Container Registry Best Practices: ECR, Docker Hub, and Self-Hosted Options

#docker #ecr #containers #devops

Introduction

Container registries are the backbone of containerized application deployment. Choosing the right registry and implementing proper practices can mean the difference between smooth deployments and security nightmares.

Amazon ECR: AWS-Native Registry

# Create a repository
aws ecr create-repository \
    --repository-name my-app \
    --image-scanning-configuration scanOnPush=true

# Push an image
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest

ECR Lifecycle Policies

{
  "rules": [{
    "rulePriority": 1,
    "description": "Keep last 10 production images",
    "selection": {
      "tagStatus": "tagged",
      "tagPrefixList": ["prod-"],
      "countType": "imageCountMoreThan",
      "countNumber": 10
    },
    "action": { "type": "expire" }
  }]
}

Docker Hub

Docker Hub remains the most widely used registry, hosting millions of public images.

Rate Limits: Anonymous pulls limited to 100 per 6 hours; authenticated free users get 200.

Self-Hosted: Harbor

helm install harbor harbor/harbor \
  --set expose.type=ingress \
  --set expose.ingress.hosts.core=registry.example.com \
  --set trivy.enabled=true

Security Best Practices

Enable image scanning
Implement least-privilege access
Sign your images with Cosign
Use immutable tags
Scan base images regularly

Image Tagging Strategies

VERSION="1.2.3"
GIT_SHA=$(git rev-parse --short HEAD)

docker build \
    -t my-app:${VERSION} \
    -t my-app:${VERSION}-${GIT_SHA} \
    -t my-app:${GIT_SHA} \
    .

Conclusion

Whether you choose ECR for AWS integration, Docker Hub for ubiquity, or Harbor for control, applying security best practices will keep your container infrastructure secure.