---
title: "Filtering Rules Syntax"
description: "How to write pattern filters in Container Registry: single and double stars, the question mark, brace lists, and regular expressions, with an example for each."
date: 2021-08-13
lastmod: 2026-08-31
canonical: "https://container-registry.com/docs/2.16/user-manual/filtering-rules-syntax/"
source: "https://container-registry.com/docs/2.16/user-manual/filtering-rules-syntax/index.md"
harbor_version: "2.16"
agent_instructions: "This is the markdown representation of https://container-registry.com/docs/2.16/user-manual/filtering-rules-syntax/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt."
---

> Agent-friendly representation of <https://container-registry.com/docs/2.16/user-manual/filtering-rules-syntax/index.md>. Site index: <https://container-registry.com/llms.txt>.


# Filtering Rules Syntax

*How to write pattern filters in Container Registry: single and double stars, the question mark, brace lists, and regular expressions, with an example for each.*


Filtering Rules Syntax
=================================

Several Container Registry features let you select repositories or tags by a pattern instead of listing every name. You write the pattern once, and it matches every name that fits. Proxy cache filters, replication filters, tag retention rules, tag immutability rules, and P2P preheat policies all use the patterns on this page.

A pattern is written in one of two ways:

* A **glob pattern** uses the wildcards `*`, `**`, and `?`. This is the default wherever a feature offers a choice.
* A **regular expression** matches against the full name. Some features also accept this form.

## Glob patterns

A glob pattern matches a name with wildcards.

### Double star (`**`)

`**` matches any characters, including the `/` path separator.

* `**` on its own matches every name.
* `library/**` matches every repository under `library/`.

For example, in the tag retention rule dialog, `**` selects all repositories:

![](../img/retention_example_doublestar.png)

### Single star (`*`)

`*` matches any characters up to the next `/`. It stops at a separator.

* `release*` matches every name that starts with `release`.
* `*release` matches every name that ends with `release`.
* `*release*` matches every name with `release` anywhere in it.

To cross a `/`, use `**`, or put a star in each segment. `release*/test*/**` matches `release_2021/test_new/1.0`.

### Question mark (`?`)

`?` matches exactly one character. `test?` matches `test1` and `test2`, but not `test12`.

### Match several patterns with braces

To match more than one pattern at once, list them in braces and separate them with commas: `{library/**,bitnami/**}`. You can use `*`, `**`, and `?` inside the list.

A comma only separates patterns **inside** braces. Outside braces, a comma is a literal character, treated as part of the name. So a bare list such as `library/**,bitnami/**` is read as one pattern and matches nothing. Use the brace form instead.

For the full glob definition, see the [doublestar pattern reference](https://github.com/bmatcuk/doublestar#patterns).

## Regular expressions

A regular expression matches against the **full** name, from start to end, so anchor it accordingly.

* `^library/.*` matches every repository whose path starts with `library/`.

Use a regular expression when a glob pattern cannot express the match you need.