8.11. Immutable tags overview
Immutable tags allow users to lock specific image tags to prevent them from being overwritten, modified, or deleted. This ensures a stable, trusted reference for builds and releases, meeting strict regulatory and compliance requirements.
When a tag is marked as immutable, the system blocks tag overwrites, manual or programmatic deletions, and auto-pruning by background workers. Additionally, manifest labels associated with an immutable tag cannot be changed.
Immutability can be applied to tags in organizations and organization-owned repositories through three methods:
- Individual Tag Settings: Users with write access can manually toggle the immutable status of a specific tag via the Red Hat Quay v2 UI or the API.
-
Immutability Policies: Administrators can define regex patterns (for example,
release-*) at the organization or repository level. Any tag pushed that matches the pattern is automatically marked as immutable. -
Manifest Labels: Developers can trigger immutability during the build process by including the
quay.immutable=truelabel in their Dockerfile or Containerfile.
Immutable tags are not available for personal user namespaces.
8.11.1. Managing tag immutability by using the Red Hat Quay v2 UI 링크 복사링크가 클립보드에 복사되었습니다!
To prevent a tag from being changed or deleted, you can manage its immutability by using the Red Hat Quay v2 UI. Use the Tag menu to set or remove immutability for a tag.
Prerequisites
- You have logged into Red Hat Quay.
-
You have set
FEATURE_IMMUTABLE_TAGStoTruein yourconfig.yamlfile.
Procedure
- On the Red Hat Quay v2 UI, click Organizations and then the name of the organization where the tag is located.
- Click the name of the repository where the tag is located.
- Click Tags in the navigation pane.
- For the tag that you want to make immutable, click the menu kebab icon and then click Make immutable.
- Optional: To remove the immutability policy, click the menu kebab icon and then click Remove immutability.