Huawei Cloud Swr Image Management

Huawei Cloud SWR Image Management

Overview

This skill provides lifecycle management capabilities for Huawei Cloud SWR (Software Repository for Container) images using the hcloud CLI.

Architecture: hcloud CLI → SWR Service API → Namespace/Repository/Tag/Auth/Quota resources

Related Skills:

• huawei-cloud-swr-image-governance - Image governance (permissions, retention, sharing, tags, immutable rules)
• huawei-cloud-swr-image-automation - Image automation ops (sync, triggers, domains)
• huawei-cloud-swr-enterprise-instance - Enterprise instance management

• Create and manage SWR namespaces (organizations)
• Create and manage image repositories with public/private settings
• Query and manage image tags/versions
• Obtain docker login credentials (temporary and long-term)
• Check SWR resource quotas

Typical Use Cases:

• "Create a SWR namespace for my project"
• "List all image repositories in namespace 'group-dev'"
• "Query image tags for repository 'nginx' in namespace 'group-dev'"
• "Get docker login command for SWR"
• "Delete an old image tag to clean up storage"
• "Check my SWR quota usage"
• "Create a private repository for my custom image"
• "Update repository description and visibility"

Prerequisites

1. hcloud CLI Requirements (MANDATORY)

• hcloud CLI installed (version >= 7.2.2)
• Run hcloud version to verify installation
• First-time usage: printf "y\n" | hcloud version to accept privacy statement

2. Credential Configuration

hcloud CLI supports two credential modes via environment variables, automatically detected at runtime:

Mode A — Long-term AK/SK (permanent access):

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

Mode B — Temporary AK/SK + SecurityToken (recommended for temporary or delegated access):

export HUAWEI_CLOUD_AK=<your-temp-ak>
export HUAWEI_CLOUD_SK=<your-temp-sk>
export HUAWEI_CLOUD_SECURITY_TOKEN=<your-security-token>
export HUAWEI_CLOUD_REGION=cn-north-4

When HUAWEI_CLOUD_SECURITY_TOKEN is present, hcloud CLI automatically uses temporary credential authentication. When only AK/SK are set, it uses long-term credential authentication.

• Security Rules:
• 🚫 Never expose AK/SK/SecurityToken values in code, conversation, or commands
• 🚫 Never use echo $HUAWEI_CLOUD_AK or echo $HUAWEI_CLOUD_SK to check credentials
• ✅ Use environment variables: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION, HUAWEI_CLOUD_SECURITY_TOKEN
• ✅ Prefer IAM users over root account for cloud operations
• ✅ Enable MFA for sensitive operations

⚠️ Important Security Notes:

• Never commit credentials to version control
• Use IAM users with minimal required permissions
• Enable MFA for sensitive operations
• Rotate AK/SK regularly

3. IAM Permission Requirements

See IAM Permission Policies for complete policy JSON.

Permission Failure Handling:

1. When any command fails due to permission errors, read references/iam-policies.md 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console and grant authorization 4. Pause execution and wait for user confirmation that permissions have been granted

Core Commands

1. Namespace (Organization) Management

See Task: Namespace Management for detailed workflows.

# List all namespaces
hcloud SWR ListNamespaces --cli-region=cn-north-4

# List namespaces with filter
hcloud SWR ListNamespaces --filter="namespace::group-dev|mode::visible" --cli-region=cn-north-4

# Show namespace details
hcloud SWR ShowNamespace --namespace=group-dev --cli-region=cn-north-4

# Create a namespace
hcloud SWR CreateNamespace --namespace=group-dev --cli-region=cn-north-4

# Delete a namespace (CAUTION: removes all repos under it)
hcloud SWR DeleteNamespaces --namespace=group-dev --cli-region=cn-north-4

Namespace Naming Rules:

• Start with lowercase letter
• Followed by lowercase letters, digits, dots, underscores, or hyphens
• Max 2 consecutive underscores
• Dots, underscores, hyphens cannot be directly connected
• End with lowercase letter or digit
• Length: 1-64 characters

2. Repository (Image Repository) Management

See Task: Repository Management for detailed workflows.

# List all repositories
hcloud SWR ListReposDetails --cli-region=cn-north-4

# List repositories in a namespace
hcloud SWR ListReposDetails --namespace=group-dev --cli-region=cn-north-4

# List repositories with pagination and sorting
hcloud SWR ListReposDetails --namespace=group-dev --limit=20 --offset=0 --order_column=updated_at --order_type=desc --cli-region=cn-north-4

# List repositories by category
hcloud SWR ListReposDetails --category=database --cli-region=cn-north-4

# Show repository details
hcloud SWR ShowRepository --namespace=group-dev --repository=nginx --cli-region=cn-north-4

# Create a repository
hcloud SWR CreateRepo --namespace=group-dev --repository=my-app --is_public=false --category=other --description="Custom app image" --cli-region=cn-north-4

# Update repository (change visibility, description, category)
hcloud SWR UpdateRepo --namespace=group-dev --repository=my-app --is_public=true --description="Updated description" --cli-region=cn-north-4

# Delete a repository (CAUTION: removes all image tags)
hcloud SWR DeleteRepo --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Repository Naming Rules:

• Start with lowercase letter or digit
• Followed by lowercase letters, digits, dots, slashes, underscores, or hyphens
• Max 2 consecutive underscores
• Dots, slashes, underscores, hyphens cannot be directly connected
• End with lowercase letter or digit
• Length: 1-128 characters

Repository Categories: app_server, linux, framework_app, database, lang, other, windows, arm

3. Image Tag (Version) Management

See Task: Tag Management for detailed workflows.

# List all tags in a repository
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --cli-region=cn-north-4

# List tags with pagination and sorting
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --limit=50 --offset=0 --order_column=updated_at --order_type=desc --cli-region=cn-north-4

# Search for a specific tag
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --filter="tag::v1.0" --cli-region=cn-north-4

# Show tag details (image digest, size, create time)
hcloud SWR ShowRepoTag --namespace=group-dev --repository=nginx --tag=v1.0 --cli-region=cn-north-4

# Create a tag (retag existing image)
hcloud SWR CreateRepoTag --namespace=group-dev --repository=nginx --source_tag=v1.0 --destination_tag=v1.0-stable --override=false --cli-region=cn-north-4

# Delete a tag (CAUTION: removes the image version permanently)
hcloud SWR DeleteRepoTag --namespace=group-dev --repository=nginx --tag=v1.0-old --cli-region=cn-north-4

4. Docker Login & Authentication

See Task: Auth Management for detailed workflows.

# Get temporary docker login credentials (valid for 12 hours)
hcloud SWR CreateAuthorizationToken --cli-region=cn-north-4

# Get long-term docker login credentials (valid for 1 year)
hcloud SWR CreateSecret --cli-region=cn-north-4

Response Format (verified against actual API):

The response returns a Docker auth config object:

{
  "auths": {
    "swr.cn-north-4.myhuaweicloud.com": {
      "auth": "base64-encoded-auth-token"
    }
  }
}

• auths: Docker config auth object, registry host as key
• auth: Base64-encoded username:password string

Docker Login Command:

# Decode auth field: echo <auth_value> | base64 -d → username:password
docker login -u <decoded_username> -p <decoded_password> swr.cn-north-4.myhuaweicloud.com

5. Quota Management

See Task: Quota Management for detailed workflows.

