Home / Knowledge hub / Container registry
Knowledge hub
Container registry
The store that holds your images, which needs its own access control.
What it means
A container registry is a service that stores container images and hands them out on request. Docker Hub, GitHub's registry and the registries run by the big cloud providers are all examples. Your build pushes an image in, and your servers pull it out when they start.
Think of it as the warehouse behind your deployments. Whatever sits on the shelf is what production will run next time something restarts. Who can put things on the shelf matters at least as much as who can take them off. That is why it deserves the same care as the servers themselves, and why private registries exist.
Why it matters
Anyone who can push to your registry can change what runs in production, without touching your code or your pipeline. Anyone who can pull from it may be able to read the secrets, internal addresses and source that were baked into the image layers. Both directions of access carry risk, and a single leaked token often grants both.
A public registry setting by mistake exposes your whole product. A private one with shared, never-rotated credentials is almost as bad. Customers asking how you protect your build output are really asking about this place. A registry is also easy to forget, because it sits outside the application and rarely appears in testing.
How it shows up
You meet registries in deployment files, build pipelines and the access tokens those pipelines hold. Check that pull and push rights are separate, that pipelines use narrow tokens, and that old images and old credentials get removed. Confirm nothing sensitive was copied into a layer, since deleting it in a later layer does not remove it.
Tags such as latest can be moved to point at a different image. A digest, the sha256 hash of the image, cannot. Deploying by digest means you run exactly what you tested. Scanning in the registry and signing images add further checks.
Questions people ask
Container registry, answered
Is a private registry the same as a secure registry?
No. Private only means the images are not open to the public. It says nothing about who inside the company can push, or how long credentials live.
Security comes from narrow, separate permissions and from knowing what is stored.
What is the difference between an image tag and a digest?
A tag is a movable label, so the same tag can point at different images over time. A digest is a hash of the image content and always points at the same bytes.
Deploying by digest makes a release repeatable.
Can secrets in a deleted image layer still be found?
Yes, if the layer was ever pushed. A later layer that deletes a file hides it from the running container but the earlier layer still contains it.
Keep secrets out of builds altogether and rotate any that were exposed.
Should our build pipeline have push rights to everything?
No. Give each pipeline a token limited to the repositories it builds, and keep pull-only tokens for servers.
This limits the damage if one pipeline credential leaks. A leaked tester token should never be able to publish production images.
Do we need to scan images in the registry?
It is a useful check, because new flaws are published about old images. A registry scan can flag an image that was clean when built.
It finds known component flaws, not weaknesses in your own application logic.
Sources
Where this comes from
Related
Terms that sit next to this one
Image signing
Signing container images so a cluster only runs ones your pipeline produced.
Container image scanning
Checking a built image for known-vulnerable packages before it ships.
Base image
The starting image your container builds on, and the old packages it can bring.
Private registry
An internal package store that keeps your private code off public indexes.
Docker
A tool for packaging an app and its dependencies into a portable container.
What is on your shelf?
Cyberlop tests the application that comes out of your pipeline, in black-box, grey-box or white-box mode. In white-box mode it reads your code as well, so a finding can point to the file and line. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.