Container registry security: security concerns for using a container registry

Containers are an important element in the DevOps process. They isolate the software component of an application to allow for consistent deployment into any computing environment. This means that apps in containers will behave exactly the same all the time.

What is a container registry?

A container registry is a repository — or a collection of repositories — that stores container images, which includes all the components that make up an application. As part of the DevOps process, container registries support container-based application development and can connect to container orchestration platforms. The container registry not only stores images but also offers a location from which developers can share them in the following ways:

1. Pushing: uploading images to the registry

2. Pulling: downloading images into another system, such as Docker or Kubernetes

There may be some who use the terms “registry” and “repository” as interchangeable, but they have two very different functions in containers. Repositories are for storing and managing images. Registries consist of multiple repositories but can also store API paths and access control guidelines.

There are different types of repositories, as well. They are:

• Locally managed

• Remotely used as caching proxies

• Generic without a specific package association

• Virtual collections of remote and local in one URL

According to the Cloud Native Computing Foundation (CNCF), container images and registries play a vital role in DevOps and cloud native application development. Image registries are then available throughout each phase of the development process.

There are two types of registries: public and private, with plenty of options available for each type. Before making that choice, developers should determine:

• Which components should be stored in the registry. In addition to images, there are a number of different platforms, code, and packages that will be stored and accessed from the container. Not all containers support anything except image registries.

• What level of security is needed.

• Where the registry will be hosted.

How is a private registry different from a public registry?

A public container registry is an easier and quicker option because developers don’t have to deal with setting up any infrastructure. Public container registries are used most often by small teams or individuals relying on open source images. However, public registries tend to be less secure.

A private container registry is set up by the organization, which offers developers the opportunity to incorporate security and data privacy within enterprise container image storage. Developers have total control over private container registries, which can be hosted either on-premise or remotely. The greatest benefits of a private registry are the freedom to manage it any way the organization likes and the ability to add whatever security measures are deemed necessary.

Private or public: Which should you use?

Public container registry services are the best option for very small teams without a budget to work with, as there are free options available. However, these free options come with limitations on how often a container image can be pulled in a set time period. But the public option also means developers don’t have to work from scratch; images already available can be used in on-going projects.

If data privacy is a top concern, private container registries should be used. Although there are public enterprise container registries, consideration should be taken at the level of privacy and security that is needed. Truly sensitive data or anything that relies on an organization’s intellectual property should be stored in a private container registry. Also, anything that requires any type of regulatory governance should be tightly controlled environments. Private containers offer the ability to control where images are stored and how they are distributed.

Which registries are the most secure?

Some of the most secure container registries available include:

• Docker Hub

• GitHub Container Registry

• Nexus

• DigitalOcean

• GitLab Container Registry

• Google Artifact Registry

• Amazon Elastic Container Registry

• Microsoft Azure Container Registry

• Jfrog Artifactory

Registries by themselves are neither secure nor insecure, so organizations should look for solutions that integrate easily with security tools.

Staying secure using container registries

Container security is a layered approach with multiple processes, tools, and other resources. The container itself needs to be well-constructed following security best practices to decrease the risk of exploitable vulnerabilities. And then each layer of the container needs its own security. Those layers are:

• Container image and its software

• Interaction between the initial container, operating system, and other containers

• The host operating system

• Networking and storage

• Runtime in Kubernetes clusters

A secure container image is the highest priority and this is achieved by following three steps.

1. Secure your code and its dependencies from the beginning. Automating this process helps developers to find potential issues early. 

2. Build from a minimal base image from a trusted source. Docker Hub has millions of images and millions more repositories. Just as important, it has Verified Publishers that offer a trusted starting point for building up images.

3. Manage all layers throughout the development lifecycle. This may be the most difficult area to manage vulnerabilities. By starting at the minimal base, adding security tools as they are needed to make them easier to remove or rebuild through the lifecycle.

Snyk Container is an image scanning solution for detecting potential vulnerabilities and offering recommendations for improving image security and slimming down base images. It’s also integrated with popular container registries so that developers can ensure the images they use across software projects are secure.