# Check SWR quotas
hcloud SWR ListQuotas --cli-region=cn-north-4

Parameter Reference

Common Parameters

Namespace Parameters

Repository Parameters

Tag Parameters

Output Format

Namespace List

{
  "namespaces": [
    {
      "id": 3827347,
      "name": "group-dev",
      "creator_name": "user-name",
      "auth": 7,
      "access_user_count": 1,
      "repo_count": 2
    }
  ]
}

Repository List

Response is a flat JSON array (not wrapped in an object):

[
  {
    "name": "nginx",
    "category": "app_server",
    "description": "Nginx web server",
    "size": 268435456,
    "is_public": true,
    "num_images": 5,
    "num_download": 120,
    "path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx",
    "internal_path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx",
    "namespace": "group-dev",
    "domain_name": "user-name",
    "tags": ["v1.0", "v1.1", "latest"],
    "created_at": "2026-04-15T10:30:00Z",
    "updated_at": "2026-05-20T14:20:00Z",
    "logo": "",
    "url": "",
    "status": false,
    "total_range": 2
  }
]

Note: num_images is the tag count (not tag_count). tags is an array of tag name strings included directly in the repository listing.

Tag List

Response is a flat JSON array (not wrapped in an object):

[
  {
    "id": 32962315,
    "repo_id": 3374895,
    "Tag": "v1.0",
    "image_id": "f47c82866a20...",
    "digest": "sha256:c8cede14b121...",
    "schema": 2,
    "size": 134217728,
    "path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx:v1.0",
    "internal_path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx:v1.0",
    "is_trusted": false,
    "created": "2026-04-15T10:30:00Z",
    "updated": "2026-05-20T14:20:00Z",
    "domain_id": "xxx",
    "scanned": false,
    "tag_type": 0
  }
]

Note: Tag name field is Tag (capital T), timestamps use created/updated (not created_at/updated_at).

Show Repository Details

{
  "id": 3374887,
  "ns_id": 3827347,
  "name": "nginx",
  "category": "other",
  "creator_id": "05949eb5...",
  "creator_name": "user-name",
  "num_images": 17,
  "num_download": 35,
  "is_public": false,
  "path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx",
  "created": "2026-03-26T07:42:40Z",
  "updated": "2026-05-06T09:22:11Z",
  "domain_id": "05949eb4...",
  "priority": 0
}

Note: ShowRepository uses created/updated and num_images — different from ListReposDetails which uses created_at/updated_at.

Auth Token Response

{
  "auths": {
    "swr.cn-north-4.myhuaweicloud.com": {
      "auth": "base64-encoded-username:password"
    }
  }
}

Note: The auth field is base64-encoded. Decode it to get docker login credentials. This is a Docker config format, NOT a header+body response.

Quota List

{
  "quotas": [
    {
      "quota_key": "namespace",
      "quota_limit": 5,
      "used": 1,
      "unit": ""
    }
  ]
}

Note: Quotas are returned as an array of objects with quota_key/quota_limit/used/unit fields, not flat key-value pairs like namespace_limit/namespace_used.

Verification

See Verification Method for step-by-step verification.

Common Region IDs

Best Practices

1. Namespace Organization: Use descriptive namespace names following team/project naming (e.g., team-backend, proj-ai) 2. Repository Visibility: Set is_public=false for internal images; only set is_public=true for images intended for public sharing 3. Tag Naming Convention: Use semantic versioning (e.g., v1.0, v1.0-stable, latest) and avoid ambiguous tags 4. Regular Cleanup: Periodically delete outdated tags to manage storage quotas 5. Retag Instead of Re-push: Use CreateRepoTag to create version aliases rather than pushing the same image multiple times 6. Long-term Login for CI/CD: Use CreateSecret for automation pipelines; use CreateAuthorizationToken for temporary access 7. Delete with Caution: Deleting a namespace removes ALL repositories under it; deleting a repository removes ALL tags

Reference Documents

Notes

• Namespace deletion is irreversible — removes all repositories and images under it
• Repository deletion is irreversible — removes all image tags permanently
• Tag deletion is irreversible — the image version cannot be recovered
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables
• hcloud CLI is the only supported method — all operations use hcloud SWR <Operation> format
• Pagination required for large datasets — use --limit and --offset for repositories and tags listing

Common Pitfalls

See Common Pitfalls & Solutions for detailed troubleshooting guides.

Quick Reference:

Common Pitfalls & Solutions

This document contains detailed troubleshooting guides for common issues encountered when using the Huawei Cloud SWR Image Management skill.

Pitfall 1: Invalid Namespace Name Format

Symptom: API returns error 400 Bad Request or NamespaceNameInvalid

Root Cause: Namespace name violates naming rules

Naming Rules:

• Start with lowercase letter
• Followed by lowercase letters, digits, dots (.), underscores (_), or hyphens (-)
• Max 2 consecutive underscores (__ is allowed, ___ is not)
• Dots, underscores, hyphens cannot be directly connected (e.g., a._b, a.-b are invalid)
• End with lowercase letter or digit
• Length: 1-64 characters

Common Mistakes:

• ❌ Group-dev — starts with uppercase
• ❌ dev___ops — 3 consecutive underscores
• ❌ dev.-ops — dot directly followed by hyphen
• ❌ dev._ops — dot directly followed by underscore
• ❌ dev- — ends with hyphen
• ❌ Very long names > 64 chars

Solution: Always verify namespace names before creation:

# Verify namespace exists (if checking existing name)
hcloud SWR ShowNamespace --namespace=<your-namespace> --cli-region=cn-north-4

Pitfall 2: Invalid Repository Name Format

Symptom: API returns error 400 Bad Request or RepoNameInvalid

Root Cause: Repository name violates naming rules

Naming Rules:

• Start with lowercase letter or digit
• Followed by lowercase letters, digits, dots (.), slashes (/), underscores (_), or hyphens (-)
• Max 2 consecutive underscores
• Dots, slashes, underscores, hyphens cannot be directly connected
• End with lowercase letter or digit
• Length: 1-128 characters

Common Mistakes:

• ❌ MyApp — starts with uppercase
• ❌ my-app/ — ends with slash
• ❌ my.app./v2 — dot directly followed by slash

Solution: Use consistent naming conventions, e.g., my-app, backend/api-server

Pitfall 3: Deleting Namespace Removes All Repositories

Symptom: All repositories and images disappear after namespace deletion

Root Cause: DeleteNamespaces removes the entire namespace and all resources under it

Solution: Before deleting a namespace, always:

1. List all repositories in the namespace:

hcloud SWR ListReposDetails --namespace=<namespace> --cli-region=cn-north-4

2. Confirm with the user that they understand ALL repositories and images will be permanently deleted

3. If repositories need to be preserved, move them to another namespace first (via image sync or re-push)

Pitfall 4: Cannot Delete Tag Without Namespace and Repository

Symptom: DeleteRepoTag fails with path parameter errors

Root Cause: All tag operations require both --namespace and --repository parameters

Solution: Always specify full path for tag operations:

# ✅ CORRECT
hcloud SWR DeleteRepoTag --namespace=group-dev --repository=nginx --tag=v1.0 --cli-region=cn-north-4

# ❌ WRONG - missing namespace
hcloud SWR DeleteRepoTag --repository=nginx --tag=v1.0 --cli-region=cn-north-4

Pitfall 5: Retag (CreateRepoTag) Source Tag Does Not Exist

Symptom: CreateRepoTag returns 404 or validation error

Root Cause: The --source_tag must reference an existing tag in the same repository

