Container Registries Cheat Sheet

Updated 2026-05-25

Next Topic: Container Resource Management Cheat Sheet

🧠Study flashcards on this topic117 cards · spaced repetition→

Container registries are centralized repositories for storing, managing, and distributing container images, serving as the critical bridge between image builds and deployments. These registries implement the OCI Distribution Specification, ensuring interoperability across tools and platforms while providing features like access control, vulnerability scanning, image signing, geo-replication, and OCI artifact storage. Whether using public registries like Docker Hub or private registries like ECR and Harbor, understanding authentication methods, tagging strategies, and lifecycle management is essential for secure and efficient container operations. A key insight: always reference images by digest rather than tags in production to guarantee immutable deployments, and leverage pull-through caches to avoid rate limits and reduce latency.

What This Cheat Sheet Covers

This topic spans 16 focused tables and 135 indexed concepts, 117 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Popular Registry ProvidersTable 2: Authentication MethodsTable 3: Pull Secrets & Access ControlTable 4: Image Tagging StrategiesTable 5: Multi-Architecture ImagesTable 6: Registry Mirrors & CachingTable 7: Image Management CLI ToolsTable 8: OCI Artifacts & Non-Image StorageTable 9: Image Retention & CleanupTable 10: Replication & Geo-DistributionTable 11: Registry APIs & IntegrationTable 12: Image Signing & VerificationTable 13: Vulnerability Scanning & SBOMsTable 14: Advanced Security FeaturesTable 15: Monitoring & ObservabilityTable 16: Registry Storage Backends

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Popular Registry Providers

Choosing the right registry depends on your cloud ecosystem, security requirements, and whether you need public distribution, private internal hosting, or self-hosted control. All major modern registries implement the OCI Distribution Specification, making images portable across providers.

Provider	Example	Description
Docker Hub	`docker pull nginx:latest` `docker push myuser/myapp:1.0`	• Most widely used public registry with official vendor images, Docker Verified Publishers, AI model catalog, and MCP server catalog • Rate limits: 100 pulls/6h per IP (unauthenticated), 200/6h (free authenticated), unlimited (Pro/Team/Business).
GitHub Container Registry (ghcr.io)	`docker pull ghcr.io/owner/image:tag` `docker login ghcr.io -u user -p $GITHUB_TOKEN`	• Integrated with GitHub Actions • uses GITHUB_TOKEN or personal access tokens for auth • supports public images without authentication, Helm charts, and other OCI artifacts.
Amazon ECR	`aws ecr get-login-password \| docker login` `docker push 123456.dkr.ecr.us-east-1.amazonaws.com/repo:tag`	• AWS-managed registry with IAM-based access control • auth tokens expire after 12 hours • supports OCI 1.1 with Referrers API, vulnerability scanning via Amazon Inspector, and lifecycle policies.
Azure Container Registry (ACR)	`az acr login --name myregistry` `docker push myregistry.azurecr.io/image:tag`	• Enterprise-grade registry with geo-replication, private endpoints, and RBAC • supports service principals, managed identities, and admin credentials • integrates with AKS seamlessly and supports OCI artifacts including Helm, Bicep, and WASM.
Google Artifact Registry	`gcloud auth configure-docker us-docker.pkg.dev` `docker push us-docker.pkg.dev/project/repo/image:tag`	• Successor to GCR • supports Docker, Helm, Maven, npm, Python, and more • fine-grained IAM, vulnerability scanning via Binary Authorization, CMEK encryption, and multi-region replication.
Harbor	`docker login harbor.example.com` `docker push harbor.example.com/library/app:v1`	• CNCF-graduated open-source registry with RBAC, multi-tenancy, replication, webhooks, and Trivy scanning • supports OCI v2.0, auto-SBOM generation on push, and Harbor Satellite for edge deployments.
JFrog Artifactory	`docker login mycompany.jfrog.io` `docker push mycompany.jfrog.io/docker/image:tag`	• Universal artifact manager supporting Docker, Helm, Maven, npm, and 30+ package types • OCI v1.1 compliant with Referrers API; enterprise features include advanced RBAC, AQL query language, and CDN distribution.
Quay.io	`docker pull quay.io/username/app:latest` `docker login quay.io`	• Managed by Red Hat • supports robot accounts for automation, geo-replication, time-machine rollback, and OCI Referrers API • offers hosted (Quay.io) and self-hosted (Project Quay) options.
GitLab Container Registry	`docker login registry.gitlab.com` `docker push registry.gitlab.com/group/project:tag`	• Integrated with GitLab CI/CD • uses project access tokens or personal tokens • supports per-project cleanup policies, tag expiration, and immutable tags.
Cloudsmith	`docker login docker.cloudsmith.io` `docker push docker.cloudsmith.io/org/repo/image:tag`	• SaaS-based multi-format registry supporting OCI v1.1, Docker, Helm, and 20+ package formats • unified policy engine, ML model tracking, and strong external distribution features.
Oracle Container Registry (OCIR)	`docker login <region>.ocir.io` `docker push <region>.ocir.io/<tenancy>/<repo>:tag`	• Managed service in Oracle Cloud with OCI IAM access control • supports private and public repositories, multi-architecture images, and high availability through replication.
Zot	`docker pull localhost:5000/image:tag` `./zot serve config.json`	• Lightweight CNCF Sandbox OCI-native registry • single static binary with no dependencies • supports OCI 1.1, Referrers API, and is embedded by Harbor Satellite for edge deployments.
Google Container Registry (GCR) (legacy)	`docker push gcr.io/project-id/image:tag`	• Deprecated and shut down; fully replaced by Google Artifact Registry • existing GCR images migrated via transition repositories that redirect pulls to Artifact Registry.

