[Yandex Cloud documentation](../../index.md) > [Yandex Container Registry](../index.md) > FAQ

# FAQ about Container Registry

#### Why is the latest tag missing or applied to a Docker image that is not the last one pushed? {#latest}

The reason is that you specified a different [tag](../concepts/docker-image.md#version) when pushing the [Docker image](../concepts/docker-image.md).

The Docker client assigns the `latest` tag automatically if the Docker image is created and pushed without a tag. You can also specify the `latest` tag explicitly.

{% note warning %}

The tag `latest` **doesn't mean** that the Docker image was the latest one pushed.

{% endnote %}

We don't recommend overwriting tags. Use a unique tag for each Docker image version. This way you can use the same Docker image version on all your VMs with identical specifications and more easily identify causes of problems.

#### How do I make a registry public? {#public-registry}

You can grant the [container-registry.images.puller](../security/index.md#container-registry-images-puller) [role](../../iam/concepts/access-control/roles.md) for your [registry](../concepts/registry.md) to the [All users](../../iam/concepts/access-control/public-group.md) public group.

{% note alert %}

This makes all Docker images in the registry available without [authentication](../operations/authentication.md).

Do not assign the `container-registry.images.pusher`, `editor`, or `admin` roles for the registry to the public group. This will enable anyone with your registry ID to use the registry.

{% endnote %}

#### I encountered an error. What should I do? {#error}

See [Troubleshooting in Container Registry](../error/index.md). It lists common errors and ways to solve them.

#### Can I get logs of my operations in Yandex Cloud? {#logs}

Yes, you can request information about operations with your resources from Yandex Cloud logs. Do it by contacting [support](https://center.yandex.cloud/support).

#### What does the "Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock" error mean? {#permission-denied}

You are not running commands as a `root` user.

You can use `sudo` or configure [non-root access](https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user).

#### How do I diagnose Credential Helper performance? {#cred-helper}

* Check under which OS user and on which host the [CLI](../../cli/index.md) commands are run. This must be the user that the [Credential Helper](../operations/authentication.md#cred-helper) is configured for and on whose behalf the `yc container registry configure-docker` command was run. The corresponding line must appear in the file `/home/<user>/.docker/config.json`. If you are working on a [virtual machine](../../compute/concepts/vm.md), make sure you have the Credential helper configured there as well.
* Check if the Credential Helper is displayed in `PATH` when running commands. During authentication in Container Registry using the Credential Helper, Docker accesses the `docker-credential-yc` binary file. Make sure this binary file is available in `PATH` for the user working with Docker. For example, if Docker is used with `sudo`, then `configure-docker` must be run with `sudo`, too. You can check this with either `echo cr.yandex | docker-credential-yc get` or `echo cr.yandex | sudo docker-credential-yc get` command, if using `sudo` to run commands. If everything works fine, you will get a response in `{"Username":"iam","Secret":"***<IAM token>***"}` format.
* If the commands run in interactive mode but fail in non-interactive mode, check the `.bashrc` file. The `yc` and `docker-credential-yc` programs are installed in a directory that is not usually available in the default `PATH`. In this case, the following lines are added to the `.bashrc` file:

   ```text
   # The next line updates PATH for Yandex Cloud CLI
   if [ -f '/home/<user>/yandex-cloud/path.bash.inc' ]; then source '/home/<user>/yandex-cloud/path.bash.inc'; fi
   ```

   The top section of the `.bashrc` file contains a condition preventing its commands from running non-interactively. That is why the commands can run when connecting to the VM manually, but fail to run when doing so via SSH.

#### What does "Error response from daemon: pull access denied for <cr.yandex/registry_ID/Docker_image_name>, repository does not exist or may require 'docker login': denied: Permission denied ; requestId = <request_ID>" mean? {#permission-denied-ip}

The [IP address](../../vpc/concepts/address.md) that the pull Docker image request is received from has no PULL permission.

[Add rules that allow pulling image](../operations/registry/registry-access.md) for this IP in the registry settings or delete all rules and try again.