Solution: Verify the source tag exists before retagging:

# Verify source tag exists
hcloud SWR ShowRepoTag --namespace=group-dev --repository=nginx --tag=v1.0 --cli-region=cn-north-4

# Then retag
hcloud SWR CreateRepoTag --namespace=group-dev --repository=nginx --source_tag=v1.0 --destination_tag=v1.0-stable --cli-region=cn-north-4

Pitfall 6: Quota Exceeded When Creating Resources

Symptom: CreateNamespace or CreateRepo returns 403 Quota limit exceeded

Root Cause: SWR has resource limits (namespace count, repository count, tag count)

Solution: Check quotas before creating resources:

hcloud SWR ListQuotas --cli-region=cn-north-4

If quota is exceeded, consider: 1. Delete unused namespaces/repositories/tags to free up quota 2. Apply for quota increase through Huawei Cloud support

Pitfall 7: Docker Login Token Expired

Symptom: docker push or docker pull fails with authentication error

Root Cause: Temporary login token (CreateAuthorizationToken) expires after 12 hours

Solution: For different use cases:

• Temporary access: Regenerate token with CreateAuthorizationToken
• CI/CD pipelines: Use long-term credentials from CreateSecret (valid for 1 year)
• Automated renewal: Schedule regular token regeneration in your pipeline

# Regenerate temporary token
hcloud SWR CreateAuthorizationToken --cli-region=cn-north-4

# Get long-term credentials
hcloud SWR CreateSecret --cli-region=cn-north-4

Pitfall 8: Pagination Required for Large Repositories

Symptom: Only first 100 tags or repositories are returned

Root Cause: Default limit is 100 for ListReposDetails and 100 for ListRepositoryTags

Solution: Use pagination parameters for large datasets:

# First page
hcloud SWR ListReposDetails --namespace=group-dev --limit=100 --offset=0 --cli-region=cn-north-4

# Second page
hcloud SWR ListReposDetails --namespace=group-dev --limit=100 --offset=100 --cli-region=cn-north-4

# Continue until all results are retrieved

Pitfall 9: filter vs Direct Parameters Conflict

Symptom: ListReposDetails returns unexpected results when both --filter and --namespace/--name/--category are used

Root Cause: If both --filter and direct parameters (--namespace, --name, --category) are used, the direct parameters will be ignored and --filter takes precedence

Solution: Use either --filter OR direct parameters, not both:

# ✅ CORRECT - Use direct parameters
hcloud SWR ListReposDetails --namespace=group-dev --name=nginx --cli-region=cn-north-4

# ✅ CORRECT - Use filter for complex queries
hcloud SWR ListReposDetails --filter="namespace::group-dev|name::nginx|limit::20|offset::0" --cli-region=cn-north-4

# ❌ WRONG - Mixing both
hcloud SWR ListReposDetails --namespace=group-dev --filter="namespace::other-ns" --cli-region=cn-north-4

Pitfall 10: --offset and --limit Must Be Used Together

Symptom: Pagination parameters are ignored when used individually

Root Cause: --offset and --limit must always be paired; using one without the other has no effect

Solution: Always use both pagination parameters:

# ✅ CORRECT
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --limit=50 --offset=0 --cli-region=cn-north-4

# ❌ WRONG - missing offset
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --limit=50 --cli-region=cn-north-4

Pitfall 11: Tag Field Name is Tag (Capital T), Not name

Symptom: Tag listing query returns unexpected field structure, scripts that reference name field fail

Root Cause: The tag name field in ListRepositoryTags and ShowRepoTag response uses Tag (capital T), not lowercase name

Solution: Always use Tag (capital T) when parsing tag list responses:

# ✅ CORRECT - Use capital T
Tag: "v1.0"

# ❌ WRONG - lowercase name does not exist in response
name: "v1.0"

Pitfall 12: Repository num_images vs tag_count

Symptom: Repository listing field tag_count not found, confusion between parameter name and response field name

Root Cause: The tag count field in repository listing and detail response is num_images, but the --order_column parameter value for sorting by tag count is tag_count. These are different!

Solution: Use num_images for the response field, but tag_count for the sort parameter:

# ✅ CORRECT - Response field is "num_images"
"num_images": 5

# ❌ WRONG - "tag_count" does not exist as a response field
"tag_count": 5

# ✅ CORRECT - order_column parameter uses "tag_count"
hcloud SWR ListReposDetails --order_column=tag_count --order_type=desc --cli-region=cn-north-4

# ❌ WRONG - order_column "num_images" causes error (SVCSTG.SWR.4001096)
hcloud SWR ListReposDetails --order_column=num_images --order_type=desc --cli-region=cn-north-4

Pitfall 13: Timestamp Field Names Vary Between APIs

Symptom: Parsing created_at/updated_at from ShowRepository or tag listing fails

Root Cause: Different SWR API operations use different timestamp field names:

• ListReposDetails: uses created_at / updated_at
• ShowRepository: uses created / updated (different!)
• ListRepositoryTags: uses created / updated
• ShowRepoTag: uses created / updated

Solution: Check which API operation you're using and use the correct timestamp field names:

Pitfall 14: CreateAuthorizationToken Returns Docker Auth Config, Not Header+Body

Symptom: Looking for X-Swr-Dockerlogin header or host body field — they don't exist

Root Cause: CreateAuthorizationToken returns a Docker config auth object format, not separate header and body fields as documented in some older references

Solution: Parse the response as a Docker auth config:

{
  "auths": {
    "swr.cn-north-4.myhuaweicloud.com": {
      "auth": "base64-encoded-username:password"
    }
  }
}

Decode the auth field to get username and password for docker login.

Pitfall 15: ListQuotas Returns Array of Objects, Not Flat Key-Value

Symptom: Trying to access namespace_limit or namespace_used fields — they don't exist

Root Cause: ListQuotas returns an array of quota objects with quota_key/quota_limit/used/unit fields, not flat key-value pairs

Solution: Parse the quotas as an array and look up by quota_key:

{
  "quotas": [
    {
      "quota_key": "namespace",
      "quota_limit": 5,
      "used": 1,
      "unit": ""
    }
  ]
}

To find namespace quota, filter the array where quota_key == "namespace".

Common Error Response Reference

IAM Permission Policies - SWR Image Management Skill

Overview

This document declares the IAM permissions required by the Huawei Cloud SWR Image Management skill. All permissions follow the principle of least privilege.

Read-Only Operations

Write Operations (Require Additional Authorization)

Minimum Read-Only Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "swr:namespace:list",
        "swr:namespace:get",
        "swr:repository:list",
        "swr:repository:get",
        "swr:tag:list",
        "swr:tag:get",
        "swr:quota:get"
      ],
      "Resource": ["*"]
    }
  ]
}

Full Management Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "swr:namespace:list",
        "swr:namespace:get",
        "swr:namespace:create",
        "swr:namespace:delete",
        "swr:repository:list",
        "swr:repository:get",
        "swr:repository:create",
        "swr:repository:update",
        "swr:repository:delete",
        "swr:tag:list",
        "swr:tag:get",
        "swr:tag:create",
        "swr:tag:delete",
        "swr:login:get",
        "swr:quota:get"
      ],
      "Resource": ["*"]
    }
  ]
}

Permission Assignment Steps

1. Log in to Huawei Cloud IAM console: https://console.huaweicloud.com/iam/ 2. Navigate to Policies → Create Custom Policy 3. Choose JSON mode and paste the policy JSON above 4. Navigate to Users / User Groups → Authorize 5. Select the custom policy and confirm

Permission Failure Handling

When a command fails with a permission error:

1. Read this document (references/iam-policies.md) 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console 4. Pause execution and wait for user confirmation that permissions have been granted 5. Retry the failed command

SWR API Reference Guide

Overview

This document provides API reference information for Huawei Cloud SWR (Software Repository for Container) operations using hcloud CLI. All commands follow the standard format: hcloud SWR <Operation> --param=value --cli-region=<region>.