Table 2: Authentication Methods

Registry authentication ranges from simple interactive logins to keyless federated identity — picking the right method for each context (interactive, CI/CD, Kubernetes workloads) is critical for both security and operability.

Method	Example	Description
Personal Access Token (PAT)	`docker login -u myuser -p $TOKEN` `export GITHUB_TOKEN=ghp_...`	• Scoped token with limited permissions and optional expiry • best practice over passwords for automated systems, CI/CD pipelines, and interactive sessions.

The rest of this section is part of the full cheat sheet

Table 3: Pull Secrets & Access Control

Kubernetes does not automatically have access to private registries. Pull secrets bridge the gap — but cloud-native identity bindings are the more secure, maintainable alternative that eliminates credential rotation.

Concept	Example	Description
imagePullSecrets	`imagePullSecrets:` `- name: regcred` in Pod spec	• Kubernetes secret containing registry credentials • allows kubelet to pull from private registries • must exist in the same namespace as the pod.

The rest of this section is part of the full cheat sheet

Table 4: Image Tagging Strategies

Tags are mutable pointers to image digests — an often-underappreciated distinction that causes subtle production bugs. Understanding which tags are safe to pin and which are ephemeral is essential before designing any tagging scheme.

Strategy	Example	Description
Semantic Versioning	`myapp:1.2.3` `myapp:v2.0.0`	• Uses MAJOR.MINOR.PATCH format • immutable once pushed (with tag immutability enabled) • ideal for production releases and dependency management.

