🏷️Container Registry

NEW

Also known as: OCI Registry

Repository service that stores, versions, and distributes container images with access control.

DESCRIPTION

A container registry hosts image repositories, enabling teams to push, pull, and manage container images securely. Modern registries implement the OCI Distribution Specification for interoperability. They often provide vulnerability scanning, content signing, replication, retention policies, and fine-grained permissions. Popular registries include Docker Hub, GitHub Container Registry, Amazon ECR, Google Artifact Registry, Harbor, and Quay. Registries underpin CI/CD workflows and container supply chain security.

ALTERNATIVE DEFINITIONS

Docker

A registry is a storage and content delivery system, holding named Docker images, available in different tagged versions.

Defines the registry’s role in storing and serving image versions.

Source

Red Hat

A container registry is a repository, or a collection of repositories, used to store and access container images.

Clarifies organization into repositories for image storage and access.

Source

RELATED TERMS

Docker Hub Amazon ECR GitHub Container Registry Artifact Registry Harbor OCI Distribution Specification Container Image Content Trust SBOM Vulnerability Scanning

COMPETING TERMS

Artifact Repository

KNOWLEDGE AREAS

Platform & Tooling Infrastructure Software Engineering Cloud

TARGET AUDIENCE

DevOps Engineer Software Developer Cloud Architect MLOps Engineer Application Administrator

EXTERNAL SOURCES

• Wikipedia - Docker (software)
• Open Container Initiative - OCI Distribution API spec
• Harbor - Open-source registry docs
• AWS - Amazon ECR overview

TOP QUESTIONS

Why do teams need a Container Registry?

To securely store, version, and distribute container images for CI/CD, ensuring consistent deployments across environments.

Category: Relevancy

What features should I look for in a Container Registry?

OCI compliance, vulnerability scanning, access control, replication, and content signing are key enterprise features.

Category: Requirements

How do Container Registries support supply chain security?

They integrate scanning, SBOMs, and signature verification to detect vulnerabilities and validate provenance.

Category: Security

What’s the difference between a Container Registry and Docker Hub?

Docker Hub is a specific public registry; ‘container registry’ is the general service category, including private and on-prem options.

Category: Misunderstanding

How do I reduce egress costs with registries?

Use regional mirrors or on-prem registries close to clusters and enable caching/replication policies.

Category: Cost

Can a Container Registry store more than images?

Yes, many support OCI artifacts like Helm charts, SBOMs, and signatures via OCI extensions.

Category: Capabilities

What are common mistakes with Container Registries?

Using ‘latest’ tags in production, skipping immutability, and not enforcing RBAC can cause drift and risk.

Category: Mistakes

How do I enforce image immutability?

Enable immutable tags and promotion workflows using digests to prevent overwrites and ensure reproducibility.

Category: Best practices

How do registries integrate with Kubernetes?

Kubelets pull images using credentials in secrets; admission controllers can enforce signature policies.

Category: Integration