Document URL: https://docs.openshift.com/container-platform/3.4/install_config/registry/accessing_registry.html#access

Section Number and Name:  Installation and Configuration - Accessing the Registry - Accessing the Registry Directly

Describe the issue: 

It gives special roles to normal users like "system:registry" and "system:image-builder". They are roles for system users (in other words service accounts), the "system:registry" for service account default/registry and "system:image-builder" for service account */builder.

These "system:" roles are not supposed to bind to normal users.

Also it gives "admin" role to a user on openshift project, which is too wide and not recommended.

Suggestions for improvement: 

To allow a user to docker push to particular project, we need:

oadm policy add-role-to-user registry-editor USERNAME -n PROJECT

For example, user joe and project openshift:

oadm policy add-role-to-user registry-editor joe -n openshift

For pull only acceess we can use "registry-viewer" role, also worth to put here.

Additional information: