{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"platform/container-registry","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/platform/container-registry/","da":"https://cmaintz.github.io/tech-atlas/da/terms/platform/container-registry/"},"term":{"en":"Container registry","da":"Container-register (registry)"},"aka":{"en":["image registry"],"da":["image-register"]},"domain":["platform"],"cluster":"containers","layer":"delivery","status":"current","era":2014,"summary":{"en":"A shared online store where container images are uploaded, given names and versions, and fetched by the machines that run them.","da":"Et fælles onlinelager, hvor container-images lægges op, får navne og versioner og hentes af de maskiner, der kører dem."},"body":{"formal":{"en":"A server that keeps container images in named collections, each image marked with version labels and a unique fingerprint of its content, and that hands them out to anyone with the right to push or pull them.","da":"En server, der opbevarer container-images i navngivne samlinger, hvor hvert image er mærket med versionsnavne og et unikt fingeraftryk af indholdet, og som udleverer dem til dem, der har ret til at lægge op eller hente."},"plain":{"en":"Like a library for software boxes - builders hand in new editions, and every machine borrows the exact edition it asks for by name.","da":"Som et bibliotek for softwarekasser - dem, der bygger, afleverer nye udgaver, og hver maskine låner præcis den udgave, den beder om ved navn."},"inPractice":{"en":"At a shipping company, the pipeline builds the booking system's image, pushes it to the company's private registry as version 2.4, and Kubernetes pulls exactly that version onto each machine.","da":"Hos et rederi bygger pipelinen bookingsystemets image, lægger det op i rederiets private registry som version 2.4, og Kubernetes henter præcis den version ned på hver maskine."},"whyItMatters":{"en":"Whoever can push to a registry decides what code runs in production, so an open or careless registry is a direct way into the software supply chain.","da":"Den, der kan lægge images op i et registry, bestemmer, hvilken kode der kører i drift, så et åbent eller sjusket registry er en direkte vej ind i softwareforsyningskæden."}},"deepDive":{"en":"Registries speak the OCI Distribution Specification, which grew out of the Docker Registry HTTP API V2. Everything lives under /v2/: a client pulls by requesting GET /v2/<name>/manifests/<reference>, where the reference is a tag or a digest, and then fetches each layer and config via GET /v2/<name>/blobs/<digest>. Pushing is the reverse: blobs are uploaded first (POST to open an upload session, optional PATCH chunks, a final PUT with ?digest=), and the manifest is pushed last, which is what makes the new tag visible. Blobs are deduplicated by digest across repositories, so a common base layer is stored once. Authentication is usually the token flow: the registry answers 401 with a WWW-Authenticate: Bearer challenge naming a token service and a scope such as repository:team/app:pull,push, and the client returns with a short-lived JWT.\n\nDistribution spec 1.1 added the referrers API (GET /v2/<name>/referrers/<digest>), which lists artifacts whose subject field points at a given manifest. This is how signatures, SBOMs, SLSA provenance and scan results are attached to an image without changing its digest; older registries without the API are served by a fallback tag scheme (sha256-<digest>).\n\nImplementations range from the CNCF Distribution project and Harbor (with built-in scanning, replication, quotas and robot accounts) to Zot and Quay, plus the cloud services Amazon ECR, Azure Container Registry, Google Artifact Registry and GitHub Container Registry. Docker Hub is the implicit default: an unqualified name such as nginx expands to docker.io/library/nginx, a behaviour that creates ambiguity and has led tools such as Podman to require fully qualified names or explicit aliases.