A container registry stores and distributes Docker images. Cloud registries (AWS ECR, Azure ACR, GCP Artifact Registry) integrate with their respective IAM systems. GitHub Container Registry (GHCR) is free for public images and integrates with GitHub Actions. Tagging strategy: tag by commit SHA (immutable) plus environment labels (latest, staging). Image signing (Cosign/Notary2) proves provenance. Trivy or Grype scan images for CVEs before deployment.
Trivy scan pipeline with severity-based gating.
Tag every image with the Git commit SHA. Enable immutable tags in your registry. This guarantees you know exactly what code is running in each environment.
Scanning after push means a vulnerable image is already in your registry. Scan locally in CI before pushing. Block push on CRITICAL CVEs. This is your last defence before deployment.
Every commit creates a new image. 50 developers × 10 commits/day = 500 new image tags per day. Implement lifecycle policies: delete untagged images after 7 days, SHA tags after 90 days.
Sign in to share your feedback and join the discussion.