TOPIC CONTAINERS
Container Registry where container images are stored, versioned, and scanned
IN 10 SECONDS
A container registry stores and serves Docker images. Docker Hub, ECR, GCR, GHCR, and self-hosted registries like Harbor. Images are tagged by version or commit SHA, and registries typically offer vulnerability scanning, access control, and retention policies. Your CI pushes images here; your CD pulls them for deployment.
GOTCHA Mutable tags like `latest` make deployments non-reproducible. Always pin to the digest (`image@sha256:...`) or an immutable tag (commit SHA). Enable immutable tag mode in your registry to prevent overwrites.
HOW A REGISTRY SERVES AN IMAGE
01 CI pipeline builds an image and pushes it with `docker push ghcr.io/myorg/myapp:v1.2.3`.
02 Registry stores each layer as a content-addressed blob. The manifest maps layer digests to the tag.
03 Scanner compares layer contents against CVE databases (Trivy, Grype, Snyk) and generates a report.
04 CD pipeline pulls the exact image digest (`myapp@sha256:abc...`) for deployment — not the mutable tag.
POKE IT YOURSELF
docker pull ghcr.io/myorg/myapp@sha256:abc123... — pull an image by digest
trivy image ghcr.io/myorg/myapp:v1.2.3 — scan an image for vulnerabilities
Drill this topic →
~70 sec read