Authentication

Environment Variables

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>

hcloud CLI Configuration

# Interactive configuration
hcloud configure

# Verify configuration (safe - does not expose values)
hcloud configure list

✅ Correct: Use hcloud configure list to verify credentials ❌ Incorrect: Never use echo $HUAWEI_CLOUD_AK to check credentials

Namespace Operations

1. List Namespaces

hcloud SWR ListNamespaces --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID
• --namespace (optional): Filter by namespace name
• --filter (optional): namespace::{name}|mode::{mode}

Response Example (verified against actual API):

{
  "namespaces": [
    {
      "id": 3827347,
      "name": "group-dev",
      "creator_name": "user-name",
      "auth": 7,
      "access_user_count": 1,
      "repo_count": 2
    }
  ]
}

Key Fields:

• id: Namespace numeric ID
• name: Namespace name
• creator_name: Creator IAM user name
• auth: Permission level (7=manage, 3=edit, 1=read)
• access_user_count: Number of users with access
• repo_count: Number of repositories under this namespace

2. Show Namespace Details

hcloud SWR ShowNamespace --namespace=group-dev --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --cli-region (required): Region ID

3. Create Namespace

hcloud SWR CreateNamespace --namespace=group-dev --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (body parameter)
• --cli-region (required): Region ID

Namespace Naming Rules:

• Start with lowercase letter
• Followed by lowercase letters, digits, dots (.), underscores (_), or hyphens (-)
• Max 2 consecutive underscores
• Dots, underscores, hyphens cannot be directly connected (e.g., a._b or a.-b is invalid)
• End with lowercase letter or digit
• Length: 1-64 characters

Valid Examples: group-dev, team1, my.project, dev_ops Invalid Examples: Group-dev (uppercase start), dev__ops (3 consecutive underscores), dev.-ops (dot-hyphen connected)

4. Delete Namespace

hcloud SWR DeleteNamespaces --namespace=group-dev --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --cli-region (required): Region ID

⚠️ Warning: This operation is irreversible. All repositories and images under the namespace will be permanently deleted.

Repository Operations

1. List Repositories

# List all repositories (no filter)
hcloud SWR ListReposDetails --cli-region=cn-north-4

# List repositories in a namespace
hcloud SWR ListReposDetails --namespace=group-dev --cli-region=cn-north-4

# List repositories with pagination
hcloud SWR ListReposDetails --namespace=group-dev --limit=20 --offset=0 --cli-region=cn-north-4

# Sort repositories by update time (descending)
hcloud SWR ListReposDetails --namespace=group-dev --order_column=updated_at --order_type=desc --cli-region=cn-north-4

# Search by name (fuzzy match)
hcloud SWR ListReposDetails --name=nginx --cli-region=cn-north-4

# Filter by category
hcloud SWR ListReposDetails --category=database --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID
• --namespace (optional): Namespace name
• --name (optional): Repository name (fuzzy match)
• --category (optional): Repository category (app_server, linux, framework_app, database, lang, other, windows, arm)
• --limit (optional): Page size, default 100, max 1000
• --offset (optional): Page offset (must pair with --limit)
• --order_column (optional): Sort column (name, updated_time, tag_count — note: tag_count is the param value, response field is num_images)
• --order_type (optional): Sort direction (desc, asc)
• --filter (optional): Complex filter expression

Response Example (verified against actual API - flat JSON array):

[
  {
    "name": "nginx",
    "category": "app_server",
    "description": "Nginx web server",
    "size": 268435456,
    "is_public": true,
    "num_images": 5,
    "num_download": 120,
    "path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx",
    "internal_path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx",
    "namespace": "group-dev",
    "domain_name": "user-name",
    "tags": ["v1.0", "v1.1", "latest"],
    "created_at": "2026-04-15T10:30:00Z",
    "updated_at": "2026-05-20T14:20:00Z",
    "logo": "",
    "url": "",
    "status": false,
    "total_range": 2
  }
]

Key Fields:

• name: Repository name
• num_images: Image/tag count (NOT tag_count)
• num_download: Total download count
• tags: Array of tag name strings included directly in listing
• path: Full image path for docker pull
• size: Total storage size in bytes
• is_public: Public/private visibility
• Response is a flat array (not wrapped in a repositories object)

2. Show Repository Details

hcloud SWR ShowRepository --namespace=group-dev --repository=nginx --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --cli-region (required): Region ID

Response Example (verified against actual API):

{
  "id": 3374887,
  "ns_id": 3827347,
  "name": "nginx",
  "category": "other",
  "description": "",
  "creator_id": "05949eb5350010e21f85c017722182de",
  "creator_name": "user-name",
  "size": 1946933102,
  "is_public": false,
  "num_images": 17,
  "num_download": 35,
  "url": "",
  "path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx",
  "internal_path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx",
  "created": "2026-03-26T07:42:40.069829Z",
  "updated": "2026-05-06T09:22:11.436606Z",
  "domain_id": "05949eb4190010e40f36c017b62fafa0",
  "priority": 0
}

Key Fields:

• ns_id: Namespace numeric ID
• creator_id: Creator IAM user ID (hex string)
• creator_name: Creator IAM user name
• num_images: Image/tag count (NOT tag_count)
• created/updated: Timestamps (NOT created_at/updated_at — different from ListReposDetails!)
• domain_id: Domain ID (hex string)
• priority: Repository priority (default 0)

3. Create Repository

hcloud SWR CreateRepo --namespace=group-dev --repository=my-app --is_public=false --category=other --description="Custom application image" --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --repository (required): Repository name (body parameter)
• --is_public (required): Public or private (true/false)
• --category (optional): Repository category
• --description (optional): Repository description
• --cli-region (required): Region ID

Repository Naming Rules:

• Start with lowercase letter or digit
• Followed by lowercase letters, digits, dots (.), slashes (/), underscores (_), or hyphens (-)
• Max 2 consecutive underscores
• Dots, slashes, underscores, hyphens cannot be directly connected
• End with lowercase letter or digit
• Length: 1-128 characters

4. Update Repository

hcloud SWR UpdateRepo --namespace=group-dev --repository=my-app --is_public=true --description="Updated description" --category=app_server --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --repository (required): Repository name (path parameter)
• --is_public (required): Public or private (true/false)
• --category (optional): New category
• --description (optional): New description
• --cli-region (required): Region ID

5. Delete Repository

hcloud SWR DeleteRepo --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --cli-region (required): Region ID

⚠️ Warning: This operation is irreversible. All image tags in the repository will be permanently deleted.

6. List Repositories by Namespace

hcloud SWR ListNamespaceRepositories --namespace=group-dev --cli-region=cn-north-4

This is an alternative to ListReposDetails when you want to list repos specifically within one namespace.

