1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

                         Container Registry Architecture
┌────────────────────────────────────────────────────────────────────────┐
│                              REGISTRY                                   │
│  ┌────────────────────────────────────────────────────────────────┐   │
│  │                         API Layer                               │   │
│  │   /v2/                    (OCI Distribution Specification)      │   │
│  │   /v2/<name>/manifests/<reference>  - Get/Put image manifests  │   │
│  │   /v2/<name>/blobs/<digest>         - Get/Put layer blobs      │   │
│  │   /v2/<name>/tags/list              - List image tags          │   │
│  └─────────────────────────┬──────────────────────────────────────┘   │
│                            │                                           │
│  ┌─────────────────────────▼──────────────────────────────────────┐   │
│  │              Authentication / Authorization                     │   │
│  │   Token Service ∙ OAuth ∙ LDAP/AD ∙ RBAC ∙ Repository Policies │   │
│  └─────────────────────────┬──────────────────────────────────────┘   │
│                            │                                           │
│  ┌─────────────────────────▼──────────────────────────────────────┐   │
│  │                     Storage Backend                             │   │
│  │   ┌─────────────┐  ┌─────────────┐  ┌─────────────┐           │   │
│  │   │  Manifests  │  │   Blobs     │  │  Tag Index  │           │   │
│  │   │  (JSON)     │  │  (Layers)   │  │  (Mapping)  │           │   │
│  │   └─────────────┘  └─────────────┘  └─────────────┘           │   │
│  │                                                                 │   │
│  │   Backends: Local FS │ AWS S3 │ Google GCS │ Azure Blob        │   │
│  └────────────────────────────────────────────────────────────────┘   │
└────────────────────────────────────────────────────────────────────────┘
              ▲                                               ▲
     docker push                                      docker pull
              │                                               │
    ┌─────────┴─────────┐                         ┌──────────┴──────────┐
    │   Developer/CI    │                         │ Kubernetes / Docker │
    └───────────────────┘                         └─────────────────────┘

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

Docker Login Flow:
==================
 
1. docker login myregistry.com
   └─→ docker: "Give me credentials for myregistry.com"
       └─→ User: enters username/password
 
2. docker pull myregistry.com/myapp:1.0
   └─→ docker → registry: GET /v2/ (anonymous)
       └─→ registry: 401 Unauthorized
            WWW-Authenticate: Bearer realm="auth.myregistry.com/token"
   
   └─→ docker → auth server: GET /token?service=myregistry&scope=repository:myapp:pull
       (with Basic Auth: base64(username:password))
       └─→ auth server: 200 OK { "token": "eyJhbG..." }
   
   └─→ docker → registry: GET /v2/myapp/manifests/1.0
       Authorization: Bearer eyJhbG...
       └─→ registry: 200 OK (manifest content)
   
   └─→ docker → registry: GET /v2/myapp/blobs/sha256:abc...
       Authorization: Bearer eyJhbG...
       └─→ registry: 200 OK (layer content)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

# Create a secret with registry credentials
kubectl create secret docker-registry regcred \
  --docker-server=myregistry.com \
  --docker-username=myuser \
  --docker-password=mypassword \
  --docker-email=user@example.com
 
---
# Reference the secret in Pod spec
apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  containers:
    - name: app
      image: myregistry.com/myapp:1.0
  imagePullSecrets:
    - name: regcred
 
---
# For cluster-wide access, patch the default ServiceAccount
kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "regcred"}]}'

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Keep only the last 10 production images",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["prod-"],
        "countType": "imageCountMoreThan",
        "countNumber": 10
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "Delete untagged images older than 1 day",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 1
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 3,
      "description": "Delete dev images older than 14 days",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["dev-", "feature-"],
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 14
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}

1
2
3
4
5
6
7
8
9
10
11
12

# Docker Distribution registry garbage collection
# First, identify unreferenced blobs (dry run)
registry garbage-collect --dry-run /etc/docker/registry/config.yml
 
# Then actually clean them up
registry garbage-collect --delete-untagged /etc/docker/registry/config.yml
 
# Harbor garbage collection (via API or UI)
# Schedule via System Administration > Configuration > Garbage Collection
 
# For ECR, lifecycle policies handle this automatically
# For GCR/Artifact Registry, enable automatic cleanup policies

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

# Create Premium tier ACR with geo-replication
az acr create \
  --name mycompanyregistry \
  --resource-group mygroup \
  --sku Premium \
  --location eastus
 
# Add replica regions
az acr replication create \
  --registry mycompanyregistry \
  --location westeurope
 
az acr replication create \
  --registry mycompanyregistry \
  --location southeastasia
 
# List replications
az acr replication list --registry mycompanyregistry
 
# Clients in each region pull from geographically closest replica
# Push to any region, and replication handles distribution

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# Harbor replication rule (via API or UI)
# Automatically push new images to remote registries
 
replication_policy:
  name: "prod-to-dr"
  src_registry:
    type: harbor
    url: https://harbor.primary.example.com
  dest_registry:
    type: harbor  # or docker-hub, aws-ecr, google-gcr, azure-acr
    url: https://harbor.dr.example.com
    credential:
      type: basic
      access_key: "replication-user"
      access_secret: "***"
  trigger:
    type: push  # Replicate on push (vs scheduled)
  filters:
    - type: name
      value: "production/**"  # Only replicate production repos
    - type: tag
      value: "v*"  # Only replicate version tags
  deletion: true  # Replicate deletions
  override: true  # Overwrite existing at destination

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

# Generate key pair (or use keyless with OIDC)
cosign generate-key-pair
 
# In CI/CD pipeline after build and security scan pass:
# Sign the image
cosign sign --key cosign.key myregistry.com/myapp:1.0
 
# Optionally sign with keyless (uses OIDC identity)
cosign sign myregistry.com/myapp:1.0  # Uses ambient OIDC token
 
# Before deployment, verify the signature
cosign verify --key cosign.pub myregistry.com/myapp:1.0
 
# Kubernetes policy enforcement (using Kyverno)
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: enforce
  rules:
    - name: verify-signature
      match:
        resources:
          kinds:
            - Pod
      verifyImages:
        - imageReferences:
            - "myregistry.com/*"
          attestors:
            - entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      MFkwEwYHKoZIzj0C...
                      -----END PUBLIC KEY-----

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

# GitHub Actions example with multiple registries
name: Build and Deploy
 
on:
  push:
    branches: [main]
 
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # Login to multiple registries
      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v2
        
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      
      # Build once
      - name: Build and tag
        run: |
          docker build -t myapp:${{ github.sha }} .
          
          # Tag for development (GHCR)
          docker tag myapp:${{ github.sha }} ghcr.io/${{ github.repository }}/myapp:${{ github.sha }}
          docker tag myapp:${{ github.sha }} ghcr.io/${{ github.repository }}/myapp:latest
          
          # Tag for production (ECR)
          docker tag myapp:${{ github.sha }} ${{ env.ECR_REGISTRY }}/myapp:${{ github.sha }}
          
      # Push to development registry (always)
      - name: Push to GHCR
        run: |
          docker push ghcr.io/${{ github.repository }}/myapp --all-tags
          
      # Push to production registry (only on release)
      - name: Push to ECR
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          docker push ${{ env.ECR_REGISTRY }}/myapp:${{ github.sha }}