diff --git a/docs/img/read_only.png b/docs/img/read_only.png
new file mode 100644
index 000000000..85e55a8f5
Binary files /dev/null and b/docs/img/read_only.png differ
diff --git a/docs/img/read_only_enable.png b/docs/img/read_only_enable.png
new file mode 100644
index 000000000..29ad806d1
Binary files /dev/null and b/docs/img/read_only_enable.png differ
diff --git a/docs/user_guide.md b/docs/user_guide.md
index a791d8aa3..79034d06c 100644
--- a/docs/user_guide.md
+++ b/docs/user_guide.md
@@ -15,6 +15,7 @@ This guide walks you through the fundamentals of using Harbor. You'll learn how
   * [Manage project creation.](#managing-project-creation)
   * [Manage self-registration.](#managing-self-registration)
   * [Manage email settings.](#managing-email-settings)
+  * [Manage registry read only.](#managing-registry-read-only)
 * [Pull and push images using Docker client.](#pulling-and-pushing-images-using-docker-client)
 * [Add description to repositories](#add-description-to-repositories)
 * [Delete repositories and images.](#deleting-repositories)
@@ -225,6 +226,20 @@ You can manage whether a user can sign up for a new account. This option is not
 You can change Harbor's email settings, the mail server is used to send out responses to users who request to reset their password.  
 ![browse project](img/new_config_email.png)
 
+### Managing registry read only
+You can change Harbor's registry read only settings, read only mode will allow 'docker pull' while preventing 'docker push' and the deletion of repository and tag.
+![browse project](img/read_only.png)
+
+If it set to true, deleting repository, tag and pushing image will be disabled. 
+![browse project](img/read_only_enable.png)
+
+```
+$ docker push 10.117.169.182/demo/ubuntu:14.04  
+The push refers to a repository [10.117.169.182/demo/ubuntu]
+0271b8eebde3: Preparing 
+denied: The system is in read only mode. Any modification is prohibited.  
+``` 
+
 ## Pulling and pushing images using Docker client  
 
 **NOTE: Harbor only supports Registry V2 API. You need to use Docker client 1.6.0 or higher.**