A container registry stores and distributes Docker images for use by clients and clusters. In GCP, repository operation combines project APIs, a regional Docker repository, and client authentication. Container Analysis stores image metadata, while Container Scanning checks images for vulnerabilities and incurs scanning charges. section 13.5.1
A practical GCP registry workflow includes:
- Select the GCP project, then enable the Container Analysis API and Container Scanning API. section 13.5.1
- Create a Docker repository in a chosen region, such as us-east4, with a description. section 13.5.1
- Configure Docker authentication for the repository’s region using GCP credentials before storing images. section 13.5.1
- Restrict cluster workloads to approved registries through admission policy, and test policy effects before enforcement. section 13.9.1
gcloud artifacts repositories create docker-registry --repository-format=docker --location=us-east4 --description="Docker Registry"
Create a regional Docker repository with the gcloud CLI before configuring client authentication and pushing images. section 13.5.1
Testing registry restrictions
An approved-repository constraint can permit only gcr.io and hub.evermore.local. A workload using docker.io/busybox is rejected by admission, while a privileged-container constraint can run in dry-run mode to reveal violations before enforcement. Exclusions can protect required system namespaces. section 13.9.1
