container registries

**Container registries** is the **systems for storing, versioning, distributing, and governing container images** - they act as the source of truth for runtime artifacts consumed by CI/CD and production orchestration. **What Is Container registries?** - **Definition**: Repository services such as Docker Hub, ECR, or GCR for hosting container images and tags. - **Core Functions**: Image push and pull, tag management, access control, and vulnerability scanning integration. - **Traceability**: Digest-based references allow immutable deployment and rollback behavior. - **Governance Layer**: Policies can enforce signed images, retention rules, and promotion workflows. **Why Container registries Matters** - **Deployment Reliability**: Centralized artifact hosting prevents drift between environments. - **Security Control**: Registry scanning and signing reduce risk of compromised image supply chains. - **Release Discipline**: Promotion pipelines rely on controlled image lineage across stages. - **Operational Scale**: Shared registry infrastructure simplifies distribution to large clusters. - **Auditability**: Image metadata and pull history support incident and compliance investigations. **How It Is Used in Practice** - **Tagging Convention**: Use semantic version plus commit hash tags with immutable digest references. - **Promotion Workflow**: Gate image movement from dev to prod through testing and policy checks. - **Lifecycle Management**: Apply retention and cleanup policies to control storage growth. Container registries are **a critical control point in modern software and MLOps delivery** - strong registry governance improves security, reproducibility, and release confidence.