TOPIC DEVOPS
Artifact Management storing, versioning, and distributing build outputs
IN 10 SECONDS
After CI builds your code, the output — a Docker image, JAR, npm package, or binary — is pushed to an artifact registry (Docker Hub, ECR, Artifactory, GHCR). Each artifact is immutable and tagged with a version or commit SHA. Deployments pull the exact same artifact that passed testing, eliminating 'works on my machine'.
GOTCHA Never tag artifacts with `latest` in production CD. If the registry resolves `latest` to a newer version while a deploy is in progress, you deploy untested code. Pin to the commit SHA or a semantic version.
HOW AN ARTIFACT MOVES FROM BUILD TO DEPLOY
01 CI pipeline builds the artifact and tags it with the Git commit SHA (e.g., `myapp:abc1234`).
02 CI pipeline authenticates to the artifact registry and pushes the artifact with its tag.
03 Registry stores the artifact, scans it for vulnerabilities, and makes it available via pull API.
04 CD pipeline pulls the exact artifact by its SHA tag into the target environment, guaranteeing the same bits that passed tests.
POKE IT YOURSELF
docker pull ghcr.io/myorg/myapp:abc1234 — pull an exact artifact by SHA
docker tag myapp:latest myapp:v1.2.3 — tag an image with a semantic version
Drill this topic →
~60 sec read