Container Registry Setup Expert

Эксперт по настройке и управлению container registries.

Типы Registry

Cloud-Managed

Registry Provider Features

ECR AWS IAM integration, scanning

Artifact Registry GCP Multi-format, regional

ACR Azure AD integration, geo-rep

Docker Hub Docker Public/private, CI/CD

Self-Hosted

Registry Best For Features

Harbor Enterprise RBAC, scanning, replication

Nexus Multi-artifact Maven, npm, Docker

Artifactory Enterprise Universal, HA

Distribution Simple Official Docker registry

AWS ECR Setup

Terraform Configuration

resource "aws_ecr_repository" "app" { name = "my-application" image_tag_mutability = "IMMUTABLE"

image_scanning_configuration { scan_on_push = true }

encryption_configuration { encryption_type = "KMS" kms_key = aws_kms_key.ecr.arn }

tags = { Environment = "production" Team = "platform" } }

resource "aws_ecr_lifecycle_policy" "cleanup" { repository = aws_ecr_repository.app.name

policy = jsonencode({ rules = [ { rulePriority = 1 description = "Keep last 10 images" selection = { tagStatus = "tagged" tagPrefixList = ["v"] countType = "imageCountMoreThan" countNumber = 10 } action = { type = "expire" } }, { rulePriority = 2 description = "Remove untagged after 7 days" selection = { tagStatus = "untagged" countType = "sinceImagePushed" countUnit = "days" countNumber = 7 } action = { type = "expire" } } ] }) }

ECR Authentication

Login to ECR

aws ecr get-login-password --region us-east-1 |
docker login --username AWS --password-stdin
123456789.dkr.ecr.us-east-1.amazonaws.com

Push image

docker tag myapp:latest 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:latest docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:latest

Harbor Self-Hosted

Docker Compose Setup

version: '3' services: harbor-core: image: goharbor/harbor-core:v2.9.0 container_name: harbor-core env_file: - ./common/config/core/env volumes: - ./common/config/core/certificates:/etc/core/certificates - ./common/config/core/key:/etc/core/key depends_on: - registry - redis - postgresql networks: - harbor

registry: image: goharbor/registry-photon:v2.9.0 container_name: registry volumes: - registry_data:/storage - ./common/config/registry:/etc/registry networks: - harbor

postgresql: image: goharbor/harbor-db:v2.9.0 container_name: harbor-db volumes: - database:/var/lib/postgresql/data environment: POSTGRES_PASSWORD: ${DB_PASSWORD} networks: - harbor

redis: image: goharbor/redis-photon:v2.9.0 container_name: harbor-redis volumes: - redis:/var/lib/redis networks: - harbor

nginx: image: goharbor/nginx-photon:v2.9.0 container_name: nginx ports: - "80:8080" - "443:8443" volumes: - ./common/config/nginx:/etc/nginx depends_on: - harbor-core networks: - harbor

volumes: registry_data: database: redis:

networks: harbor: driver: bridge

Image Security

Vulnerability Scanning

Trivy scan

trivy image myapp:latest

Grype scan

grype myapp:latest

ECR scan results

aws ecr describe-image-scan-findings
--repository-name myapp
--image-id imageTag=latest

Image Signing with Cosign

Generate key pair

cosign generate-key-pair

Sign image

cosign sign --key cosign.key myregistry/myapp:latest

Verify signature

cosign verify --key cosign.pub myregistry/myapp:latest

Content Trust (Docker)

Enable content trust

export DOCKER_CONTENT_TRUST=1

Sign and push

docker push myregistry/myapp:latest

Verify on pull

docker pull myregistry/myapp:latest

Kubernetes Integration

Image Pull Secret

apiVersion: v1 kind: Secret metadata: name: registry-credentials namespace: default type: kubernetes.io/dockerconfigjson data: .dockerconfigjson: | eyJhdXRocyI6eyJteXJlZ2lzdHJ5LmNvbSI6eyJ1c2VybmFtZSI6InVzZXIi LCJwYXNzd29yZCI6InBhc3MiLCJhdXRoIjoiZFhObGNqcHdZWE56In19fQ==

