Registry
A central repository for storing and managing software artifacts, most commonly Docker images.
Detailed Explanation
A registry (like Docker Hub, Amazon ECR, or GitHub Packages) serves as the source of truth for your deployments. When a server needs to run an application, it 'pulls' the specific image version from the registry. This centralizes versioning and provides a secure, reliable way to distribute software across a large number of machines.
Quick Summary
A registry is a network-accessible store for build artifacts, container images, packages, helm charts, that production servers pull from at deploy time. It's the bridge between CI and runtime infrastructure.
Key Takeaways
- Images are addressable by name and tag (e.g., `ghcr.io/org/api:v1.2.3`) or by immutable content digest (`@sha256:...`).
- Pin to digests in production manifests so a moved tag can't silently change what runs.
- Private registries (ECR, GHCR, GitLab Container Registry) gate pulls with IAM/tokens; public registries (Docker Hub) are unauthenticated by default.
- Image scanning is usually a registry feature, block pushes with known critical CVEs.
- Registries are network choke points; production clusters should pull from a same-region or in-cluster mirror to avoid pull storms.
When to use it
- Storing container images for Kubernetes/ECS/Cloud Run deployments.
- Sharing internal libraries via private npm or PyPI registries.
- Distributing Helm charts and Terraform modules across teams.
- Hosting Docker images of base OS or framework layers for downstream teams to extend.
Common Mistakes
- Pulling from public registries in production without a pull-through cache, outages and rate limits hit you directly.
- Leaving images public when they contain proprietary code or build secrets.
- Never pruning the registry, so storage bills creep up and CI gets slower scanning more layers.
- Skipping authentication on private network registries because "it's internal", internal still leaks.
Registry, Frequently Asked
Should I run my own registry or use a managed one?
Managed (ECR, GHCR, GAR, ACR) is almost always the right call, they handle storage, replication, scanning, and IAM. Self-hosted Harbor or Distribution makes sense only when air-gapped or for regulatory reasons.
Why pull by digest instead of tag?
Tags are mutable: `myapp:v1.2.3` can be repushed to point at different content. Digests (`@sha256:...`) are content-addressed and cannot change. Use tags for humans, digests for production manifests.
Do all registries follow the same protocol?
Container registries implement the OCI Distribution Spec, so most tools work against any of them. Package registries (npm, PyPI, Maven) each have their own protocol and aren't interchangeable with container registries.