What is Container Registry?
A container registry is a service that stores and distributes container images, enabling developers to push, pull, and version images across environments.
A container registry is a centralized repository for storing and distributing container images. It acts as the image lifecycle manager, handling uploads (pushes), downloads (pulls), versioning, and access control. Registries can be public, such as Docker Hub and Google Container Registry (GCR), or private, like GitHub Container Registry (GHCR) and AWS Elastic Container Registry (ECR). They are essential in CI/CD pipelines, where built images are pushed to a registry and later pulled by orchestration platforms like Kubernetes for deployment.
Registries work over HTTPS, using the OCI Distribution Specification (formerly Docker Registry V2 API) to manage image blobs and manifests. When a user runs `docker push`, the client authenticates with the registry, uploads image layers as compressed tarballs, and sends a manifest referencing those layers. On `docker pull`, the registry returns the manifest, and the client downloads only missing layers. Most registries support content-addressable storage, image signing (e.g., Notary), vulnerability scanning, and retention policies. They integrate with identity providers for fine-grained access control and can be deployed on-premises or as SaaS.
In the container ecosystem, the registry sits between the build system and the runtime. Developers push images from local machines or CI servers; production clusters pull from the registry during pod initialization. Registries can be fronted by a content cache (e.g., Harbor, Nexus) to reduce bandwidth and improve pull speed in multi-cluster setups. They are a critical component of supply chain security, as compromised registries can distribute malicious images. The OCI Artifact Specification extends registries to store non-image artifacts like Helm charts and OPA bundles.
Key facts
- Container registries implement the OCI Distribution Specification for push/pull operations.
- Public registries like Docker Hub serve millions of images; private ones enforce access controls.
- Images are stored as layers, with manifests referencing layer digests for content-addressability.
- Registries often integrate with CI/CD tools and Kubernetes for automated deployments.
- Vulnerability scanning and image signing are common security features in modern registries.
How it works in practice
Related terms
References
More in Containers & Orchestration
ConfigMap
A ConfigMap is a Kubernetes API object used to store non-confidential configuration data in key-value pairs, which pods can consume as environment variables, command-line arguments, or configuration files.
Container
A container is a lightweight, isolated runtime that packages an application with its dependencies using OS-level virtualization, enabling consistent execution across environments.
Container Image
A container image is a lightweight, standalone, executable package that includes everything needed to run a piece of software: code, runtime, system tools, libraries, and settings. It is the unit of distribution in container ecosystems like Docker and Kubernetes.
Container Runtime
A container runtime is the low-level software that creates, starts, and stops containers according to the OCI runtime specification, enabling process isolation and resource management.
Docker
Docker is a platform and toolchain for packaging, distributing, and running applications inside lightweight, portable containers, popularising the technology from 2013 onward.
Helm
Helm is a package manager for Kubernetes that uses charts to define, install, and upgrade complex applications as a single, versioned unit.
Ingress Controller
An Ingress Controller is a Kubernetes component that watches Ingress resources and configures a reverse proxy to route external HTTP and HTTPS traffic to services inside the cluster.
Init Container
An init container is a specialized container in a Kubernetes pod that runs to completion before any regular containers start, performing initialization or setup tasks.
Kubernetes
Kubernetes is an open source platform for automating the deployment, scaling, and management of containerized applications across clusters of hosts.
Operator
A Kubernetes Operator is a custom controller that extends the Kubernetes API to automate the management of a specific application, encoding human operational knowledge as code.