Container registry: choosing and securing your image registry (Docker Hub, Harbor, GHCR, ECR)

1. The registries #

Public, cloud or self-hosted.

Comparison #

2. Securing #

An image is code running in production.

Practices #

docker build -t registry.example.com/shop/api:1.4.2 .
trivy image --severity HIGH,CRITICAL --exit-code 1 registry.example.com/shop/api:1.4.2
docker push registry.example.com/shop/api:1.4.2
cosign sign registry.example.com/shop/api@sha256:<digest>

• Immutable tags (version or digest), never latest in production.
• Limited-privilege service accounts for CI; read-only for clusters.
• Mirror or cache of public images (Harbor proxy cache) against Docker Hub limits and outages.
• Retention policy to delete unused images.

Good practice: Deploy by digest (@sha256:...): it is the only guarantee that the image in production is exactly the one that was scanned and signed.