What is Container Registry
Docker image storage
Container Registry
Container Registry is a centralized storage for Docker images and other OCI-compliant artifacts, providing versioning, access control, and container distribution.
Registry Types
| Type | Examples | |------|----------| | Public | Docker Hub, GitHub Container Registry | | Cloud | AWS ECR, Google GCR, Azure ACR | | Self-hosted | Harbor, Nexus, JFrog Artifactory | | GitLab | GitLab Container Registry |
Key Features
- Image Storage — Centralized repository
- Versioning — Tags and digest for identification
- Access Control — RBAC and security policies
- Vulnerability Scanning — Integration with Trivy, Clair
- Replication — Mirroring across regions
Working with Registry
| Command | Description | |---------|-------------| | docker login | Authenticate to registry | | docker push | Upload image | | docker pull | Download image | | docker tag | Create tag |
Best Practices
- Use immutable tags (not latest)
- Scan images for vulnerabilities
- Sign images (Cosign, Notary)
- Set up cleanup policy for old images
- Enable garbage collection
CI/CD Integration
# GitLab CI example
build:
script:
- docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
- docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA