You can review new features, bug fixes, known issues, and configuration changes for each Project Quay release. Use these notes to plan upgrades and understand changes that affect standalone and OpenShift Container Platform deployments.

About Project Quay

Project Quay is a container registry platform for secure storage, distribution, and governance of containers and cloud-native artifacts. You can deploy it as a standalone component or as an Operator on OpenShift Container Platform.

Project Quay includes the following features and benefits:

  • Granular security management

  • Fast and robust at any scale

  • High velocity CI/CD

  • Automated installation and updates

  • Enterprise authentication and team-based access control

  • OpenShift Container Platform integration

Project Quay is regularly released, containing new features, bug fixes, and software updates. You can upgrade Project Quay for both standalone and OpenShift Container Platform deployments.

Important

Project Quay only supports rolling back, or downgrading, to previous z-stream versions, for example, {producty-n1}.2 → {producty-n1}.1. Rolling back to previous y-stream versions ({producty} → {producty-n1}) is not supported. This is because Project Quay updates might contain database schema upgrades that are applied when upgrading to a new version of Project Quay. Database schema upgrades are not considered backwards compatible.

Downgrading to previous z-streams is neither recommended nor supported by either Operator based deployments or virtual machine based deployments. Downgrading should only be done in extreme circumstances. The decision to rollback your Project Quay deployment must be made in conjunction with the Project Quay support and development teams. For more information, contact Project Quay support.
Additional resources

Project Quay release notes

You can review y-stream and z-stream release information for Project Quay, including new features, bug fixes, and known issues for each version.

RHBA-TBD - Project Quay 5.0.0 release

Project Quay {producty} is available with Clair {clairproductminv}. You can review the advisory, compatibility matrix, and life cycle policy for this release.

Issued TBD

Project Quay release {producty} is now available with Clair {clairproductminv}. The bug fixes that are included in the update are listed in the RHBA-TBD advisory. For the most recent compatibility matrix, see Quay Enterprise 3.x Tested Integrations. For information on the release cadence of Project Quay, see the Project Quay Life Cycle Policy.

Project Quay new features and enhancements

You can review new features and enhancements in Project Quay {producty}.

Configurable gunicorn worker timeout

  • Project Quay {producty} introduces configurable gunicorn worker timeout settings. Two new config.yaml parameters, GUNICORN_REGISTRY_TIMEOUT and GUNICORN_WEB_TIMEOUT, allow administrators to increase the gunicorn worker timeout beyond the previous hardcoded 30-second default.

    Increasing these values prevents worker termination during long-running operations, including large image pushes, proxy cache blob downloads, and API queries on large organizations with quota enabled. The default values are 300 seconds for the registry process and 60 seconds for the web process. The minimum accepted value for both parameters is 30 seconds and the maximum is 300 seconds.

Red Hat Quay on OpenShift Container Platform new features and enhancements

You can review new features and enhancements for Red Hat Quay on OpenShift Container Platform in {producty}.

Default NetworkPolicy support for Operator-managed components

  • Project Quay {producty} introduces automatic NetworkPolicy management for all Operator-managed components. The Project Quay Operator now creates and reconciles default NetworkPolicy objects for each managed component, including Quay, Clair, PostgreSQL, Redis, mirror, and upgrade jobs. Policies are applied only for components that are explicitly marked as managed in the QuayRegistry custom resource; components marked as unmanaged do not receive NetworkPolicy restrictions.

    The default policies are not user-configurable. Some components, such as the Quay application and Clair, intentionally use broad egress rules to accommodate external dependencies, including cloud-based object storage, proxied upstream registries, and Clair’s CVE database updates.

Project Quay configuration fields updates and changes

You can review configuration fields that are new or changed in Project Quay {producty}.

Gunicorn worker timeout configuration fields

The following configuration fields allow you to tune the gunicorn worker timeout for the registry and web processes. Previously, the timeout was hardcoded at 30 seconds, which caused worker termination during legitimate long-running operations such as large image pushes, proxy cache blob downloads, and API queries on large organizations with quota enabled.

Field Type Description

GUNICORN_REGISTRY_TIMEOUT

Integer

Specifies the worker timeout, in seconds, for the gunicorn-registry process. The minimum value is 30. The maximum value is 300. Defaults to 300.

GUNICORN_WEB_TIMEOUT

Integer

Specifies the worker timeout, in seconds, for the gunicorn-web process. The minimum value is 30. The maximum value is 300. Defaults to 60.

API endpoint enhancements

You can review API enhancements in Project Quay {producty}.

Project Quay bug fixes

You can review bug fixes included in Project Quay {producty}.

The following issues were fixed with Project Quay {producty}:

Project Quay feature tracker

You can track Project Quay feature availability across recent releases, including Technology Preview status, and review platform support for IBM Power, IBM Z, and IBM LinuxONE.

Some features available in previous releases have been deprecated or removed. Deprecated functionality is still included in Project Quay, but is planned for removal in a future release and is not recommended for new deployments. For the most recent list of deprecated and removed functionality in Project Quay, refer to Table 1.1. Additional details for more fine-grained functionality that has been deprecated and removed are listed after the table.

Table 1. Features tracker
Feature Quay 5 Quay 3.18 Quay 3.17

Microsoft Entra ID v2 token and multi-issuer OIDC support

-

General Availability

-

Programmatic OAuth token provisioning

-

Technology Preview

-

OpenShift Container Platform cluster TLS security profile inheritance & Post-Quantum Cryptography (PQC) readiness

-

General Availability

-

Sparse manifest support for multi-architecture filtering

-

General Availability

General Availability

Immutable tags overview

-

General Availability

General Availability

Proof Key for Code Exchange support for OIDC

-

General Availability

General Availability

v1 UI

-

Deprecated

Deprecated
IBM Power, IBM Z, and IBM® LinuxONE support matrix
Table 2. list of supported and unsupported features
Feature IBM Power IBM Z and IBM® LinuxONE

Allow team synchronization via OIDC on Azure

Not Supported

Not Supported

Backing up and restoring on a standalone deployment

Supported

Supported

Clair Disconnected

Supported

Supported

Geo-Replication (Standalone)

Supported

Supported

Geo-Replication (Operator)

Supported

Supported

IPv6

Not Supported

Not Supported

Migrating a standalone to operator deployment

Supported

Supported

Mirror registry

Supported

Supported

Quay config editor - mirror, OIDC

Supported

Supported

Quay config editor - MAG, Kinesis, Keystone, GitHub Enterprise

Not Supported

Not Supported

Quay config editor - Red Hat Quay V2 User Interface

Supported

Supported

Quay Disconnected

Supported

Supported

Repo Mirroring

Supported

Supported