Tag Operations

1. List Tags

# List all tags in a repository
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --cli-region=cn-north-4

# List tags with pagination
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --limit=50 --offset=0 --cli-region=cn-north-4

# Sort tags by update time
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --order_column=updated_at --order_type=desc --cli-region=cn-north-4

# Search for specific tag
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --filter="tag::v1.0" --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --cli-region (required): Region ID
• --limit (optional): Page size, default 100, max 1000
• --offset (optional): Page offset
• --order_column (optional): Sort column (updated_at)
• --order_type (optional): Sort direction (desc, asc)
• --tag (optional): Search by tag name
• --filter (optional): Complex filter expression

Response Example (verified against actual API - flat JSON array):

[
  {
    "id": 32962315,
    "repo_id": 3374895,
    "Tag": "v1.0",
    "image_id": "f47c82866a200fa5...",
    "digest": "sha256:c8cede14b1214e45...",
    "schema": 2,
    "size": 134217728,
    "path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx:v1.0",
    "internal_path": "swr.cn-north-4.myhuaweicloud.com/group-dev/nginx:v1.0",
    "is_trusted": false,
    "created": "2026-04-15T10:30:00Z",
    "updated": "2026-05-20T14:20:00Z",
    "domain_id": "xxx",
    "scanned": false,
    "tag_type": 0
  }
]

Key Fields:

• Tag: Tag/version name (capital T, not lowercase name)
• image_id: Image content identifier (hex string)
• digest: Image content hash (SHA256)
• size: Image size in bytes
• path: Full image path for docker pull
• created/updated: Timestamps (NOT created_at/updated_at)
• Response is a flat array (not wrapped in a tags object)
• manifest field contains full OCI/Docker manifest JSON (very long, omitted above)

2. Show Tag Details

hcloud SWR ShowRepoTag --namespace=group-dev --repository=nginx --tag=v1.0 --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --tag (required): Image tag/version name
• --cli-region (required): Region ID

3. Create Tag (Retag)

hcloud SWR CreateRepoTag --namespace=group-dev --repository=nginx --source_tag=v1.0 --destination_tag=v1.0-stable --override=false --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --source_tag (required): Source tag name
• --destination_tag (required): Target tag name
• --override (optional): Overwrite existing tag (true/false)
• --cli-region (required): Region ID

Use Case: Retagging allows you to create aliases for existing image versions without re-pushing the image. For example, tagging v1.0 as stable to indicate it's the current stable release.

4. Delete Tag

hcloud SWR DeleteRepoTag --namespace=group-dev --repository=nginx --tag=v1.0-old --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --tag (required): Image tag/version name
• --cli-region (required): Region ID

⚠️ Warning: This operation is irreversible. The image version will be permanently deleted.

Authentication Operations

1. Get Temporary Login Token (12-hour validity)

hcloud SWR CreateAuthorizationToken --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID
• --projectname (optional): Project name, defaults to region name (e.g., cn-north-1)

Response Example (verified against actual API - Docker auth config format):

{
  "auths": {
    "swr.cn-north-4.myhuaweicloud.com": {
      "auth": "base64-encoded-auth-token"
    }
  }
}

Key Fields:

• auths: Docker config auth object
• auth: Base64-encoded string in format username:password
• Registry host is the key under auths (e.g., swr.cn-north-4.myhuaweicloud.com)

Usage:

# Decode the base64 auth field to get username and password:
# echo <auth_value> | base64 -d  →  username:password
# Then use decoded credentials:
docker login -u <decoded_username> -p <decoded_password> swr.cn-north-4.myhuaweicloud.com

2. Get Long-term Login Secret (1-year validity)

hcloud SWR CreateSecret --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID
• --projectname (optional): Project name

Usage: Recommended for CI/CD pipelines and automation where long-term credentials are needed.

Quota Operations

1. Check Quotas

hcloud SWR ListQuotas --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID
• --project_id (path parameter, auto-filled from credentials)

Response Example (verified against actual API - array of quota objects):

{
  "quotas": [
    {
      "quota_key": "namespace",
      "quota_limit": 5,
      "used": 1,
      "unit": ""
    }
  ]
}

Key Fields:

• quota_key: Resource type identifier (namespace, repo, tag, etc.)
• quota_limit: Maximum allowed for this resource type
• used: Current usage count
• unit: Unit of measurement (typically empty string for count-based quotas)
• Response is an array of quota objects (not flat key-value pairs)

Common Region IDs

Common Errors

Related Documentation

• Huawei Cloud SWR Documentation
• hcloud CLI Documentation
• Huawei Cloud API Explorer

Task: Auth Management

Overview

SWR authentication provides docker login credentials for pushing and pulling images. This task covers obtaining both temporary (12-hour) and long-term (1-year) login credentials.

Operations Catalog

Workflows

W1: Get Temporary Login Token (12-hour validity)

hcloud SWR CreateAuthorizationToken --cli-region=cn-north-4

Optional Parameter:

• --projectname: Project name, defaults to region name (e.g., cn-north-1)

Response Structure (verified against actual API - Docker auth config format):

{
  "auths": {
    "swr.cn-north-4.myhuaweicloud.com": {
      "auth": "base64-encoded-auth-token"
    }
  }
}

• auths: Docker config auth object, registry host as key
• auth: Base64-encoded username:password string

Constructing Docker Login Command:

The auth field is a base64-encoded string containing username:password. Decode it to get the credentials:

# Decode the auth field to get username and password
# echo <auth_value> | base64 -d  →  username:password
# Then login with decoded credentials:
docker login -u <decoded_username> -p <decoded_password> swr.cn-north-4.myhuaweicloud.com

Use Cases:

• Temporary docker push/pull access
• Development environment login
• Short-lived CI/CD pipeline credentials

Token Lifetime: 12 hours from generation

W2: Get Long-term Login Secret (1-year validity)

hcloud SWR CreateSecret --cli-region=cn-north-4

Optional Parameter:

• --projectname: Project name

Response Structure: Same Docker auth config format as temporary token (auths object with base64 auth field)

Use Cases:

• CI/CD pipeline persistent credentials
• Automation scripts that run over extended periods
• Kubernetes cluster image pull secrets

Token Lifetime: 1 year from generation

Recommendation: For Kubernetes deployments, store the long-term secret as a Kubernetes Secret:

# Create Kubernetes secret for SWR registry
kubectl create secret docker-registry swr-secret \
  --docker-server=swr.cn-north-4.myhuaweicloud.com \
  --docker-username=cn-north-4_<user_name> \
  --docker-password=<secret_from_CreateSecret>

W3: Multi-Region Login

For working with multiple SWR regions, generate credentials for each region:

# Login for cn-north-4
hcloud SWR CreateAuthorizationToken --cli-region=cn-north-4

# Login for cn-east-3
hcloud SWR CreateAuthorizationToken --cli-region=cn-east-3

# Login for ap-southeast-1
hcloud SWR CreateAuthorizationToken --cli-region=ap-southeast-1

Note: Each region has its own SWR registry endpoint:

• cn-north-4: swr.cn-north-4.myhuaweicloud.com
• cn-east-3: swr.cn-east-3.myhuaweicloud.com
• ap-southeast-1: swr.ap-southeast-1.myhuaweicloud.com

Common Scenarios

S1: CI/CD Pipeline Setup

Configure automated image push/pull for CI/CD:

# 1. Get long-term credentials
hcloud SWR CreateSecret --cli-region=cn-north-4

# 2. Store credentials in CI/CD environment variables
# (Do NOT print credentials - store them securely)

# 3. Use in pipeline script
docker login -u ${SWR_USERNAME} -p ${SWR_PASSWORD} swr.cn-north-4.myhuaweicloud.com
docker push swr.cn-north-4.myhuaweicloud.com/${NAMESPACE}/${REPO}:${TAG}

