Container Registries

# Sign with cosign (recommended)
cosign sign --key cosign.key myregistry.io/myapp:v1.0.0
 
# Verify before deployment
cosign verify --key cosign.pub myregistry.io/myapp:v1.0.0
 
# Sign with notation (CNCF standard)
notation sign myregistry.io/myapp:v1.0.0
 
# Admission policy in Kubernetes
apiVersion: v1
kind: ConfigMap
metadata:
  name: cosign-policy
data:
  policy.yaml: |
    apiVersion: v1alpha1
    kind: ClusterImagePolicy
    metadata:
      name: require-signature
    spec:
      images:
      - glob: "myregistry.io/**"
      authorities:
      - key:
          data: |
            -----BEGIN PUBLIC KEY-----
            MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
            -----END PUBLIC KEY-----

# Dockerfile with multi-arch support
FROM --platform=$BUILDPLATFORM node:20-alpine AS builder
ARG TARGETPLATFORM
ARG BUILDPLATFORM
RUN echo "Building on $BUILDPLATFORM for $TARGETPLATFORM"
 
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
 
FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]

# Build and push multi-arch with Docker Buildx
docker buildx create --use
docker buildx build --platform linux/amd64,linux/arm64 \
  -t myregistry.io/myapp:v1.0.0 --push .
 
# Registry stores a manifest list that references
# architecture-specific images
docker manifest inspect myregistry.io/myapp:v1.0.0

# Pull-through cache configuration in ECR
apiVersion: v1
kind: ConfigMap
metadata:
  name: registry-mirror-config
data:
  config.yaml: |
    mirrors:
      docker.io:
        endpoint:
          - https://123456789.dkr.ecr.us-east-1.amazonaws.com
      registry-1.docker.io:
        endpoint:
          - https://123456789.dkr.ecr.us-east-1.amazonaws.com

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Keep last 10 production images",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["v"],
        "countType": "imageCountMoreThan",
        "countNumber": 10
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "Delete untagged images older than 1 day",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 1
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}

# GitHub Actions with GHCR
name: Build and Push
on:
  push:
    branches: [main]
 
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:latest
            ghcr.io/${{ github.repository }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max