Configure and Secure Container Registries

This skill provides expertise in setting up, configuring, and managing container registries, with deep knowledge of public and private registries, security best practices, authentication mechanisms, and integration patterns with CI/CD pipelines and orchestration platforms. Registry type and selection criteria cover cloud-managed registries - AWS ECR (best for AWS-native environments with automatic vulnerability scanning), Google Artifact Registry (GCR's successor, supporting Docker/Maven/npm formats), Azure Container Registry (geo-replication, Azure DevOps integration), and Docker Hub (public images, with rate-limiting considerations for production) - and self-hosted solutions - Harbor (enterprise features, vulnerability scanning, policy enforcement), Sonatype Nexus (multi-format repository manager), JFrog Artifactory (universal artifact management), and Docker Registry (lightweight, basic functionality).

Registry security best practices cover authentication and access control (AWS ECR login via the CLI, and creating an encrypted repository with scan-on-push enabled) and image signing/verification (Docker Content Trust for key-based signing, and Cosign for keyless signing via an OIDC issuer). Self-hosted Harbor registry setup includes a Docker Compose configuration for the registry and core services (with capability dropping for security hardening) and a harbor.yml configuration covering hostname, TLS certificates, admin password, database connection pooling, Trivy vulnerability-scan settings, and log rotation.

Kubernetes integration covers creating an image-pull secret for a private registry and attaching it to a service account, then referencing that service account in a deployment with an explicit imagePullPolicy: Always and resource limits. CI/CD pipeline integration covers a GitLab CI job that logs into the registry, builds, tags, and pushes the image on the main branch, and a GitHub Actions workflow pushing to multiple registries.

Use this skill when setting up or hardening a container registry - choosing between cloud-managed and self-hosted options, configuring image signing, or wiring registry authentication into Kubernetes and CI/CD. It is well suited to teams standing up new container infrastructure or migrating registries. It is not meant for non-containerized artifact storage, or for teams already satisfied with an existing, properly configured registry setup.

Input: the team's cloud provider, security requirements (signing, scanning), and CI/CD platform.

Output: a selected registry configuration, image-signing setup, Kubernetes pull-secret wiring, and CI/CD push integration. Example ECR repository creation with scan-on-push:

aws ecr create-repository \
  --repository-name my-app \
  --encryption-configuration encryptionType=AES256 \
  --image-scanning-configuration scanOnPush=true

Works with AWS ECR, Google Artifact Registry, Azure Container Registry, Docker Hub, and self-hosted Harbor/Nexus/Artifactory, plus Kubernetes image-pull secrets and GitLab CI/GitHub Actions for pipeline integration.

Platform and DevOps engineers setting up or hardening container registry infrastructure, and teams that need image signing and CI/CD-integrated registry authentication configured correctly.