S2: Kubernetes Deployment Setup

Configure Kubernetes to pull images from SWR:

# 1. Get long-term credentials
hcloud SWR CreateSecret --cli-region=cn-north-4

# 2. Create Kubernetes docker-registry secret
kubectl create secret docker-registry swr-regcred \
  --docker-server=swr.cn-north-4.myhuaweicloud.com \
  --docker-username=<username> \
  --docker-password=<password> \
  --namespace=<k8s-namespace>

# 3. Reference in pod/deployment spec
# imagePullSecrets:
#   - name: swr-regcred

S3: Manual Image Push/Pull

# 1. Get temporary token
hcloud SWR CreateAuthorizationToken --cli-region=cn-north-4

# 2. Login to SWR registry
docker login -u cn-north-4_<user> -p <token> swr.cn-north-4.myhuaweicloud.com

# 3. Tag and push image
docker tag my-app:latest swr.cn-north-4.myhuaweicloud.com/group-dev/my-app:latest
docker push swr.cn-north-4.myhuaweicloud.com/group-dev/my-app:latest

# 4. Pull image
docker pull swr.cn-north-4.myhuaweicloud.com/group-dev/my-app:v1.0

Security Notes

• 🚫 Never store login credentials in code repositories
• 🚫 Never display full credentials in logs or conversation
• ✅ Use environment variables or secret management tools
• ✅ Rotate long-term credentials periodically
• ✅ Use temporary tokens for development, long-term for production automation

Task: Namespace Management

Overview

SWR namespace (organization) is the top-level grouping for image repositories. All repositories must belong to a namespace. This task covers creating, querying, and deleting namespaces.

Operations Catalog

Workflows

W1: View All Namespaces

# List all namespaces you have permission to
hcloud SWR ListNamespaces --cli-region=cn-north-4

# List namespaces with visible mode (includes repos you have access to even if namespace access is limited)
hcloud SWR ListNamespaces --filter="mode::visible" --cli-region=cn-north-4

# Search for a specific namespace
hcloud SWR ListNamespaces --filter="namespace::group-dev" --cli-region=cn-north-4

Output Fields (verified against actual API):

• id: Namespace numeric ID
• name: Namespace name
• creator_name: Creator IAM user name (NOT creator)
• auth: Permission level (7=manage, 3=edit, 1=read)
• access_user_count: Number of users with access
• repo_count: Number of repositories under this namespace

W2: Check Namespace Details

hcloud SWR ShowNamespace --namespace=group-dev --cli-region=cn-north-4

Use Cases:

• Verify namespace exists before creating repositories
• Check namespace permissions and metadata
• Troubleshoot "namespace not found" errors

W3: Create a New Namespace

Pre-creation Checklist: 1. Verify namespace name follows naming rules (1-64 chars, lowercase start) 2. Check quota availability: hcloud SWR ListQuotas --cli-region=cn-north-4 3. Verify namespace doesn't already exist: hcloud SWR ShowNamespace --namespace=<name> --cli-region=cn-north-4

hcloud SWR CreateNamespace --namespace=group-dev --cli-region=cn-north-4

Post-creation Verification:

hcloud SWR ShowNamespace --namespace=group-dev --cli-region=cn-north-4

W4: Delete a Namespace

⚠️ CAUTION: Deleting a namespace permanently removes ALL repositories and images under it. This is irreversible.

Pre-deletion Checklist: 1. List all repositories in the namespace:

hcloud SWR ListReposDetails --namespace=<name> --cli-region=cn-north-4

2. Confirm with user that all repositories and images will be deleted 3. Optionally save critical images by syncing to another region or namespace

hcloud SWR DeleteNamespaces --namespace=group-dev --cli-region=cn-north-4

Post-deletion Verification:

# Should return 404 or empty result
hcloud SWR ShowNamespace --namespace=group-dev --cli-region=cn-north-4

Common Scenarios

S1: Organize Images by Team/Project

Create separate namespaces for different teams or projects:

# Team namespaces
hcloud SWR CreateNamespace --namespace=team-backend --cli-region=cn-north-4
hcloud SWR CreateNamespace --namespace=team-frontend --cli-region=cn-north-4
hcloud SWR CreateNamespace --namespace=team-data --cli-region=cn-north-4

# Project namespaces
hcloud SWR CreateNamespace --namespace=proj-order-service --cli-region=cn-north-4
hcloud SWR CreateNamespace --namespace=proj-user-service --cli-region=cn-north-4

S2: Migrate Namespace

When reorganizing, migrate images by pushing to the new namespace and then deleting the old one:

# 1. Create new namespace
hcloud SWR CreateNamespace --namespace=team-new-backend --cli-region=cn-north-4

# 2. Push images to new namespace (using docker)
docker tag old-image:latest swr.cn-north-4.myhuaweicloud.com/team-new-backend/old-image:latest
docker push swr.cn-north-4.myhuaweicloud.com/team-new-backend/old-image:latest

# 3. Verify migration
hcloud SWR ListReposDetails --namespace=team-new-backend --cli-region=cn-north-4

# 4. Delete old namespace (after confirming migration is complete)
hcloud SWR DeleteNamespaces --namespace=team-backend --cli-region=cn-north-4

Task: Quota Management

Overview

SWR has resource quotas that limit the number of namespaces, repositories, and image tags you can create. This task covers checking quota usage and limits.

Operations Catalog

Workflows

W1: Check Quota Usage

hcloud SWR ListQuotas --cli-region=cn-north-4

Response Structure (verified against actual API - array of quota objects):

{
  "quotas": [
    {
      "quota_key": "namespace",
      "quota_limit": 5,
      "used": 1,
      "unit": ""
    }
  ]
}

Output Fields:

• quota_key: Resource type identifier (namespace, repo, tag, etc.)
• quota_limit: Maximum allowed for this resource type
• used: Current usage count
• unit: Unit of measurement (typically empty string for count-based quotas)
• Response is an array of quota objects (not flat key-value pairs like namespace_limit/namespace_used)

W2: Check Quota Before Creating Resources

Before creating namespaces, repositories, or tags, verify quota availability:

# Check quotas
hcloud SWR ListQuotas --cli-region=cn-north-4

# If namespace quota is near limit, consider cleanup:
# - List all namespaces
hcloud SWR ListNamespaces --cli-region=cn-north-4

# - Delete unused namespaces (CAUTION: removes all repos under them)
hcloud SWR DeleteNamespaces --namespace=unused-ns --cli-region=cn-north-4

W3: Storage Management via Tag Cleanup

When tag quota is near limit, clean up old tags:

# 1. Check current tag quota
hcloud SWR ListQuotas --cli-region=cn-north-4

# 2. Find repositories with most tags (order_column uses "tag_count", response field is "num_images")
hcloud SWR ListReposDetails --order_column=tag_count --order_type=desc --cli-region=cn-north-4

# 3. For repositories with many tags, list and delete old ones
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --order_column=updated_at --order_type=asc --cli-region=cn-north-4

# 4. Delete old tags
hcloud SWR DeleteRepoTag --namespace=group-dev --repository=nginx --tag=v0.1-beta --cli-region=cn-north-4

Default Quota Limits (Reference)

Note: Default limits may vary by region and project configuration. Always use ListQuotas to check actual limits.

