Container Registry
Category:
Definition
A container registry is a storage and distribution system for OCI container images. Registries store images organized by repository and tag, and serve them to container runtimes that pull images for execution.
Detailed Explanation
A container registry is to container images what npm is to JavaScript packages — a versioned, addressable store you push to and pull from.
**Registry anatomy:**
A fully qualified image reference looks like: `ghcr.io/myorg/myapp:v1.2.3`
- `ghcr.io` — the registry host - `myorg/myapp` — the repository (namespace/name) - `v1.2.3` — the tag
Images are also addressable by digest: `ghcr.io/myorg/myapp@sha256:abc123...` — this is immutable and tamper-proof, unlike tags which can be reassigned.
**Public vs. private registries:**
Public registries (like Docker Hub's public repositories) allow anyone to pull images without authentication. Private registries require credentials.
**Major registries:**
| Registry | Host | Best for | |---|---|---| | Docker Hub | docker.io | Public images, official base images | | GitHub Container Registry | ghcr.io | GitHub-integrated workflows | | Google Artifact Registry | pkg.dev | GCP projects | | Amazon ECR | ecr.amazonaws.com | AWS projects | | Azure Container Registry | azurecr.io | Azure projects | | Kubeletto Internal | internal | Platform-built images |
**Registry operations:** - `docker build -t myapp:latest .` — build an image locally - `docker push ghcr.io/org/myapp:latest` — push to a registry - `docker pull nginx:alpine` — pull from Docker Hub - Kubeletto pulls images on deploy and pushes internally-built images automatically
How Kubeletto provides Container Registry
Kubeletto supports pulling images from any OCI-compliant registry: Docker Hub, GHCR, GCR, ECR, and private registries with credentials. Build pipelines using BuildKit push to an internal Kubeletto registry. Kubeletto's worker nodes pull images from this internal registry for deployment, ensuring secure, high-performance private image handling.
Frequently Asked Questions
How do I use a private registry with Kubeletto?
Add your registry credentials (username + password/token) as environment secrets in your Kubeletto app configuration. Kubeletto uses these to authenticate pulls from private registries.
Does Kubeletto have a built-in registry?
Yes. Kubeletto has an internal container registry used for storing images built by the platform's build pipelines. You don't interact with it directly — builds push to it automatically.
What is the difference between a tag and a digest?
A tag (like latest or v1.2.3) is a mutable pointer — it can be reassigned to a different image. A digest (sha256:...) is an immutable content hash that always refers to the exact same image bytes.
Related Terms
See Container Registry in action
Deploy your first app on Kubeletto — free during our active beta.