Quay
By Red Hat
Quay is a container image registry, originally developed independently and later acquired by CoreOS and then Red Hat, that stores, scans, and distributes container images for use in Kubernetes and other container platforms. io hosted…
Definition
Quay is a container image registry, originally developed independently and later acquired by CoreOS and then Red Hat, that stores, scans, and distributes container images for use in Kubernetes and other container platforms. It is available both as Red Hat's managed Quay.io hosted service and as Red Hat Quay, a self-hosted product that organizations run on their own infrastructure, with built-in vulnerability scanning and fine-grained access control across both deployment models.
Overview
Container-based deployment requires a registry that stores built images and serves them to whatever platform ultimately runs the containers, and Quay was built to fill that role with an emphasis on security scanning and enterprise access control beyond what a bare container registry provides. It predates Red Hat's ownership, having been created as an independent registry service before being acquired first by CoreOS and folded into Red Hat when Red Hat acquired CoreOS, after which Quay became a core piece of Red Hat's container and Kubernetes product line, particularly OpenShift. Mechanically, Quay implements the standard container registry protocol used to push and pull OCI-compliant images, the same interface Docker and Kubernetes expect, so it works as a drop-in registry for existing container tooling. On top of that base, it layers automated vulnerability scanning that inspects image layers for known security issues as images are pushed, robocopy-style geo-replication for the self-hosted Red Hat Quay product so images can be mirrored across multiple data centers, and detailed role-based access controls at the level of individual repositories and teams, which matters for organizations that need to segregate which teams can push or pull specific images. Quay differs from Docker Hub, the most widely known public registry, primarily in its enterprise security posture and its tight integration with Red Hat's OpenShift Kubernetes platform, where Quay is commonly the default or recommended registry. It also overlaps with other enterprise registries such as JFrog Artifactory's container support and cloud-provider registries like Amazon ECR or Google Artifact Registry, differentiating mainly through its scanning depth and the option to self-host with geo-replication rather than relying solely on a cloud provider's managed offering. In practice, organizations running OpenShift or other Kubernetes-based platforms use Quay as the registry their build pipelines push images to and their clusters pull images from, relying on its scanning to catch known vulnerabilities before images reach production and its access controls to restrict which teams or automated systems can publish to sensitive repositories. Quay.io, the hosted public instance, also serves open-source projects that want free public image hosting with security scanning included. Self-hosting Red Hat Quay requires meaningful operational investment, similar to any stateful enterprise service, including storage backend configuration and scaling, while the hosted Quay.io service removes that burden at the cost of less control over data residency and infrastructure placement. Teams already standardized on a particular cloud provider sometimes find that provider's native container registry, tightly integrated with its own IAM and compute services, a simpler default than adding Quay as a separate component.
Key Features
- OCI-compliant container image storage compatible with Docker and Kubernetes
- Automated vulnerability scanning on image push
- Geo-replication across data centers in the self-hosted Red Hat Quay product
- Fine-grained role-based access control per repository and team
- Available as hosted Quay.io or self-hosted Red Hat Quay
- Tight integration with Red Hat OpenShift as its default registry
- Repository-level visibility controls for public and private images
- Robot accounts for automated CI/CD image push and pull