Common Scenarios

S1: Quota Audit for Resource Planning

Regularly audit quota usage for resource planning:

# Check quotas
hcloud SWR ListQuotas --cli-region=cn-north-4

# List namespace count
hcloud SWR ListNamespaces --cli-region=cn-north-4

# List repository count by namespace
hcloud SWR ListReposDetails --limit=1000 --cli-region=cn-north-4

# Calculate tag usage per namespace
# For each namespace:
hcloud SWR ListReposDetails --namespace=group-dev --cli-region=cn-north-4
# Then for each repo:
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --cli-region=cn-north-4

S2: Apply for Quota Increase

If quotas are insufficient:

1. Document current usage with ListQuotas 2. Calculate required increase based on project needs 3. Contact Huawei Cloud support to apply for quota increase 4. Provide justification: project name, expected growth, timeline

Task: Repository Management

Overview

SWR image repositories hold container images within a namespace. This task covers creating, querying, updating, and deleting repositories.

Operations Catalog

Workflows

W1: List Repositories

# List all repositories across all namespaces
hcloud SWR ListReposDetails --cli-region=cn-north-4

# List repositories in a specific namespace
hcloud SWR ListReposDetails --namespace=group-dev --cli-region=cn-north-4

# List repositories with pagination
hcloud SWR ListReposDetails --namespace=group-dev --limit=20 --offset=0 --cli-region=cn-north-4

# Sort by most recently updated
hcloud SWR ListReposDetails --namespace=group-dev --order_column=updated_at --order_type=desc --cli-region=cn-north-4

# Sort by tag count (order_column uses "tag_count" even though response field is "num_images")
hcloud SWR ListReposDetails --namespace=group-dev --order_column=tag_count --order_type=desc --cli-region=cn-north-4

# Search by name (fuzzy match)
hcloud SWR ListReposDetails --name=nginx --cli-region=cn-north-4

# Filter by category
hcloud SWR ListReposDetails --category=database --cli-region=cn-north-4

Output Fields (verified against actual API):

• namespace: Parent namespace
• name: Repository name
• category: Repository category
• description: Repository description
• is_public: Whether publicly visible
• num_images: Number of image tags (NOT tag_count)
• num_download: Total download count
• size: Total storage size in bytes
• tags: Array of tag name strings included directly in listing
• path: Full image path for docker pull
• created_at: Creation timestamp
• updated_at: Last update timestamp

W2: View Repository Details

hcloud SWR ShowRepository --namespace=group-dev --repository=nginx --cli-region=cn-north-4

Output Fields (verified — different from ListReposDetails):

• ns_id: Namespace numeric ID
• creator_id: Creator IAM user ID (hex string)
• creator_name: Creator IAM user name
• num_images: Tag count (NOT tag_count)
• created/updated: Timestamps (NOT created_at/updated_at)
• domain_id: Domain ID (hex string)
• priority: Repository priority (default 0)

Use Cases:

• Check repository visibility (public/private)
• View tag count and storage size
• Verify repository before updating or deleting

W3: Create a Repository

Pre-creation Checklist: 1. Verify namespace exists: hcloud SWR ShowNamespace --namespace=<name> --cli-region=cn-north-4 2. Check repository name follows naming rules (1-128 chars) 3. Decide visibility: is_public=true for public sharing, is_public=false for internal use 4. Choose appropriate category

# Create a private repository
hcloud SWR CreateRepo --namespace=group-dev --repository=my-app --is_public=false --category=other --description="Custom application image" --cli-region=cn-north-4

# Create a public repository
hcloud SWR CreateRepo --namespace=group-dev --repository=nginx --is_public=true --category=app_server --description="Nginx web server" --cli-region=cn-north-4

Category Options: app_server, linux, framework_app, database, lang, other, windows, arm

Post-creation Verification:

hcloud SWR ShowRepository --namespace=group-dev --repository=my-app --cli-region=cn-north-4

W4: Update Repository Properties

# Change visibility from private to public
hcloud SWR UpdateRepo --namespace=group-dev --repository=my-app --is_public=true --cli-region=cn-north-4

# Update description
hcloud SWR UpdateRepo --namespace=group-dev --repository=my-app --is_public=true --description="Updated: production-ready app" --cli-region=cn-north-4

# Change category
hcloud SWR UpdateRepo --namespace=group-dev --repository=my-app --is_public=true --category=framework_app --cli-region=cn-north-4

Note: --is_public is required for UpdateRepo even if you only want to change description or category.

W5: Delete a Repository

⚠️ CAUTION: Deleting a repository permanently removes ALL image tags. This is irreversible.

Pre-deletion Checklist: 1. List all tags to verify what will be deleted:

hcloud SWR ListRepositoryTags --namespace=<name> --repository=<repo> --cli-region=cn-north-4

2. Confirm with user that all tags will be permanently deleted

hcloud SWR DeleteRepo --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Post-deletion Verification:

# Should return 404
hcloud SWR ShowRepository --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Common Scenarios

S1: Standard Project Repository Setup

Set up repositories for a typical development team:

# Create namespace for the project
hcloud SWR CreateNamespace --namespace=proj-microservice --cli-region=cn-north-4

# Create repositories for each service
hcloud SWR CreateRepo --namespace=proj-microservice --repository=order-service --is_public=false --category=framework_app --description="Order management service" --cli-region=cn-north-4
hcloud SWR CreateRepo --namespace=proj-microservice --repository=user-service --is_public=false --category=framework_app --description="User management service" --cli-region=cn-north-4
hcloud SWR CreateRepo --namespace=proj-microservice --repository=gateway --is_public=false --category=app_server --description="API gateway" --cli-region=cn-north-4

S2: Audit Repository Inventory

Periodically review repositories across all namespaces:

# List all repositories sorted by tag count (order_column uses "tag_count", response field is "num_images")
hcloud SWR ListReposDetails --order_column=tag_count --order_type=desc --cli-region=cn-north-4

# List repositories in a specific namespace
hcloud SWR ListReposDetails --namespace=group-dev --cli-region=cn-north-4

# For each repository, check tag details
hcloud SWR ShowRepository --namespace=group-dev --repository=nginx --cli-region=cn-north-4

S3: Change Repository Visibility

Switch a repository between public and private:

# Make repository public (for sharing with external teams)
hcloud SWR UpdateRepo --namespace=group-dev --repository=base-image --is_public=true --cli-region=cn-north-4

# Make repository private (for internal use only)
hcloud SWR UpdateRepo --namespace=group-dev --repository=internal-tool --is_public=false --cli-region=cn-north-4

Task: Tag Management

Overview

Image tags (versions) represent specific image builds within a repository. This task covers querying, creating (retagging), and deleting image tags.

