Container Registries & Image Supply
Where images are stored, signed, and vetted
A registry stores, verifies and serves images: ECR, ACR, Artifact Registry, GHCR. Governance lives here — immutability, signing, scanning, replication, and fine-grained pull permissions.
What you will learn
- Explain repository/tag/digest/immutability semantics
- Enable scanning + signing in a registry workflow
- Design pull access per environment with least privilege
A registry is an artifact store + API (OCI Distribution). Repos hold tagged digests; digests uniquely identify content. Policies control immutability, scanning, replication, retention and who can pull.
What is this?
Concepts: repository (namespace), tag (mutable pointer), digest (sha256 content hash). Registries: ECR (per-account, IAM auth), ACR (replication across geos), Artifact Registry (repo types + IAM), GHCR (org-level). Security: vulnerability/secret scanning on push, signing (cosign/sigstore, notation), SBOM, immutable tags, geo-replication, cross-account pull grants, retention policies, and Registry Assessment scanning for IaC misconfig. Pull flows: EKS/ECS IAM role → ECRGetAuthorizationToken; GKE/Cloud Run → Google service identity; AKS → ACR key/identity.
Why do you need it?
- A compromised or poisoned base image is a supply-chain breadwinner for attackers.
- Digest-pinned + signed images make 'which exact bytes ran in prod?' verifiable.
- Cross-region replication saves cold-start and DR geographics.
- Registry IAM is the pull-permission gate: leases, not public pulls.
Mental model
A bank vault with separate lockers, seals and inspection logs
Hardened image registry
Only named people (IAM/roles) may open their locker (repo); contents are sealed (digest) and inspected on deposit (scanning/signing).
How it works
- Push: client authenticates, layers uploaded, manifest stored by digest.
- Tag → the pointer to today's digest; tags mutate, digests do not.
- Scanning runs over layers on push; findings flow to the pipeline gate.
- Signed tags carry provenance (signed-by, sha) verifiable at pull time.
- Policies: immutability rejects tag overrides; retention GCs old digests; replication mirrors to regions.
Registry supply gate.
Examples
Digest-pinned, verified pull
# CI signs the artifactcosign sign --key gcpkms://projects/acme/locations/global/keyRings/ci/cryptoKeys/sign ghcr.io/acme/api:v1.2 # runtime pulls ONLY the exact bytesimage: ghcr.io/acme/api@sha256:6f01d8...# + admission policy: reject unsigned images (Kyverno/sigstore policy)Both layers of trust are registry-native: cryptographically pinned bytes and provenance that admission controllers can enforce.
In production
- Pipeline gates: fail build on high severity findings before publish.
- Multi-account pull: app cluster role reads from the shared platform registry.
- Geo-replicated ACR/ECR replicated for DR and regional latency.
- Tag policy: `release-<ver>` immutable, `dev-*` mutable, retention 90 days.
Best practices
- Pin by digest in production; use tags only for human convenience.
- Enable push-time scanning and fail the pipeline over its gating.
- Sign release images and enforce verification at admission.
- Scopes pulls per environment/account identity — no public repositories.
- Set retention + immutability; clean old digests on a schedule.
Common mistakes
- Pulling mutable :latest in production and letting drift in silently.
- Public-by-default repos leaking app internals and secrets.
- Scanning after deploy rather than gating the build on findings.
- Ignoring registry IAM; every node with cluster creds pulls everything.
Debugging tips
- Pull 401 → token/principal mismatch; check region + repo grant, not just network.
- scan 'Unknown' for ages → scan CI broke or image not pushed to registry scan path.
- Digest mismatch across environments → image rebuilt with different content under the same tag.
- Replication drift → compare per-region digests and re-sync policy.
Interview checkpoint
Hands-on lab
- Push an image to a private registry
- Pin pulls by digest
- Enable scanning and interpret findings
Push, Pin, and Scan an Image
40 min · intermediate
Quick quiz
Which uniquely identifies image content?
Scanning flags: