Back to Details

container-registries

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Container Registries

容器镜像仓库

Store, manage, and distribute container images across cloud and self-hosted registries.
在云原生和自建镜像仓库中存储、管理和分发容器镜像。

When to Use This Skill

适用场景

Use this skill when:
  • Pushing and pulling container images
  • Configuring registry authentication
  • Setting up image retention policies
  • Managing private container registries
  • Implementing image scanning and security
在以下场景中使用本技能：
  • 推送和拉取容器镜像
  • 配置镜像仓库认证
  • 设置镜像保留策略
  • 管理私有容器镜像仓库
  • 实现镜像扫描与安全防护

Prerequisites

前置条件

  • Docker or Podman installed
  • Cloud CLI tools (AWS CLI, az, gcloud) for respective registries
  • Appropriate IAM permissions
  • 已安装 Docker 或 Podman
  • 对应镜像仓库的云 CLI 工具（AWS CLI、az、gcloud）
  • 具备合适的 IAM 权限

Docker Hub

Docker Hub

Authentication

认证

bash
undefined
bash
undefined

Login

Login

docker login
docker login

Login with token

Login with token

echo "$DOCKER_TOKEN" | docker login -u username --password-stdin
undefined
echo "$DOCKER_TOKEN" | docker login -u username --password-stdin
undefined

Push/Pull Images

镜像推送/拉取

bash
undefined
bash
undefined

Tag image

Tag image

docker tag myapp:latest username/myapp:latest
docker tag myapp:latest username/myapp:latest

Push

Push

docker push username/myapp:latest
docker push username/myapp:latest

Pull

Pull

docker pull username/myapp:latest
undefined
docker pull username/myapp:latest
undefined

Automated Builds

自动构建

Configure in Docker Hub UI:
  1. Connect GitHub/Bitbucket repository
  2. Set build rules (branch → tag mapping)
  3. Configure build context and Dockerfile path
在 Docker Hub 界面中配置：
  1. 连接 GitHub/Bitbucket 仓库
  2. 设置构建规则（分支→标签映射）
  3. 配置构建上下文和 Dockerfile 路径

Amazon ECR

Amazon ECR

Setup

配置步骤

bash
undefined
bash
undefined

Create repository

Create repository

aws ecr create-repository
--repository-name myapp
--image-scanning-configuration scanOnPush=true
--encryption-configuration encryptionType=AES256
aws ecr create-repository
--repository-name myapp
--image-scanning-configuration scanOnPush=true
--encryption-configuration encryptionType=AES256

Get registry URI

Get registry URI

REGISTRY=$(aws ecr describe-repositories
--repository-names myapp
--query 'repositories[0].repositoryUri'
--output text | cut -d'/' -f1)
undefined
REGISTRY=$(aws ecr describe-repositories
--repository-names myapp
--query 'repositories[0].repositoryUri'
--output text | cut -d'/' -f1)
undefined

Authentication

认证

bash
undefined
bash
undefined

Login (Docker)

Login (Docker)

aws ecr get-login-password --region us-east-1 |
docker login --username AWS --password-stdin $REGISTRY
aws ecr get-login-password --region us-east-1 |
docker login --username AWS --password-stdin $REGISTRY

Login with credential helper

Login with credential helper

Add to ~/.docker/config.json:

Add to ~/.docker/config.json:

{ "credHelpers": { "123456789.dkr.ecr.us-east-1.amazonaws.com": "ecr-login" } }
undefined
{ "credHelpers": { "123456789.dkr.ecr.us-east-1.amazonaws.com": "ecr-login" } }
undefined

Push/Pull

镜像推送/拉取

bash
undefined
bash
undefined

Tag and push

Tag and push

docker tag myapp:latest $REGISTRY/myapp:latest docker push $REGISTRY/myapp:latest
docker tag myapp:latest $REGISTRY/myapp:latest docker push $REGISTRY/myapp:latest

Pull

Pull

docker pull $REGISTRY/myapp:latest
undefined
docker pull $REGISTRY/myapp:latest
undefined

Lifecycle Policy

生命周期策略

bash
undefined
bash
undefined

Create lifecycle policy

Create lifecycle policy

aws ecr put-lifecycle-policy
--repository-name myapp
--lifecycle-policy-text '{ "rules": [ { "rulePriority": 1, "description": "Keep last 10 images", "selection": { "tagStatus": "any", "countType": "imageCountMoreThan", "countNumber": 10 }, "action": { "type": "expire" } } ] }'
undefined
aws ecr put-lifecycle-policy
--repository-name myapp
--lifecycle-policy-text '{ "rules": [ { "rulePriority": 1, "description": "Keep last 10 images", "selection": { "tagStatus": "any", "countType": "imageCountMoreThan", "countNumber": 10 }, "action": { "type": "expire" } } ] }'
undefined

Repository Policy

仓库策略

bash
undefined
bash
undefined

Allow cross-account access

Allow cross-account access

aws ecr set-repository-policy
--repository-name myapp
--policy-text '{ "Version": "2012-10-17", "Statement": [ { "Sid": "CrossAccountPull", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::OTHER_ACCOUNT:root" }, "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ] } ] }'
undefined
aws ecr set-repository-policy
--repository-name myapp
--policy-text '{ "Version": "2012-10-17", "Statement": [ { "Sid": "CrossAccountPull", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::OTHER_ACCOUNT:root" }, "Action": [ "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ] } ] }'
undefined

Azure Container Registry (ACR)

Azure Container Registry (ACR)

Setup

配置步骤

bash
undefined
bash
undefined

Create registry

Create registry

az acr create
--resource-group mygroup
--name myregistry
--sku Standard
--admin-enabled false
az acr create
--resource-group mygroup
--name myregistry
--sku Standard
--admin-enabled false

Get login server

Get login server

az acr show --name myregistry --query loginServer -o tsv
undefined
az acr show --name myregistry --query loginServer -o tsv
undefined

Authentication

认证

bash
undefined
bash
undefined

Login with Azure CLI

Login with Azure CLI

az acr login --name myregistry
az acr login --name myregistry

Login with service principal

Login with service principal

docker login myregistry.azurecr.io
-u $SP_APP_ID
-p $SP_PASSWORD
docker login myregistry.azurecr.io
-u $SP_APP_ID
-p $SP_PASSWORD

Get access token

Get access token

az acr login --name myregistry --expose-token
undefined
az acr login --name myregistry --expose-token
undefined

Push/Pull

镜像推送/拉取

bash
undefined
bash
undefined

Tag and push

Tag and push

docker tag myapp:latest myregistry.azurecr.io/myapp:latest docker push myregistry.azurecr.io/myapp:latest
docker tag myapp:latest myregistry.azurecr.io/myapp:latest docker push myregistry.azurecr.io/myapp:latest

ACR Build (build in cloud)

ACR Build (build in cloud)

az acr build
--registry myregistry
--image myapp:latest
--file Dockerfile .
undefined
az acr build
--registry myregistry
--image myapp:latest
--file Dockerfile .
undefined

Retention Policy

保留策略

bash
undefined
bash
undefined

Enable retention policy

Enable retention policy

az acr config retention update
--registry myregistry
--status enabled
--days 30
--type UntaggedManifests
undefined
az acr config retention update
--registry myregistry
--status enabled
--days 30
--type UntaggedManifests
undefined

Geo-Replication

地理复制

bash
undefined
bash
undefined

Enable replication

Enable replication

az acr replication create
--registry myregistry
--location westeurope
az acr replication create
--registry myregistry
--location westeurope

List replications

List replications

az acr replication list --registry myregistry
undefined
az acr replication list --registry myregistry
undefined

Google Container Registry (GCR) / Artifact Registry

Google Container Registry (GCR) / Artifact Registry

Setup (Artifact Registry)

配置步骤（Artifact Registry）

bash
undefined
bash
undefined

Create repository

Create repository

gcloud artifacts repositories create myrepo
--repository-format=docker
--location=us-central1
--description="Docker repository"
undefined
gcloud artifacts repositories create myrepo
--repository-format=docker
--location=us-central1
--description="Docker repository"
undefined

Authentication

认证

bash
undefined
bash
undefined

Configure Docker auth

Configure Docker auth

gcloud auth configure-docker us-central1-docker.pkg.dev
gcloud auth configure-docker us-central1-docker.pkg.dev

Or use credential helper

Or use credential helper

gcloud auth print-access-token |
docker login -u oauth2accesstoken --password-stdin
https://us-central1-docker.pkg.dev
undefined
gcloud auth print-access-token |
docker login -u oauth2accesstoken --password-stdin
https://us-central1-docker.pkg.dev
undefined

Push/Pull

镜像推送/拉取

bash
undefined
bash
undefined

Tag for Artifact Registry

Tag for Artifact Registry

docker tag myapp:latest
us-central1-docker.pkg.dev/PROJECT_ID/myrepo/myapp:latest
docker tag myapp:latest
us-central1-docker.pkg.dev/PROJECT_ID/myrepo/myapp:latest

Push

Push

docker push us-central1-docker.pkg.dev/PROJECT_ID/myrepo/myapp:latest
docker push us-central1-docker.pkg.dev/PROJECT_ID/myrepo/myapp:latest

Pull

Pull

docker pull us-central1-docker.pkg.dev/PROJECT_ID/myrepo/myapp:latest
undefined
docker pull us-central1-docker.pkg.dev/PROJECT_ID/myrepo/myapp:latest
undefined

Cleanup Policy

清理策略

bash
undefined
bash
undefined

Create cleanup policy

Create cleanup policy

gcloud artifacts repositories set-cleanup-policies myrepo
--location=us-central1
--policy=policy.json
gcloud artifacts repositories set-cleanup-policies myrepo
--location=us-central1
--policy=policy.json

policy.json

policy.json

{ "name": "delete-old", "action": {"type": "Delete"}, "condition": { "olderThan": "30d", "tagState": "untagged" } }
undefined
{ "name": "delete-old", "action": {"type": "Delete"}, "condition": { "olderThan": "30d", "tagState": "untagged" } }
undefined

GitHub Container Registry (GHCR)

GitHub Container Registry (GHCR)

Authentication

认证

bash
undefined
bash
undefined

Login with PAT

Login with PAT

echo "$GITHUB_TOKEN" | docker login ghcr.io -u USERNAME --password-stdin
undefined
echo "$GITHUB_TOKEN" | docker login ghcr.io -u USERNAME --password-stdin
undefined

Push/Pull

镜像推送/拉取

bash
undefined
bash
undefined

Tag

Tag

docker tag myapp:latest ghcr.io/OWNER/myapp:latest
docker tag myapp:latest ghcr.io/OWNER/myapp:latest

Push

Push

docker push ghcr.io/OWNER/myapp:latest
docker push ghcr.io/OWNER/myapp:latest

Pull

Pull

docker pull ghcr.io/OWNER/myapp:latest
undefined
docker pull ghcr.io/OWNER/myapp:latest
undefined

Visibility Settings

可见性设置

Configure in GitHub:
  1. Go to package settings
  2. Change visibility (public/private)
  3. Manage access for teams/users
在 GitHub 中配置：
  1. 进入包设置页面
  2. 修改可见性（公开/私有）
  3. 管理团队/用户的访问权限

Self-Hosted Registry

自建镜像仓库

Deploy with Docker

使用 Docker 部署

bash
undefined
bash
undefined

Run registry

Run registry

docker run -d -p 5000:5000
--name registry
-v registry-data:/var/lib/registry
registry:2
docker run -d -p 5000:5000
--name registry
-v registry-data:/var/lib/registry
registry:2

Configure TLS

Configure TLS

docker run -d -p 443:5000
--name registry
-v /certs:/certs
-v registry-data:/var/lib/registry
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key
registry:2
undefined
docker run -d -p 443:5000
--name registry
-v /certs:/certs
-v registry-data:/var/lib/registry
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key
registry:2
undefined

Harbor Registry

Harbor Registry

bash
undefined
bash
undefined

Download Harbor

Download Harbor

wget https://github.com/goharbor/harbor/releases/download/v2.9.0/harbor-online-installer-v2.9.0.tgz tar xzvf harbor-online-installer-v2.9.0.tgz
wget https://github.com/goharbor/harbor/releases/download/v2.9.0/harbor-online-installer-v2.9.0.tgz tar xzvf harbor-online-installer-v2.9.0.tgz

Configure harbor.yml

Configure harbor.yml

Set hostname, https certificate, admin password

Set hostname, https certificate, admin password

Install

Install

./install.sh --with-trivy --with-chartmuseum
undefined
./install.sh --with-trivy --with-chartmuseum
undefined

Image Security

镜像安全

Vulnerability Scanning

漏洞扫描

bash
undefined
bash
undefined

ECR - Enable scan on push

ECR - Enable scan on push

aws ecr put-image-scanning-configuration
--repository-name myapp
--image-scanning-configuration scanOnPush=true
aws ecr put-image-scanning-configuration
--repository-name myapp
--image-scanning-configuration scanOnPush=true

Get scan results

Get scan results

aws ecr describe-image-scan-findings
--repository-name myapp
--image-id imageTag=latest
aws ecr describe-image-scan-findings
--repository-name myapp
--image-id imageTag=latest

ACR - Scan with Defender

ACR - Scan with Defender

az acr task create
--registry myregistry
--name scan-images
--cmd "mcr.microsoft.com/azure-cli az acr run-scan"
undefined
az acr task create
--registry myregistry
--name scan-images
--cmd "mcr.microsoft.com/azure-cli az acr run-scan"
undefined

Image Signing

镜像签名

bash
undefined
bash
undefined

Enable content trust

Enable content trust

export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST=1

Sign image on push

Sign image on push

docker push myregistry/myapp:latest
docker push myregistry/myapp:latest

Verify signature

Verify signature

docker trust inspect myregistry/myapp:latest
undefined
docker trust inspect myregistry/myapp:latest
undefined

Common Issues

常见问题

Issue: Authentication Expired

问题：认证过期

Problem: Push/pull fails with auth error Solution: Re-run login command, check credential helper
问题：推送/拉取镜像时出现认证错误 解决方案：重新执行登录命令，检查凭证助手配置

Issue: Image Not Found

问题：镜像未找到

Problem: Pull fails with manifest unknown Solution: Verify tag exists, check registry URL
问题：拉取镜像时出现 manifest unknown 错误 解决方案：验证标签是否存在，检查镜像仓库 URL

Issue: Push Permission Denied

问题：推送权限被拒绝

Problem: Cannot push to repository Solution: Check IAM permissions, verify repository exists
问题：无法推送镜像至仓库 解决方案：检查 IAM 权限，确认仓库是否存在

Issue: Rate Limiting (Docker Hub)

问题：请求频率限制（Docker Hub）

Problem: Too many requests error Solution: Authenticate for higher limits, use pull-through cache
问题：出现请求过多错误 解决方案：登录账号以获取更高限制，使用拉取缓存

Best Practices

最佳实践

  • Enable vulnerability scanning on all repositories
  • Implement lifecycle policies to manage storage costs
  • Use immutable tags for production images
  • Configure cross-region replication for availability
  • Use service accounts/principals for CI/CD authentication
  • Enable audit logging for compliance
  • Implement image signing for supply chain security
  • Use pull-through cache to avoid rate limits
  • 为所有仓库启用漏洞扫描
  • 实施生命周期策略以控制存储成本
  • 为生产环境镜像使用不可变标签
  • 配置跨区域复制以提升可用性
  • 为 CI/CD 认证使用服务账号/主体
  • 启用审计日志以满足合规要求
  • 实施镜像签名以保障供应链安全
  • 使用拉取缓存避免请求频率限制

Related Skills

相关技能

  • docker-management - Building images
  • container-scanning - Security scanning
  • aws-iam - AWS permissions
  • docker-management - 镜像构建
  • container-scanning - 安全扫描
  • aws-iam - AWS 权限