Cloud Container Registry — ECR, ACR & GCR Guide

In this tutorial, you'll learn about Cloud Container Registry. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Cloud container registries store, manage, and distribute Docker container images with built-in security scanning, geo-Replication, and integration with Orchestration services like ECS, AKS, and GKE.

What You'll Learn

You'll learn how to push images to ECR, ACR, and Artifact Registry, configure vulnerability scanning and Replication, and integrate registries with CI/CD pipelines for automated deployments.

Why It Matters

Public registries like Docker Hub impose pull rate limits and lack enterprise security features. Cloud registries provide private storage, automated scanning for CVEs, and fast pulls from the same region as your compute. DodaZIP uses ECR to store and scan all container images before deployment.

Real-World Use

A fintech company runs 500 containers across 3 regions. Each region pulls images from a local replica of the registry, reducing cold-start latency by 80% and eliminating Docker Hub rate limits entirely.

Registry Architecture

flowchart LR
  A["CI/CD Pipeline"] --> B[Build Image]
  B --> C[Push to Registry]
  C --> D["AWS ECR / ACR / GCR"]
  D --> E[Vulnerability Scan]
  E --> F{Pass?}
  F -->|Yes| G[Deploy to Cluster]
  F -->|No| H[Notify Team]
  G --> I["ECS / AKS / GKE"]
  style D fill:#48f,color:#fff
  style F fill:#f90,color:#fff

AWS ECR

ECR integrates natively with ECS and EKS, supporting IAM-based access control.

# Create a repository
aws ecr create-repository \
  --repository-name myapp \
  --image-scanning-configuration scanOnPush=true \
  --region us-east-1

# Authenticate and push
aws ecr get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin \
  123456789012.dkr.ecr.us-east-1.amazonaws.com

docker build -t myapp:latest .
docker tag myapp:latest 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:latest
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:latest

Azure ACR

ACR supports OCI artifacts, Helm charts, and geo-Replication across regions.

# Create a container registry
az acr create \
  --name dodatechregistry \
  --resource-group my-rg \
  --sku Premium \
  --location eastus \
  --admin-enabled true

# Enable geo-replication
az acr replication create \
  --registry dodatechregistry \
  --location westeurope

# Login and push
az acr login --name dodatechregistry

docker build -t myapp:latest .
docker tag myapp:latest dodatechregistry.azurecr.io/myapp:latest
docker push dodatechregistry.azurecr.io/myapp:latest

# List repositories
az acr Repository list --name dodatechregistry

GCP Artifact Registry

Artifact Registry replaces Container Registry with multi-format support.

# Create a Docker repository
gcloud artifacts repositories create my-repo \
  --repository-format docker \
  --location us-central1 \
  --description "Docker images for production"

# Configure Docker auth
gcloud auth configure-docker us-central1-docker.pkg.dev

# Build and push
docker build -t myapp:latest .
docker tag myapp:latest \
  us-central1-docker.pkg.dev/my-project/my-repo/myapp:latest
docker push us-central1-docker.pkg.dev/my-project/my-repo/myapp:latest

Vulnerability Scanning

import boto3
import json

ecr = boto3.client("ecr")

def scan_and_report(repository_name, image_tag):
    response = ecr.start_image_scan(
        repositoryName=repository_name,
        imageId={"imageTag": image_tag}
    )

    waiter = ecr.get_waiter("image_scan_complete")
    waiter.wait(
        repositoryName=repository_name,
        imageId={"imageTag": image_tag}
    )

    findings = ecr.describe_image_scan_findings(
        repositoryName=repository_name,
        imageId={"imageTag": image_tag}
    )

    for finding in findings["imageScanFindings"]["findings"]:
        print(f"[{finding['severity']}] {finding['name']}")

Expected output:

[HIGH] CVE-2024-1234 — openssl vulnerability
[MEDIUM] CVE-2024-5678 — libcurl out-of-bounds read

Image Cleanup with Lifecycle Policies

# ECR lifecycle policy to delete old images
aws ecr put-lifecycle-policy \
  --repository-name myapp \
  --lifecycle-policy-text \
    '{"rules":[{"rulePriority":1,"description":"Keep last 10 images","selection":{"tagStatus":"any","countType":"imageCountMoreThan","countNumber":10},"action":{"type":"expire"}}]}'

Common Errors

1. Pushing without authenticating first — Always run get-login-password or az acr login before pushing. Auth tokens expire every 12 hours in CI.
2. Storing secrets in images — Build args and environment variables baked into images can be extracted. Use secrets injection at runtime.
3. Not scanning images before deployment — A vulnerable base image exposes production. Enable scanOnPush and block deployments on critical findings.
4. Forgetting to clean up old images — ECR charges for storage. Set lifecycle policies to expire untagged and old images automatically.
5. Cross-region pull latency — Pulling an image from a different region than your compute adds seconds to cold starts. Enable Replication or use regional registries.

Practice Questions

1. What is the difference between ECR and Docker Hub? ECR is private by default, integrates with IAM, supports vulnerability scanning, and has no pull rate limits for authenticated users.
2. How does ACR geo-Replication work? ACR Premium tier replicates images to specified regions. Pushes go to the primary region, and reads route to the nearest replica automatically.
3. What is the difference between GCR and Artifact Registry? Artifact Registry is the newer service supporting Docker, Maven, npm, and Python packages. GCR only supports Docker.
4. Why scan container images? Images contain OS packages and application dependencies with known vulnerabilities. Scanning identifies CVEs before they reach production.
5. Challenge: Design a CI/CD pipeline that builds a Docker image, scans it, pushes to a regional registry, and deploys to ECS. Fail the build on HIGH severity findings.

Mini Project

Set up a cross-region container pipeline:

• Build a multi-stage Docker image for a Go web app
• Push to ECR in us-east-1 with scan on push
• Replicate to eu-west-1 using ACR geo-Replication
• Deploy to ECS Fargate and AKS simultaneously
• Verify that each cluster pulls from its local region

FAQ

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.