Operations Catalog

Workflows

W1: List All Tags in a Repository

# List all tags
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --cli-region=cn-north-4

# List tags with pagination (for repositories with many tags)
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --limit=50 --offset=0 --cli-region=cn-north-4

# Sort tags by most recently updated
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --order_column=updated_at --order_type=desc --cli-region=cn-north-4

# Search for a specific tag name
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --tag=v1.0 --cli-region=cn-north-4

Output Fields (verified against actual API):

• Tag: Tag/version name (capital T, not name) (e.g., v1.0, latest)
• image_id: Image content identifier (hex string)
• digest: Image content hash (SHA256)
• size: Image size in bytes
• created: Creation timestamp (NOT created_at)
• updated: Last update timestamp (NOT updated_at)
• path: Full image path (e.g., swr.cn-north-4.myhuaweicloud.com/group-dev/nginx:v1.0)
• manifest: Full OCI/Docker manifest JSON (very long string)
• deleted: Null for active tags
• domain_id: Domain ID (hex string)
• scanned: Security scan status (boolean)
• tag_type: Tag type (0=normal)

W2: View Tag Details

hcloud SWR ShowRepoTag --namespace=group-dev --repository=nginx --tag=v1.0 --cli-region=cn-north-4

Use Cases:

• Verify image digest before deployment
• Check image size for storage management
• Confirm tag exists before retagging or deleting

W3: Create a Tag (Retag)

Retagging creates a new tag pointing to the same image as an existing tag. This is useful for:

• Creating version aliases (e.g., v1.0 → stable)
• Marking production-ready versions
• Organizing tags by release stage

# Create a new tag from an existing tag
hcloud SWR CreateRepoTag --namespace=group-dev --repository=nginx --source_tag=v1.0 --destination_tag=stable --override=false --cli-region=cn-north-4

# Create a tag with override (replaces existing tag if it exists)
hcloud SWR CreateRepoTag --namespace=group-dev --repository=nginx --source_tag=v1.1 --destination_tag=latest --override=true --cli-region=cn-north-4

Pre-retag Checklist: 1. Verify source tag exists:

hcloud SWR ShowRepoTag --namespace=group-dev --repository=nginx --tag=v1.0 --cli-region=cn-north-4

2. Decide whether to override if destination tag already exists

Parameters:

• --source_tag (required): Existing tag name to copy from
• --destination_tag (required): New tag name to create
• --override (optional): Whether to overwrite if destination tag exists (true/false, default false)

W4: Delete a Tag

⚠️ CAUTION: Deleting a tag permanently removes the image version. This is irreversible.

Pre-deletion Checklist: 1. Verify the tag details to confirm it's the correct version:

hcloud SWR ShowRepoTag --namespace=group-dev --repository=nginx --tag=v1.0-old --cli-region=cn-north-4

2. Confirm with user that the image version will be permanently deleted 3. Check if other tags reference the same image digest (they won't be affected)

hcloud SWR DeleteRepoTag --namespace=group-dev --repository=nginx --tag=v1.0-old --cli-region=cn-north-4

Post-deletion Verification:

# Should return 404 or tag should not appear in list
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --tag=v1.0-old --cli-region=cn-north-4

Common Scenarios

S1: Tag Versioning Strategy

Apply semantic versioning with retagging:

# After pushing image with specific version tag
# Create aliases for release stages
hcloud SWR CreateRepoTag --namespace=group-dev --repository=my-app --source_tag=v2.1.0 --destination_tag=stable --override=true --cli-region=cn-north-4
hcloud SWR CreateRepoTag --namespace=group-dev --repository=my-app --source_tag=v2.1.0 --destination_tag=v2 --override=true --cli-region=cn-north-4
hcloud SWR CreateRepoTag --namespace=group-dev --repository=my-app --source_tag=v2.1.0 --destination_tag=latest --override=true --cli-region=cn-north-4

Recommended Tag Strategy:

• v{major}.{minor}.{patch} — specific version (e.g., v2.1.0)
• v{major}.{minor} — latest minor version (e.g., v2.1)
• v{major} — latest major version (e.g., v2)
• stable — current production-ready version
• latest — most recently pushed version

S2: Clean Up Old Tags

Periodically remove outdated tags to manage storage:

# 1. List all tags sorted by update time
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=my-app --order_column=updated_at --order_type=asc --cli-region=cn-north-4

# 2. For each old tag, verify and delete
hcloud SWR ShowRepoTag --namespace=group-dev --repository=my-app --tag=v1.0-beta --cli-region=cn-north-4
hcloud SWR DeleteRepoTag --namespace=group-dev --repository=my-app --tag=v1.0-beta --cli-region=cn-north-4

S3: Check Image Inventory

Audit all images across namespaces:

# For each namespace and repository, list tags
hcloud SWR ListReposDetails --namespace=group-dev --cli-region=cn-north-4
# Then for each repository:
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=nginx --order_column=updated_at --order_type=desc --cli-region=cn-north-4

Verification Method - SWR Image Management Skill

Overview

This document defines the verification steps for the SWR image management skill. Verification is divided into three levels: installation verification, configuration verification, and functional verification.

Level 1: Installation Verification

1.1 hcloud CLI Installation

1.2 hcloud CLI First Run

# Accept privacy statement (first time only)
printf "y\n" | hcloud version

Expected: Version number displayed without error.

Level 2: Configuration Verification

2.1 Credential Configuration

✅ Correct: Use hcloud configure list to verify ❌ Incorrect: Do NOT use echo $HUAWEI_CLOUD_AK to check credentials

2.2 Connectivity Test

# Test API connectivity with a read-only operation
hcloud SWR ListNamespaces --cli-region=cn-north-4

Expected: Returns HTTP 200 and namespace list (may be empty).

Level 3: Functional Verification

3.1 Namespace Management

# List namespaces (read-only)
hcloud SWR ListNamespaces --cli-region=cn-north-4

Expected: Displays list of SWR namespaces.

# Create a test namespace
hcloud SWR CreateNamespace --namespace=test-verify --cli-region=cn-north-4

Expected: Namespace created successfully.

# Show namespace details
hcloud SWR ShowNamespace --namespace=test-verify --cli-region=cn-north-4

Expected: Returns namespace details including name and creator.

# Clean up: delete test namespace
hcloud SWR DeleteNamespaces --namespace=test-verify --cli-region=cn-north-4

Expected: Namespace deleted successfully.

3.2 Repository Management

# Create a test repository
hcloud SWR CreateRepo --namespace=test-verify --repository=test-image --is_public=false --description="Verification test" --cli-region=cn-north-4

Expected: Repository created successfully.

# List repositories
hcloud SWR ListReposDetails --namespace=test-verify --cli-region=cn-north-4

Expected: Lists repositories including the test repository.

# Show repository details
hcloud SWR ShowRepository --namespace=test-verify --repository=test-image --cli-region=cn-north-4

Expected: Returns repository details.

# Update repository
hcloud SWR UpdateRepo --namespace=test-verify --repository=test-image --is_public=true --description="Updated for verification" --cli-region=cn-north-4

Expected: Repository updated successfully.

3.3 Tag Management (Requires an image pushed to the repository)

Note: Tag operations require an image to be pushed to the repository first using docker push.

# List tags (will be empty for new repo without pushed images)
hcloud SWR ListRepositoryTags --namespace=test-verify --repository=test-image --cli-region=cn-north-4

Expected: Returns tag list (may be empty for newly created repository).

3.4 Authentication

# Get temporary login token
hcloud SWR CreateAuthorizationToken --cli-region=cn-north-4

Expected: Returns login token and SWR registry host address.

# Get long-term login secret
hcloud SWR CreateSecret --cli-region=cn-north-4

Expected: Returns long-term login credentials.

3.5 Quota Check

hcloud SWR ListQuotas --cli-region=cn-north-4

Expected: Returns quota information with limits and current usage.

3.6 Clean Up

# Delete test repository
hcloud SWR DeleteRepo --namespace=test-verify --repository=test-image --cli-region=cn-north-4

# Delete test namespace
hcloud SWR DeleteNamespaces --namespace=test-verify --cli-region=cn-north-4

Expected: All test resources cleaned up.

Verification Checklist