Managing

Managing Permissions

Grant clients access to specific repositories using pattern-based permissions. Deny by default.

Using an AI assistant? Give it this file.

/llms.md is a single Markdown file covering installation, configuration, quickstart, clients, upstreams, permissions, TLS, and production deployment. Copy it and paste it into your AI chat, or tell the AI to fetch https://drevnix.tech/llms.md.

Managing Permissions

Permissions define which repositories a client is allowed to pull. The default policy is deny-all. A client with no permissions cannot pull anything, regardless of which upstream registries exist.

Pattern syntax

Permission patterns follow the format [upstream-id]/[repository-path] with an optional trailing wildcard:

Pattern	What it allows
`*`	Everything: all upstreams, all repositories
`ghcr/*`	All repositories on the `ghcr` upstream
`ghcr/myorg/*`	All images under `myorg` on `ghcr`
`ghcr/myorg/api`	Exactly `ghcr/myorg/api` and nothing else
`dockerhub/library/*`	All official Docker Hub library images
`dockerhub/library/nginx`	Only the nginx image from Docker Hub

Rules:

Wildcards (*) can only appear at the end of a pattern
ghcr/*/api is not valid. Mid-path wildcards are not supported
A client can have multiple permission entries
If any permission matches the requested repository, access is granted
No match → 403 Forbidden

Creating a permission

Via portal: Permissions → Add Permission, or from the client’s detail page

Via API:

curl -X POST http://drevnix.company.com:8002/v1/permissions \
  -u admin:password \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "ci-pipeline-prod",
    "repository": "ghcr/myorg/*"
  }'

Listing permissions

All permissions:

curl http://drevnix.company.com:8002/v1/permissions \
  -u admin:password

Filtered by client:

curl "http://drevnix.company.com:8002/v1/permissions?client_id=ci-pipeline-prod" \
  -u admin:password

Deleting a permission

Access is revoked immediately:

curl -X DELETE http://drevnix.company.com:8002/v1/permissions/42 \
  -u admin:password

To change a permission pattern, delete the existing entry and create a new one.

Examples by use case

CI pipeline: only its own image:

{"client_id": "ci-pipeline-payments", "repository": "ghcr/myorg/payments"}

Developer: all company images plus official Docker Hub images:

{"client_id": "dev-alice", "repository": "ghcr/myorg/*"}
{"client_id": "dev-alice", "repository": "dockerhub/library/*"}

Contractor: single upstream, single org:

{"client_id": "contractor-alice", "repository": "ghcr/partner-org/*"}

Emergency read-all (use sparingly):

{"client_id": "ops-break-glass", "repository": "*"}