Deployment with Pull Secret

apiVersion: apps/v1 kind: Deployment metadata: name: myapp spec: replicas: 3 selector: matchLabels: app: myapp template: metadata: labels: app: myapp spec: containers: - name: myapp image: myregistry.com/myapp:v1.0.0 imagePullPolicy: Always imagePullSecrets: - name: registry-credentials

ServiceAccount Configuration

apiVersion: v1 kind: ServiceAccount metadata: name: myapp-sa namespace: default imagePullSecrets:

name: registry-credentials

CI/CD Integration

GitHub Actions

name: Build and Push

on: push: branches: [main]

jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

  - name: Set up Docker Buildx
    uses: docker/setup-buildx-action@v3

  - name: Login to ECR
    uses: aws-actions/amazon-ecr-login@v2

  - name: Login to Docker Hub
    uses: docker/login-action@v3
    with:
      username: ${{ secrets.DOCKERHUB_USERNAME }}
      password: ${{ secrets.DOCKERHUB_TOKEN }}

  - name: Build and push
    uses: docker/build-push-action@v5
    with:
      context: .
      platforms: linux/amd64,linux/arm64
      push: true
      tags: |
        123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:${{ github.sha }}
        myuser/myapp:${{ github.sha }}
      cache-from: type=gha
      cache-to: type=gha,mode=max

GitLab CI

stages:

build
push

variables: IMAGE_NAME: $CI_REGISTRY_IMAGE

build: stage: build image: docker:24 services: - docker:24-dind before_script: - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY script: - docker build -t $IMAGE_NAME:$CI_COMMIT_SHA . - docker push $IMAGE_NAME:$CI_COMMIT_SHA only: - main

Cleanup Scripts

ECR Cleanup

import boto3 from datetime import datetime, timedelta

def cleanup_untagged_images(repository: str, days_old: int = 7): """Remove untagged images older than specified days.""" ecr = boto3.client('ecr')

response = ecr.describe_images(
    repositoryName=repository,
    filter={'tagStatus': 'UNTAGGED'}
)

cutoff = datetime.now() - timedelta(days=days_old)

images_to_delete = []
for image in response['imageDetails']:
    if image['imagePushedAt'].replace(tzinfo=None) &#x3C; cutoff:
        images_to_delete.append({
            'imageDigest': image['imageDigest']
        })

if images_to_delete:
    ecr.batch_delete_image(
        repositoryName=repository,
        imageIds=images_to_delete
    )
    print(f"Deleted {len(images_to_delete)} images")

Usage

cleanup_untagged_images('my-app', days_old=7)

Performance Optimization

Registry Caching

Docker daemon.json

{ "registry-mirrors": ["https://mirror.gcr.io"], "insecure-registries": [], "max-concurrent-downloads": 10, "max-concurrent-uploads": 5 }

Pull-Through Cache (Harbor)

Harbor project config

replication:

name: docker-hub-proxy type: pull-through source: https://registry-1.docker.io filters:
- name: library/* trigger: type: manual

Troubleshooting

Test connectivity

curl -v https://myregistry.com/v2/

Check authentication

docker login myregistry.com

Verify TLS

openssl s_client -connect myregistry.com:443 -servername myregistry.com

Clear credentials

docker logout myregistry.com rm ~/.docker/config.json

Debug pull issues

docker pull myregistry.com/myapp:latest --debug

Лучшие практики

Image immutability — используйте immutable tags
Vulnerability scanning — scan on push обязателен
Lifecycle policies — автоматическая очистка старых images
Content trust — подписывайте production images
Geo-replication — для global deployments
Access control — минимальные права через RBAC
Monitoring — алерты на failed pushes и pulls

container-registry-setup

Safety Notice

Copy this and send it to your AI assistant to learn