| **read** access | public, if user is public, otherwise for this user only | public, if org is public, otherwise for org members only |
| **write** access | owner only | org members with admin or write access to the org |
Additionally, public access can be restricted instance-wide by the setting of [`service.REQUIRE_SIGNIN_VIEW`](../../admin/config-cheat-sheet/#service-service).
| Type | Every rule manages a specific package type. |
| Apply pattern to full package name | If enabled, the patterns below are applied to the full package name (`package/version`). Otherwise only the version (`version`) is used. |
| Keep the most recent | How many versions to _always_ keep for each package. |
| Keep versions matching | The regex pattern that determines which versions to keep. An empty pattern keeps no version while `.+` keeps all versions. The container registry will always keep the `latest` version even if not configured. |
| Remove versions older than | Remove only versions older than the selected days. |
| Remove versions matching | The regex pattern that determines which versions to remove. An empty pattern or `.+` leads to the removal of every package if no other setting tells otherwise. |
Every cleanup rule can show a preview of the affected packages.
This can be used to check if the cleanup rules is proper configured.
### Regex examples
Regex patterns are automatically surrounded with `\A` and `\z` anchors.
Do not include any `\A`, `\z`, `^` or `$` token in the regex patterns as they are not necessary.
The patterns are case-insensitive which matches the behaviour of the package registry in Forgejo.
| `release.*` | Match versions that are either named or start with `release`. |
| `.+-temp-.+` | Match versions that contain `-temp-`. |
| `v.+\|release` | Match versions that either start with `v` or are named `release`. |
| `package/v.+\|other/release` | Match versions of the package `package` that start with `v` or the version `release` of the package `other`. This needs the setting _Apply pattern to full package name_ enabled. |
The cleanup rules are part of the [clean up job](../../admin/config-cheat-sheet/#cron---cleanup-expired-packages-croncleanup_packages) and run periodically.