The rest of this section is part of the full cheat sheet

Table 1: Popular Registry Providers

Provider	Example	Description
Docker Hub	`docker pull nginx:latest` `docker push myuser/myapp:1.0`	• Most widely used public registry with official vendor images, Docker Verified Publishers, AI model catalog, and MCP server catalog • Rate limits: 100 pulls/6h per IP (unauthenticated), 200/6h (free authenticated), unlimited (Pro/Team/Business).
GitHub Container Registry (ghcr.io)	`docker pull ghcr.io/owner/image:tag` `docker login ghcr.io -u user -p $GITHUB_TOKEN`	• Integrated with GitHub Actions • uses GITHUB_TOKEN or personal access tokens for auth • supports public images without authentication, Helm charts, and other OCI artifacts.
Amazon ECR	`aws ecr get-login-password \| docker login` `docker push 123456.dkr.ecr.us-east-1.amazonaws.com/repo:tag`	• AWS-managed registry with IAM-based access control • auth tokens expire after 12 hours • supports OCI 1.1 with Referrers API, vulnerability scanning via Amazon Inspector, and lifecycle policies.
Azure Container Registry (ACR)	`az acr login --name myregistry` `docker push myregistry.azurecr.io/image:tag`	• Enterprise-grade registry with geo-replication, private endpoints, and RBAC • supports service principals, managed identities, and admin credentials • integrates with AKS seamlessly and supports OCI artifacts including Helm, Bicep, and WASM.
Google Artifact Registry	`gcloud auth configure-docker us-docker.pkg.dev` `docker push us-docker.pkg.dev/project/repo/image:tag`	• Successor to GCR • supports Docker, Helm, Maven, npm, Python, and more • fine-grained IAM, vulnerability scanning via Binary Authorization, CMEK encryption, and multi-region replication.
Harbor	`docker login harbor.example.com` `docker push harbor.example.com/library/app:v1`	• CNCF-graduated open-source registry with RBAC, multi-tenancy, replication, webhooks, and Trivy scanning • supports OCI v2.0, auto-SBOM generation on push, and Harbor Satellite for edge deployments.
JFrog Artifactory	`docker login mycompany.jfrog.io` `docker push mycompany.jfrog.io/docker/image:tag`	• Universal artifact manager supporting Docker, Helm, Maven, npm, and 30+ package types • OCI v1.1 compliant with Referrers API; enterprise features include advanced RBAC, AQL query language, and CDN distribution.
Quay.io	`docker pull quay.io/username/app:latest` `docker login quay.io`	• Managed by Red Hat • supports robot accounts for automation, geo-replication, time-machine rollback, and OCI Referrers API • offers hosted (Quay.io) and self-hosted (Project Quay) options.
GitLab Container Registry	`docker login registry.gitlab.com` `docker push registry.gitlab.com/group/project:tag`	• Integrated with GitLab CI/CD • uses project access tokens or personal tokens • supports per-project cleanup policies, tag expiration, and immutable tags.
Cloudsmith	`docker login docker.cloudsmith.io` `docker push docker.cloudsmith.io/org/repo/image:tag`	• SaaS-based multi-format registry supporting OCI v1.1, Docker, Helm, and 20+ package formats • unified policy engine, ML model tracking, and strong external distribution features.
Oracle Container Registry (OCIR)	`docker login <region>.ocir.io` `docker push <region>.ocir.io/<tenancy>/<repo>:tag`	• Managed service in Oracle Cloud with OCI IAM access control • supports private and public repositories, multi-architecture images, and high availability through replication.
Zot	`docker pull localhost:5000/image:tag` `./zot serve config.json`	• Lightweight CNCF Sandbox OCI-native registry • single static binary with no dependencies • supports OCI 1.1, Referrers API, and is embedded by Harbor Satellite for edge deployments.
Google Container Registry (GCR) (legacy)	`docker push gcr.io/project-id/image:tag`	• Deprecated and shut down; fully replaced by Google Artifact Registry • existing GCR images migrated via transition repositories that redirect pulls to Artifact Registry.

Table 2: Authentication Methods

Method	Example	Description
Personal Access Token (PAT)	`docker login -u myuser -p $TOKEN` `export GITHUB_TOKEN=ghp_...`	• Scoped token with limited permissions and optional expiry • best practice over passwords for automated systems, CI/CD pipelines, and interactive sessions.

Table 3: Pull Secrets & Access Control

Concept	Example	Description
imagePullSecrets	`imagePullSecrets:` `- name: regcred` in Pod spec	• Kubernetes secret containing registry credentials • allows kubelet to pull from private registries • must exist in the same namespace as the pod.

Table 4: Image Tagging Strategies

Strategy	Example	Description
Semantic Versioning	`myapp:1.2.3` `myapp:v2.0.0`	• Uses MAJOR.MINOR.PATCH format • immutable once pushed (with tag immutability enabled) • ideal for production releases and dependency management.