\n\nThe registry sits at a trust junction in the software supply chain. Risks include mutable tags being overwritten (mitigated by tag-immutability settings and deploying by digest), leaked push credentials from CI, publicly readable private repositories exposing embedded secrets, typosquatted or malicious public images (cryptominers in look-alike repositories on Docker Hub are a recurring finding), and dependence on a public registry's availability and pull rate limits. Common controls are a private pull-through cache or mirror so that production pulls only from an internal registry, separate push identities per pipeline using short-lived OIDC federation rather than static passwords, continuous scanning of stored images, retention and garbage-collection policies, and an admission controller that refuses images from unapproved registries or without a valid signature. A registry is distinct from a package repository such as npm or PyPI in serving whole runtime filesystems, and distinct from the runtime, which only consumes what the registry serves.","da":"Registries taler OCI Distribution Specification, der voksede ud af Docker Registry HTTP API V2. Alt ligger under /v2/: en klient henter ved at kalde GET /v2/<navn>/manifests/<reference>, hvor referencen er et tag eller en digest, og henter derefter hvert lag og config via GET /v2/<navn>/blobs/<digest>. At lægge op foregår omvendt: blobs uploades først (POST åbner en upload-session, eventuelle PATCH-bidder, et afsluttende PUT med ?digest=), og manifestet lægges op til sidst, hvilket er det, der gør det nye tag synligt. Blobs deduplikeres via digest på tværs af repositories, så et fælles base-lag kun gemmes én gang. Godkendelse sker typisk via token-flowet: registryet svarer 401 med en WWW-Authenticate: Bearer-udfordring, der angiver en token-tjeneste og et scope som repository:team/app:pull,push, og klienten vender tilbage med et kortlivet JWT.\n\nDistributionsspecifikationen 1.1 tilføjede referrers-API'et (GET /v2/<navn>/referrers/<digest>), der lister artefakter, hvis subject-felt peger på et givet manifest. Det er sådan, signaturer, SBOM'er, SLSA-provenance og scanningsresultater knyttes til et image uden at ændre dets digest; ældre registries uden API'et betjenes af en reserveordning med tags (sha256-<digest>).\n\nImplementeringerne spænder fra CNCF-projektet Distribution og Harbor (med indbygget scanning, replikering, kvoter og robotkonti) til Zot og Quay samt cloudtjenesterne Amazon ECR, Azure Container Registry, Google Artifact Registry og GitHub Container Registry. Docker Hub er den underforståede standard: et ukvalificeret navn som nginx udvides til docker.io/library/nginx, en adfærd, der skaber tvetydighed og har fået værktøjer som Podman til at kræve fuldt kvalificerede navne eller eksplicitte aliasser.\n\nRegistryet står i et knudepunkt for tillid i softwareforsyningskæden. Risici er bl.a. foranderlige tags, der overskrives (afhjælpes med uforanderlige tags og udrulning via digest), lækkede push-legitimationsoplysninger fra CI, private repositories, der ved en fejl kan læses offentligt og afslører indlejrede hemmeligheder, typosquattede eller ondsindede offentlige images (kryptominere i forvekslelige repositories på Docker Hub er et tilbagevendende fund) samt afhængighed af et offentligt registrys tilgængelighed og grænser for antal pulls. Typiske kontroller er en privat pull-through-cache eller et spejl, så produktion kun henter fra et internt registry, separate push-identiteter per pipeline med kortlivet OIDC-føderering i stedet for faste adgangskoder, løbende scanning af lagrede images, politikker for opbevaring og oprydning (garbage collection) og en admission controller, der afviser images fra ikke-godkendte registries eller uden gyldig signatur. Et registry adskiller sig fra et pakke-repository som npm eller PyPI ved at levere hele runtime-filsystemer, og fra runtimen, der kun forbruger det, registryet udleverer."},"edges":[{"type":"requires","to":"platform/container-image","confidence":"high","strength":"normal"},{"type":"part-of","to":"platform/software-supply-chain","confidence":"high","strength":"normal"},{"type":"used-with","to":"platform/docker","confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"Docker Docs - What is a registry?","url":"https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-a-registry/","tier":"official-doc","publisher":"Docker"},{"title":"NIST SP 800-190 - Application Container Security Guide","tier":"standard","publisher":"NIST"}],"draft":true}