Managing Container Registries
Overview
Manage container registries across Docker Hub, AWS ECR, GCP Artifact Registry, Azure ACR, and self-hosted registries (Harbor, Nexus). Automate image tagging, lifecycle policies, cross-region replication, vulnerability scanning integration, and access control for container image storage and distribution.
Prerequisites
- Docker CLI installed and authenticated to the target registry
- Cloud provider CLI (
aws, gcloud, az) for managed registries
- Registry credentials configured (
docker login or credential helpers)
- Understanding of image naming conventions (registry/namespace/image:tag)
- IAM permissions for registry operations (push, pull, delete, admin)
Instructions
- Identify the target registry type: ECR, Artifact Registry, ACR, Docker Hub, or self-hosted
- Configure authentication: set up credential helpers for automated access (
docker-credential-ecr-login, gcloud auth configure-docker)
- Define image naming and tagging strategy: use semantic versioning for releases, git SHA for CI builds,
latest only for development
- Create repository/namespace structure organized by team, application, or environment
- Configure lifecycle policies to auto-delete untagged images and images older than retention threshold (e.g., keep last 10 tagged images, delete untagged after 7 days)
- Set up vulnerability scanning: enable automatic scanning on push (ECR scan-on-push, GCP Container Analysis)
- Configure cross-region replication for disaster recovery and latency reduction
- Implement access control: read-only for CI pull, push access for CI build agents, admin for operators
- Generate Terraform/IaC for registry infrastructure and policies
Output
- Terraform/CloudFormation for registry creation with lifecycle and replication policies
- Docker credential helper configuration scripts
- CI/CD pipeline steps for building, tagging, and pushing images
- Lifecycle policy JSON (ECR) or cleanup scripts (Docker Hub, Harbor)
- RBAC configurations for registry access control
Error Handling
| Error |
Cause |
Solution |
denied: requested access to the resource is denied |
Missing push/pull permissions or expired token |
Re-authenticate with docker login or refresh credential helper; verify IAM policies |
manifest unknown: manifest unknown |
Image tag does not exist in the registry |
Verify image name and tag; check if lifecycle policy deleted the image |
no space left on device during push |
Registry storage quota exceeded |
Increase quota, run lifecycle cleanup, or delete unused images |
unauthorized: authentication required |
Credential helper not configured or token expired |
Set up credential helper (aws ecr get-login-password, gcloud auth configure-docker) |
toomanyrequests: rate limit exceeded |
Docker Hub pull rate limit hit |
Use authenticated pulls, mirror images to private registry, or upgrade Docker Hub plan |
Examples
- "Set up an AWS ECR repository with scan-on-push enabled, lifecycle policy to keep last 20 tagged images, and cross-region replication to us-west-2."
- "Configure GCP Artifact Registry with Docker credential helper and a cleanup policy for images not pulled in 90 days."
- "Create a CI pipeline step that builds a Docker image, tags it with the git SHA and
latest, pushes to ECR, and fails if Critical vulnerabilities are found."
Resources
Source: jeremylongshore/claude-code-plugins-plus-skills → skills/.curated/managing-container-registries/SKILL.md
Also appears in: jeremylongshore/claude-code-plugins-plus-skills/plugins/devops/container-registry-manager/skills/managing-container-registries/SKILL.md
1---2name: managing-container-registries3description: 'Execute use when you need to work with containerization. This skill provides container management and orchestration with comprehensive guidance and automation. Trigger with phrases like "containerize app", "manage containers", or "orchestrate deployment". '4---56# Managing Container Registries78## Overview910Manage container registries across Docker Hub, AWS ECR, GCP Artifact Registry, Azure ACR, and self-hosted registries (Harbor, Nexus). Automate image tagging, lifecycle policies, cross-region replication, vulnerability scanning integration, and access control for container image storage and distribution.1112## Prerequisites1314- Docker CLI installed and authenticated to the target registry15- Cloud provider CLI (`aws`, `gcloud`, `az`) for managed registries16- Registry credentials configured (`docker login` or credential helpers)17- Understanding of image naming conventions (registry/namespace/image:tag)18- IAM permissions for registry operations (push, pull, delete, admin)1920## Instructions21221. Identify the target registry type: ECR, Artifact Registry, ACR, Docker Hub, or self-hosted232. Configure authentication: set up credential helpers for automated access (`docker-credential-ecr-login`, `gcloud auth configure-docker`)243. Define image naming and tagging strategy: use semantic versioning for releases, git SHA for CI builds, `latest` only for development254. Create repository/namespace structure organized by team, application, or environment265. Configure lifecycle policies to auto-delete untagged images and images older than retention threshold (e.g., keep last 10 tagged images, delete untagged after 7 days)276. Set up vulnerability scanning: enable automatic scanning on push (ECR scan-on-push, GCP Container Analysis)287. Configure cross-region replication for disaster recovery and latency reduction298. Implement access control: read-only for CI pull, push access for CI build agents, admin for operators309. Generate Terraform/IaC for registry infrastructure and policies3132## Output3334- Terraform/CloudFormation for registry creation with lifecycle and replication policies35- Docker credential helper configuration scripts36- CI/CD pipeline steps for building, tagging, and pushing images37- Lifecycle policy JSON (ECR) or cleanup scripts (Docker Hub, Harbor)38- RBAC configurations for registry access control3940## Error Handling4142| Error | Cause | Solution |43|-------|-------|---------|44| `denied: requested access to the resource is denied` | Missing push/pull permissions or expired token | Re-authenticate with `docker login` or refresh credential helper; verify IAM policies |45| `manifest unknown: manifest unknown` | Image tag does not exist in the registry | Verify image name and tag; check if lifecycle policy deleted the image |46| `no space left on device` during push | Registry storage quota exceeded | Increase quota, run lifecycle cleanup, or delete unused images |47| `unauthorized: authentication required` | Credential helper not configured or token expired | Set up credential helper (`aws ecr get-login-password`, `gcloud auth configure-docker`) |48| `toomanyrequests: rate limit exceeded` | Docker Hub pull rate limit hit | Use authenticated pulls, mirror images to private registry, or upgrade Docker Hub plan |4950## Examples5152- "Set up an AWS ECR repository with scan-on-push enabled, lifecycle policy to keep last 20 tagged images, and cross-region replication to us-west-2."53- "Configure GCP Artifact Registry with Docker credential helper and a cleanup policy for images not pulled in 90 days."54- "Create a CI pipeline step that builds a Docker image, tags it with the git SHA and `latest`, pushes to ECR, and fails if Critical vulnerabilities are found."5556## Resources5758- AWS ECR: https://docs.aws.amazon.com/AmazonECR/latest/userguide/59- GCP Artifact Registry: https://cloud.google.com/artifact-registry/docs60- Azure ACR: https://learn.microsoft.com/en-us/azure/container-registry/61- Harbor registry: https://goharbor.io/docs/62- Docker Hub: https://docs.docker.com/docker-hub/6364---6566**Source:** [`jeremylongshore/claude-code-plugins-plus-skills`](https://github.com/jeremylongshore/claude-code-plugins-plus-skills) → `skills/.curated/managing-container-registries/SKILL.md`6768**Also appears in:** `jeremylongshore/claude-code-plugins-plus-skills/plugins/devops/container-registry-manager/skills/managing-container-registries/SKILL.md`
thedixitjain