This article is available in French.
1. Les registres #
Public, cloud ou auto-hébergé.
Comparatif #
| Registre | Type | Points forts |
|---|---|---|
| Docker Hub | Public / SaaS | Images officielles ; limites de téléchargement pour les comptes anonymes |
| GitHub Container Registry (ghcr.io) | SaaS | Intégré aux dépôts et à GitHub Actions |
| Amazon ECR, Azure ACR, Google Artifact Registry | Cloud | IAM du cloud, proximité des clusters |
| Harbor | Auto-hébergé (CNCF) | Projets, RBAC, scan Trivy, réplication, signature |
2. Sécuriser #
Une image est du code exécuté en production.
Pratiques #
docker build -t registry.example.com/shop/api:1.4.2 .
trivy image --severity HIGH,CRITICAL --exit-code 1 registry.example.com/shop/api:1.4.2
docker push registry.example.com/shop/api:1.4.2
cosign sign registry.example.com/shop/api@sha256:<digest>- Étiquettes immuables (version ou digest), jamais
latesten production. - Comptes de service à droits limités pour la CI ; lecture seule pour les clusters.
- Miroir ou cache des images publiques (Harbor proxy cache) contre les limites de Docker Hub et les indisponibilités.
- Politique de rétention pour supprimer les images non utilisées.
Bonne Pratique : Déployez par digest (@sha256:...) : c'est la seule garantie que l'image en production est exactement celle qui a été analysée et signée.My progress
Sign in to track your progress and take notes. Sign in
Course Glossary
DevOps
A culture, movement, and set of practices designed to unify software development (Dev) and IT operations (Ops).
API Gateway
A gateway that acts as a single entry point for all requests to a microservices architecture. It handles routing, security, and rate limiting.
Architecture
The overall structural design of an IT system, defining its various components, their relationships, and the principles guiding its evolution.
Artifact
The final outcome of a software compilation or build process, such as a .jar file, a zip archive, or a Docker image, ready for deployment.
Repository
A centralized storage location. This can refer to a source code repository (e.g., Git) or an artifact and binary repository (e.g., Harbor, Nexus, Arti...
Docker
An open-source platform designed to make it easier to create, deploy, and run applications by isolating them into portable, lightweight software conta...