[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud Registry](../../index.md) > [Step-by-step guides](../index.md) > Managing a registry > Creating a registry > Remote

# Creating a remote registry

{% note info %}

A remote registry can be created in any format except binary.

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create a remote registry.
    1. Navigate to **Cloud Registry**.
    1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Registries**.
    1. In the top-right corner, click **Create registry**.
    1. Select the registry format.
    1. In the **Registry type** field, select `Remote`.
    1. Select the source type:

        * `Public`: Public source.

            Registry format | Public source addresses
            --- | ---
            Maven | `Maven Central`<br/>`Gradle Plugin Portal`<br/>`Axiom`
            Npm | `Npm`
            Docker | `Docker Hub`
            NuGet| `NuGet`
            PyPI | `PyPI`<br/>`PyPI Test`


            {% note info %}

            You can get access to the `Axiom` public source on request. To activate access to `Axiom`, [create](https://center.yandex.cloud/support/tickets/create) a request to support.

            {% endnote %}


        * `Custom`: [Custom](../../concepts/registry.md#custom-registry) source.

            Specify your custom source address.

    1. Select the authorization type:

        {% note info %}

        Authorization is available for custom sources and the `Docker Hub` public source. For `Docker Hub`, only the `Basic` authorization type is available.

        {% endnote %}

        * `None`: Without authorization.

        * `Basic`: Authorization by username and password.

        * `Bearer`: Authorization by Bearer token.

    1. If `Basic` or `Bearer` is your selected authorization type:

        1. [Create](../../../lockbox/operations/secret-create.md) a Yandex Lockbox secret. In the **Key** field, specify `value`. In **Value**, specify as follows:

            * Password, for the `Basic` authorization type.
            * Bearer token, for the `Bearer` authorization type.

        1. Grant access to the contents of the secret to the Cloud Registry [service agent](../../../iam/concepts/service-control.md#service-agent) by assigning it the `lockbox.payloadViewer` [role](../../../lockbox/security/index.md#lockbox-payloadViewer) for this secret.

            Currently, you can only grant this access using the [Yandex Cloud CLI](../../../cli/quickstart.md) command by specifying the ID of the Yandex Lockbox secret containing the password or Bearer token and the [ID of the cloud](../../../organization/operations/organization-get-id.md) you are creating the registry in:

            ```bash
            yc lockbox secret add-access-binding \
              --id <secret_ID> \
              --role lockbox.payloadViewer \
              --agent cloud-registry:data-plane \
              --cloud-id <cloud_ID>
            ```

        1. In the registry settings, specify the username (if the authorization type is `Basic`) and the ID of the Yandex Lockbox secret you created.

    1. Enter a name and description for the registry.
    1. Add labels in `key: value` format.
    1. Click **Create**.

- CLI {#cli}

    To create a remote registry, run this command:

    ```
    yc cloud-registry registry create \
      --name <registry_name> \
      --description <registry_description> \
      --registry-kind <registry_format> \
      --registry-type remote \
      --properties <registry_properties>
    ```

    Where:
    * `--name`: Registry name.
    * `--description`: Registry description.
    * `--registry-kind`: Registry format. Available formats: `maven`, `npm`, `docker`, `nuget`, and `pypi`.
    * `--registry-type`: Registry [type](../../concepts/registry.md#registry-types).
    * `--properties`: Registry properties. Provide them as a string in `name1=value1,name2=value2` format. Available properties for remote registries are as follows:

        * `source`: Source registry. You can specify a public source or a [custom](../../concepts/registry.md#custom-registry) one. Available public sources are as follows:

            Registry format | Public source addresses
            --- | ---
            `maven` | `@maven-central`<br/>`@gradle-plugin-portal`<br/>`@axiom`
            `npm` | `@npmjs`
            `docker` | `@docker-hub`
            `nuget` | `@nuget`
            `pypi` | `@pypi`<br/>`@pypi-test`

            {% note info %}

            You can get access to the `@axiom` public source on request. To activate access to `@axiom`, [create](https://center.yandex.cloud/support/tickets/create) a request to support.

            {% endnote %}

        * `authorizationType`: Authorization type. Available authorization types: `none`, `basic`, and `bearer`. The default value is `none`.

            {% note info %}

            Authorization is available for custom sources and the `@docker-hub` public source. For `@docker-hub`, only the `basic` authorization type is available.

            {% endnote %}

            If `basic` or `bearer` is your specified `authorizationType`:

            1. [Create](../../../lockbox/operations/secret-create.md) a Yandex Lockbox secret. Set the `key` parameter to `value`; set the key value as follows:

                * Password, where `authorizationType` set to `basic`.
                * Bearer token, where `authorizationType` set to `bearer`.

            1. Grant access to the contents of the secret to the Cloud Registry [service agent](../../../iam/concepts/service-control.md#service-agent) by assigning it the `lockbox.payloadViewer` [role](../../../lockbox/security/index.md#lockbox-payloadViewer) for this secret.

                Run the command while specifying the ID of the Yandex Lockbox secret containing the password or Bearer token and the [ID of the cloud](../../../organization/operations/organization-get-id.md) you are creating the registry in:

                ```bash
                yc lockbox secret add-access-binding \
                  --id <secret_ID> \
                  --role lockbox.payloadViewer \
                  --agent cloud-registry:data-plane \
                  --cloud-id <cloud_ID>
                ```

        * `authorizationSecretId`: ID of the user secret that stores the password or Bearer token. It is required where `authorizationType` is set to `basic` or `bearer`.
        * `authorizationUsername`: Username. It is required if `authorizationType` is `basic`.

    Result:

    ```
    done (3s)
    id: cn1fsnc2dak********
    folder_id: b1gc1t4cb638********
    name: my-first-registry
    kind: DOCKER
    type: REMOTE
    status: ACTIVE
    description: docker
    created_at: "2024-11-30T16:11:12.901356Z"
    modified_at: "2024-11-30T16:11:16.243323Z"
    ```

- API {#api}

    To create a remote registry, use the [create](../../api-ref/Registry/create.md) REST API method for the [Registry](../../api-ref/Registry/index.md) resource or the [RegistryService/Create](../../api-ref/grpc/Registry/create.md) gRPC API call.

    In the `type` field, specify `REMOTE`.

{% endlist %}