What Is a Container Registry?
Learn what a container registry is, how image tagging and pushes/pulls work, and how registries connect CI pipelines to Kubernetes deployments.
Expected Interview Answer
A container registry is a storage and distribution service for container images, letting teams push built images and pull them down onto any server or cluster that needs to run them.
Registries version images by tag, control access with authentication, and serve as the handoff point between CI pipelines that build images and runtime environments like Kubernetes that pull and run them. Public registries such as Docker Hub coexist with private registries hosted by cloud providers or self-managed, giving organizations control over image security and distribution.
- Central, versioned storage for container images
- Decouples image building from image running
- Supports access control for private images
- Integrates naturally with CI/CD pipelines
- Enables consistent deployment across environments
AI Mentor Explanation
A container registry is like a franchise's central kit store where every finished, tagged uniform set is stored after being made, so any ground the team plays at can request and receive the exact same kit. Coaches never hand-carry kits between venues; each stadium simply pulls the correct tagged set from the store before the match.
Step-by-Step Explanation
Step 1
Build the image
A CI pipeline builds a container image from a Dockerfile and application code.
Step 2
Tag the image
The image is tagged with a version identifier, such as a commit hash or semantic version.
Step 3
Push to the registry
The tagged image is pushed to a registry like Docker Hub, ECR, or GCR.
Step 4
Pull on deploy
Deployment targets pull the exact tagged image from the registry when starting containers.
Step 5
Access control
Authentication and permissions restrict who can push or pull private images.
What Interviewer Expects
- Defines a container registry as storage for versioned images
- Explains the push/pull workflow between CI and runtime
- Can name examples like Docker Hub, ECR, GCR, or ACR
- Understands access control for private registries
- Connects registries to Kubernetes image pulls
Common Mistakes
- Confusing a container registry with a container itself
- Thinking registries only store public images
- Not knowing images are versioned by tags
- Assuming a registry runs containers rather than storing them
Best Answer (HR Friendly)
“A container registry is a storage system for packaged application images, similar to an app store for internal software, where teams upload versions of their app and any server can download and run the exact same version consistently.”
Code Example
# Build and tag the image
docker build -t myregistry.io/team/api:1.4.0 .
# Push to the registry
docker push myregistry.io/team/api:1.4.0
# Pull the same image elsewhere
docker pull myregistry.io/team/api:1.4.0Follow-up Questions
- What is the difference between a public and a private container registry?
- How do you scan container images for vulnerabilities in a registry?
- What is image tagging strategy and why does 'latest' cause problems?
- How does Kubernetes authenticate to pull from a private registry?
- What is image layer caching and how does it speed up pushes?
MCQ Practice
1. What does a container registry primarily do?
A registry stores versioned container images so they can be pulled and run anywhere, but it does not run them itself.
2. How are different versions of an image distinguished?
Images are tagged with identifiers like version numbers or commit hashes to distinguish versions.
3. Which is an example of a container registry?
Docker Hub is a well-known public container registry; ECR, GCR, and ACR are cloud provider equivalents.
Flash Cards
What is a container registry? — A service that stores and distributes versioned container images.
How are image versions tracked? — Via tags, such as version numbers or commit hashes.
Name a public container registry. — Docker Hub.
What secures private images? — Authentication and access control on the registry.