Oracle Container Registry (OCIR)

Connect Oracle Cloud Infrastructure Container Registry (OCIR) to Safeguard. The IAM policy each credential needs, which credentials work, and step-by-step setup.

Availability

This integration is switched on per workspace. If you do not see the card under Integrations, ask your Safeguard contact.

What it does

The Oracle Container Registry (OCIR) card connects Safeguard to container images in Oracle Cloud Infrastructure (OCI) Container Registry. Safeguard lists your repositories and image tags, and each image you select becomes a project that Safeguard scans for an SBOM and vulnerability findings. Scans pull with your credential and are pinned to the image digest the tag points at when the scan starts. Find the card under Integrations on the Project/Product tab.

Only commercial-realm (oc1) regions are supported.

Public vs private

	Public	Private
What you enter	An Image URL, such as `ap-mumbai-1.ocir.io/<namespace>/<repository>:<tag>`	Region and one of the sign-in methods below
Credential needed	None. The repository must be marked public in OCI	An auth token, an API signing key, or both
What you can select	The public images you add by URL	Every repository the credential can see, or the Images you list

Supported auth methods

Method (dialog label)	Use it when	Notes
Auth token	Simple setup	Username and an auth token, the same pair `docker login` uses. Lists your namespace's repositories and pulls images
API signing key	You want listing across compartments	Tenancy OCID, User OCID, Key fingerprint and Private key (PEM). Safeguard lists repositories through the OCI Artifacts API and creates a short-lived pull token for each scan

Permissions required

Safeguard only reads. It never pushes, deletes or retags images, and calls no other Oracle service (no Object Storage, no Identity).

Auth token

IAM policy statement	Required?	What Safeguard uses it for
`Allow group <group> to read repos in tenancy` (or `in compartment <compartment>`)	Required	Listing repositories and tags (`/v2/` catalog and tag lists) and pulling images for scans

API signing key

IAM policy statement	Required?	What Safeguard uses it for
`Allow group <group> to read repos in tenancy` (or `in compartment <compartment>`)	Required	Listing container repositories and images through the Artifacts API, and the pull token for each scan

<group> is a group that contains the user the credential belongs to. inspect repos is not enough: it lists repositories but cannot pull images.

Least privilege: a dedicated user in a dedicated group with read repos in only the compartment that holds the images. You can narrow further with a condition, for example where all { target.repo.name=/team-app*/ }.

Token types

Credential type	Works?	Notes
Auth token of a dedicated IAM user	Yes (recommended)	Username `<tenancy namespace>/<user>`, or `<tenancy namespace>/<identity domain>/<user>`
API signing key of a dedicated IAM user	Yes	Paste the PRIVATE key with its BEGIN and END lines; a passphrase only if the key has one
Credentials of a user with `manage repos` or tenancy administrator rights	Works, not recommended	Safeguard never writes
Console password	No	OCIR needs an auth token, not the console password
Instance principals, resource principals or OCI session tokens	No	Not available

Expiry: OCI auth tokens and API keys do not expire on their own. Rotate them at least every 90 days.

What we never need: manage repos, use repos (push), Object Storage, Identity or any other service's permissions.

Step-by-step setup

Create the credential in Oracle Cloud

In the Oracle Cloud Console, create a group for Safeguard and add a dedicated user to it.
Create a policy in the tenancy (or the compartment) with Allow group <group> to read repos in tenancy (or in compartment <compartment>).
For Auth token: open the user, then Auth tokens > Generate token. Copy it; the Console does not show it again.
For API signing key: open the user, then API keys > Add API key, download the private key, and note the fingerprint, the user OCID and the tenancy OCID.
Find your tenancy namespace under Tenancy details > Object storage namespace.

Or with the OCI CLI

oci iam group create --name safeguard-ocir --description "Safeguard OCIR read"
oci iam policy create --compartment-id <tenancy-ocid> --name safeguard-ocir \
  --description "Safeguard read access to OCIR" \
  --statements '["Allow group safeguard-ocir to read repos in tenancy"]'
oci iam auth-token create --user-id <user-ocid> --description safeguard
# Check it:
docker login <region-key>.ocir.io -u '<tenancy-namespace>/<user>'

Connect it in Safeguard

Open Integrations and choose the Project/Product tab.
Click Connect on the Oracle Container Registry (OCIR) card.
For public images, choose Public, enter a Name, paste an Image URL, click Add, then Next.
For private images, choose Private, enter a Name, pick the Region (identifier or key, such as ap-mumbai-1 or bom) and the Sign-in method:
- Auth token: Username and Auth token; the Tenancy namespace fills in from the username;
- API signing key: Tenancy OCID, User OCID, Key fingerprint, Private key (PEM) and, if needed, Key passphrase and Compartment OCID.
Optionally list Images (one per line) to connect only those.
Click Verify Credentials. "Credentials verified." means OCI accepted them, with the number of repositories visible.
Click Next, select repositories and tags, review, and choose a connect option (fast, progressive or deep scan).

Webhooks and triggers

This integration has no webhooks. Each selected image is scanned when you connect it; to rescan new tags, set a schedule under Integrations > Scheduled or rescan by hand from the project.

What we read and store

Read: repository names, image tags and manifest digests, and the images you select for scanning.
Stored: the connection's settings, the SBOM and findings of each scanned image with its digest, and the credential, which is encrypted at rest and never shown again after you save it.
Not stored: image layers. The image is read for the scan and not kept.
No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Message you see	Cause	Fix
`The tenancy OCID starts with ocid1.tenancy.`	The Tenancy OCID field holds something else	Copy it from Tenancy details
`The user OCID starts with ocid1.user.`	The User OCID field holds something else	Copy it from the user's page
`The fingerprint is 16 pairs of hex digits separated by colons, as shown next to the API key.`	The fingerprint is malformed	Copy it from the user's API keys list
`Paste the PRIVATE key, including its BEGIN and END lines.`	The public key, or a partial key, was pasted	Paste the private `.pem` file you downloaded
`The compartment OCID starts with ocid1.compartment. (or ocid1.tenancy. for the root).`	The Compartment OCID is malformed	Copy it from the compartment's page, or leave it empty
`Not an Oracle Container Registry image: <names>`	An entry under Images is not an OCIR image path	Use `<region>.ocir.io/<namespace>/<repository>`
Verification fails with an auth token	Wrong username format, a console password instead of an auth token, or no `read repos` policy	Use `<tenancy namespace>/<user>` and an auth token, and check the policy

Rotation and disconnect

Rotate: generate a new auth token or add a new API key, find the connection under Project Configurations on the Project/Product tab, choose Update, enter the new values, verify and save, then delete the old token or key in OCI.
Disconnect: choose Delete from the connection's menu under Project Configurations and confirm Delete configuration, then delete the auth token or API key, or remove the user from the group.

Vendor references

Policies to control repository access, checked 2026-10-16.
Pulling images using the Docker CLI, checked 2026-10-16.

Oracle Container Registry (OCIR)

On this page