more information, see Automating access to IBM Cloud Container Registry.

Security and regulation compliance

Security and regulation compliance includes tasks such as security controls implementation and compliance certification.

Table 4. Responsibilities for security and regulation compliance
The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.
Task	IBM Responsibilities	Your Responsibilities
Secure confidential information.	Not applicable	It is your responsibility to make sure that no confidential information is put into your images.
Ensure that the service instance is secure.	It is the responsibility of IBM to ensure the security of the service instance.	Not applicable

Disaster recovery

Disaster recovery includes tasks such as the following tasks:

Providing dependencies on disaster recovery sites
Provisioning disaster recovery environments
Backing up data and configuration
Replicating data and configuration to the disaster recovery environment
Fail over on disaster events

For more information, see High availability for Container Registry and Business continuity and disaster recovery for Container Registry.

Table 5. Responsibilities for disaster recovery
The first column describes the task that the customer or IBM might be responsible for. The second column describes IBM responsibilities for that task. The third column describes your responsibilities as the customer for that task.
Task	IBM Responsibilities	Your Responsibilities
Copy your data to another region.	Not applicable	It is your responsibility to copy the data to another region. For more information, see Regions.
Restore the contents of the data in a single region.	It is the responsibility of IBM to restore the contents of the data in a single region.	Not applicable