Container Registry
debt(d5/e3/b5/t5)
Closest to 'specialist tool catches' (d5). Misuse patterns like :latest tags, missing vulnerability scanning, or public registry exposure require specialized tools (Trivy, Grype, ECR/GHCR scanning features) to detect. These aren't caught by compilers or default linters but are flagged by container security scanners listed in detection_hints.tools.
Closest to 'simple parameterised fix' (e3). The quick_fix indicates switching registries and adding proper tagging is a parameterized fix - update CI/CD config to push to ECR/GHCR with commit-sha tags, add Trivy scan step. Touches deployment configs and CI pipelines but remains a straightforward pattern replacement, not architectural rework.
Closest to 'persistent productivity tax' (b5). Registry choice affects all container workflows: CI/CD pipelines, deployment scripts, developer local pulls, and image lifecycle management. Applies to web and cli contexts per applies_to. A poor registry choice (rate-limited Docker Hub) breaks parallel CI builds repeatedly, taxing multiple work streams, but doesn't define system architecture.
Closest to 'notable trap' (t5). The misconception explicitly states developers assume Docker Hub is the only option, missing that cloud provider registries offer IAM integration, vulnerability scanning, and no rate limits. The :latest tag trap (non-deterministic, breaks rollbacks) is a documented gotcha most devs eventually learn, but causes real pain in production rollback scenarios first.
Also Known As
TL;DR
Explanation
Container registries store Docker images as layers, identified by tags (myapp:1.2.3 or myapp:abc123). Public registries: Docker Hub (default, rate-limited pulls), GitHub Container Registry (ghcr.io, free with GitHub). Private registries: Amazon ECR, Google Artifact Registry, Azure Container Registry — provide IAM-based access control, vulnerability scanning, and geographic replication. Best practices: never use :latest in production, tag with immutable identifiers (git SHA), scan images for CVEs before pushing, and rotate registry credentials.
Common Misconception
Why It Matters
Common Mistakes
- Using :latest tag — non-deterministic, makes rollbacks impossible.
- Public registry for private application images — code and configuration visible to anyone.
- No image vulnerability scanning — CVEs in base images go undetected.
- No registry cleanup — old images accumulate storage costs; add lifecycle policies.
Code Examples
# Non-deterministic latest tag:
docker build -t myapp:latest .
docker push myapp:latest
# CI deploys latest — but what version is latest?
# Rollback: push the previous latest back — which was?
# Impossible to reproduce builds from 6 months ago# Immutable SHA tag + semantic version:
GIT_SHA=$(git rev-parse --short HEAD)
docker build -t 123456789.dkr.ecr.eu-west-1.amazonaws.com/myapp:$GIT_SHA .
docker push 123456789.dkr.ecr.eu-west-1.amazonaws.com/myapp:$GIT_SHA
# Also tag with version:
docker tag myapp:$GIT_SHA myapp:v1.2.3
# ECR lifecycle policy: keep last 10 tagged images
# Scan on push: enabled
# IAM: only CI role can push
https://docs.aws.amazon.com/AmazonECR/latest/userguide/what-is-ecr.html