Container Registry Best Practices: ECR, Docker Hub, and Self-Hosted Options

Introduction

Container registries are the backbone of containerized application deployment. Choosing the right registry and implementing proper practices can mean the difference between smooth deployments and security nightmares.

Amazon ECR: AWS-Native Registry

# Create a repository
aws ecr create-repository \
    --repository-name my-app \
    --image-scanning-configuration scanOnPush=true

# Push an image
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest

ECR Lifecycle Policies

{
  "rules": [{
    "rulePriority": 1,
    "description": "Keep last 10 production images",
    "selection": {
      "tagStatus": "tagged",
      "tagPrefixList": ["prod-"],
      "countType": "imageCountMoreThan",
      "countNumber": 10
    },
    "action": { "type": "expire" }
  }]
}

Docker Hub

Docker Hub remains the most widely used registry, hosting millions of public images.

Rate Limits: Anonymous pulls limited to 100 per 6 hours; authenticated free users get 200.

Self-Hosted: Harbor

helm install harbor harbor/harbor \
  --set expose.type=ingress \
  --set expose.ingress.hosts.core=registry.example.com \
  --set trivy.enabled=true

Security Best Practices

1. Enable image scanning
2. Implement least-privilege access
3. Sign your images with Cosign
4. Use immutable tags
5. Scan base images regularly

Image Tagging Strategies

VERSION="1.2.3"
GIT_SHA=$(git rev-parse --short HEAD)

docker build \
    -t my-app:${VERSION} \
    -t my-app:${VERSION}-${GIT_SHA} \
    -t my-app:${GIT_SHA} \
    .

Conclusion

Whether you choose ECR for AWS integration, Docker Hub for ubiquity, or Harbor for control, applying security best practices will keep your container infrastructure secure.

---

Need Help with Your DevOps Infrastructure?

At InstaDevOps, we specialize in helping startups build production-ready infrastructure.

📅 Book a Free 15-Min Consultation

Originally published at instadevops.com