Migrating container images between different namespaces in the same IBM Cloud Container Registry region

A common question that we receive is about how to migrate images between namespaces in IBM Cloud Container Registry more easily. The obvious solution might be to use a registry client such as skopeo to copy the images from the source to the destination. While this solution will work, it would mean that all the data would have to be downloaded to the local machine and then uploaded back to the registry, which is both time consuming and expensive (if you are using public bandwidth). 

In this blog I explain how you can take advantage of the ibmcloud cr image-tag command to do the migration server side even if the namespaces are owned by different accounts. 

Before you start, ensure that you meet the following prerequisites:

•             The two namespaces are in the same IBM Cloud Container Registry region.
•              You have a user that has the appropriate access to both namespaces. This access must be “reader” on the source namespace and “writer” on the destination namespace.

If you meet the prerequisites, you can use the following steps to complete the migration:

1.  Log in with ibmcloud login and target the account that owns the source namespace. If you want to migrate namespaces cross account you must login with username and password or SSO and not an apikey.
2.  Copy of the following script and run it.
   
   

#!/bin/bash
set -e

SRC_NAMESPACE="Insert source namespace"
TARGET_NAMESPACE="Insert destination namespace"

# List all the images in the target namespace
IMAGES=$(ibmcloud cr images --restrict "${SRC_NAMESPACE}" --format '{{.Repository}}:{{.Tag}}')

# For each target image image-tag it to the destination namespace.

for image in ${IMAGES} ; do
    TARGET_IMAGE="${image/$TARGET_NAMESPACE/"$SRC_NAMESPACE"}"
    ibmcloud cr image-tag "$image" "$TARGET_IMAGE"
done

The previous script copies all the images from the source to the destination. However, you can use of some of the functionality that is provided by the Go templating that the Container Registry passes to `--format` to do some more advanced scenarios. For example, the following script copies images that were built in the last 30 days.

#!/bin/bash
set -e

# ibmcloud login and target the account that the SRC_NAMESPACE belongs too (so that the image list finds the source images)

SRC_NAMESPACE="registry-tests"
TARGET_NAMESPACE="migrate-test"

# List all the images in the target namespace
day=$((60*60*24))
thirtydaysago=$(($(date +%s) - 30*$day))

# List all the images in the target namespace that are less than 30 days old
IMAGES=$(ibmcloud cr images --restrict "${SRC_NAMESPACE}" --format '{{ if (gt .Created '$thirtydaysago')}}{{.Repository}}:{{.Tag}}{{end}}')

# For each target image image-tag it to the destination namespace.
for image in ${IMAGES} ; do
    TARGET_IMAGE="${image/$TARGET_NAMESPACE/"$SRC_NAMESPACE"}"
    ibmcloud cr image-tag "$image" "$TARGET_IMAGE"
done

Useful Links

-              https://cloud.ibm.com/docs/Registry?topic=Registry-containerregcli#bx_cr_image_tag

-              https://cloud.ibm.com/docs/Registry?topic=Registry-iam&interface=ui

-              https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview&interface=ui#registry_regions

-              https://cloud.ibm.com/docs/Registry?topic=Registry-registry_cli_list